Analysis
- max time kernel
148s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240704-en - resource tags
- submitted
05/07/2024, 19:22
General
- Target c8ef778ff1e9493aecd06b7be81c033356d288235494e6ae5d67bd0cc6789195.exe
- Size 457KB
- Sample240705-x3cx7stemn
- SHA256 c8ef778ff1e9493aecd06b7be81c033356d288235494e6ae5d67bd0cc6789195
Malware Config
Signatures
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Loads dropped DLL 3 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Drops file in System32 directory 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 3 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8ef778ff1e9493aecd06b7be81c033356d288235494e6ae5d67bd0cc6789195.exe"C:\Users\Admin\AppData\Local\Temp\c8ef778ff1e9493aecd06b7be81c033356d288235494e6ae5d67bd0cc6789195.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Lovkrav=Get-Content 'C:\Users\Admin\AppData\Local\Temp\overmandede\Metran\menubilledet\Radioaktivest.Sup';$Exorable=$Lovkrav.SubString(70678,3);.$Exorable($Lovkrav)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"3⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_50z5zp3f.ugf.ps1
Banner.dll
BgImage.dll
nsDialogs.dll
Lighedspunkternes.Fla
Radioaktivest.Sup
0f5007522459c86e95ffcc62f32308f1_3391016d-f0b6-457a-866d-88b771c7b6ac
0f5007522459c86e95ffcc62f32308f1_3391016d-f0b6-457a-866d-88b771c7b6ac
memory/1636-78-0x0000000000E00000-0x0000000004C7D000-memory.dmp
memory/1636-64-0x0000000077721000-0x0000000077841000-memory.dmp
memory/1636-65-0x00000000777A8000-0x00000000777A9000-memory.dmp
memory/3832-49-0x0000000007410000-0x00000000079B4000-memory.dmp
memory/3832-31-0x0000000073A00000-0x00000000741B0000-memory.dmp
memory/3832-44-0x0000000005BD0000-0x0000000005BEE000-memory.dmp
memory/3832-45-0x0000000005C00000-0x0000000005C4C000-memory.dmp
memory/3832-46-0x0000000006120000-0x00000000061B6000-memory.dmp
memory/3832-47-0x00000000060C0000-0x00000000060DA000-memory.dmp
memory/3832-48-0x0000000006BC0000-0x0000000006BE2000-memory.dmp
memory/3832-33-0x0000000005560000-0x00000000055C6000-memory.dmp
memory/3832-32-0x00000000054F0000-0x0000000005556000-memory.dmp
memory/3832-51-0x0000000008040000-0x00000000086BA000-memory.dmp
memory/3832-53-0x0000000073A00000-0x00000000741B0000-memory.dmp
memory/3832-54-0x0000000073A00000-0x00000000741B0000-memory.dmp
memory/3832-55-0x0000000073A00000-0x00000000741B0000-memory.dmp
memory/3832-39-0x00000000055D0000-0x0000000005924000-memory.dmp
memory/3832-57-0x0000000073A00000-0x00000000741B0000-memory.dmp
memory/3832-58-0x00000000086C0000-0x000000000C53D000-memory.dmp
memory/3832-60-0x0000000073A0E000-0x0000000073A0F000-memory.dmp
memory/3832-61-0x0000000073A00000-0x00000000741B0000-memory.dmp
memory/3832-62-0x0000000073A00000-0x00000000741B0000-memory.dmp
memory/3832-63-0x0000000073A00000-0x00000000741B0000-memory.dmp
memory/3832-30-0x0000000004D20000-0x0000000004D42000-memory.dmp
memory/3832-29-0x0000000073A00000-0x00000000741B0000-memory.dmp
memory/3832-28-0x0000000004E10000-0x0000000005438000-memory.dmp
memory/3832-27-0x00000000022A0000-0x00000000022D6000-memory.dmp
memory/3832-26-0x0000000073A0E000-0x0000000073A0F000-memory.dmp