Analysis
-
max time kernel
125s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02-08-2024 16:05
Static task
static1
Behavioral task
behavioral1
Sample
10ac2e565601cd6061779132e5dbef043c2edd7639078edb7367bcd96bcb6be8.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
10ac2e565601cd6061779132e5dbef043c2edd7639078edb7367bcd96bcb6be8.exe
Resource
win11-20240730-en
General
-
Target
10ac2e565601cd6061779132e5dbef043c2edd7639078edb7367bcd96bcb6be8.exe
-
Size
756KB
-
MD5
cd6379f0633857d7a4eaa981bac6f6a5
-
SHA1
dca4e3fd682a4025f7ed3dbda78acc2478ba0932
-
SHA256
10ac2e565601cd6061779132e5dbef043c2edd7639078edb7367bcd96bcb6be8
-
SHA512
c2f0875b6cd0ad56f5bcaec5c5171686f96f5dbebeed789c903b980e36c21df8f9dcecfc33ddd4c589608d6d600bd8dbb77b31a0de0a7c154778aea7fededf87
-
SSDEEP
12288:zcrNS33L10QdrXpDs7nEAePHgkBEEcVc5e7rwKHIIPeimkAz/:yNA3R5drXpA7EAPkB/cVc5cciIIPeRV/
Malware Config
Extracted
lokibot
http://94.156.66.169:5988/dghdfghdfstgd/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation 10ac2e565601cd6061779132e5dbef043c2edd7639078edb7367bcd96bcb6be8.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation cfhxnghd.sfx.exe -
Executes dropped EXE 4 IoCs
pid Process 3380 cfhxnghd.sfx.exe 1556 cfhxnghd.exe 4988 cfhxnghd.exe 1832 cfhxnghd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook cfhxnghd.exe Key opened \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook cfhxnghd.exe Key opened \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook cfhxnghd.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1556 set thread context of 4988 1556 cfhxnghd.exe 89 PID 1556 set thread context of 1832 1556 cfhxnghd.exe 90 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10ac2e565601cd6061779132e5dbef043c2edd7639078edb7367bcd96bcb6be8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cfhxnghd.sfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cfhxnghd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1556 cfhxnghd.exe Token: SeDebugPrivilege 4988 cfhxnghd.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 232 wrote to memory of 2544 232 10ac2e565601cd6061779132e5dbef043c2edd7639078edb7367bcd96bcb6be8.exe 84 PID 232 wrote to memory of 2544 232 10ac2e565601cd6061779132e5dbef043c2edd7639078edb7367bcd96bcb6be8.exe 84 PID 232 wrote to memory of 2544 232 10ac2e565601cd6061779132e5dbef043c2edd7639078edb7367bcd96bcb6be8.exe 84 PID 2544 wrote to memory of 3380 2544 cmd.exe 87 PID 2544 wrote to memory of 3380 2544 cmd.exe 87 PID 2544 wrote to memory of 3380 2544 cmd.exe 87 PID 3380 wrote to memory of 1556 3380 cfhxnghd.sfx.exe 88 PID 3380 wrote to memory of 1556 3380 cfhxnghd.sfx.exe 88 PID 3380 wrote to memory of 1556 3380 cfhxnghd.sfx.exe 88 PID 1556 wrote to memory of 4988 1556 cfhxnghd.exe 89 PID 1556 wrote to memory of 4988 1556 cfhxnghd.exe 89 PID 1556 wrote to memory of 4988 1556 cfhxnghd.exe 89 PID 1556 wrote to memory of 4988 1556 cfhxnghd.exe 89 PID 1556 wrote to memory of 4988 1556 cfhxnghd.exe 89 PID 1556 wrote to memory of 4988 1556 cfhxnghd.exe 89 PID 1556 wrote to memory of 4988 1556 cfhxnghd.exe 89 PID 1556 wrote to memory of 4988 1556 cfhxnghd.exe 89 PID 1556 wrote to memory of 4988 1556 cfhxnghd.exe 89 PID 1556 wrote to memory of 1832 1556 cfhxnghd.exe 90 PID 1556 wrote to memory of 1832 1556 cfhxnghd.exe 90 PID 1556 wrote to memory of 1832 1556 cfhxnghd.exe 90 PID 1556 wrote to memory of 1832 1556 cfhxnghd.exe 90 PID 1556 wrote to memory of 1832 1556 cfhxnghd.exe 90 PID 1556 wrote to memory of 1832 1556 cfhxnghd.exe 90 PID 1556 wrote to memory of 1832 1556 cfhxnghd.exe 90 PID 1556 wrote to memory of 1832 1556 cfhxnghd.exe 90 PID 1556 wrote to memory of 1832 1556 cfhxnghd.exe 90 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook cfhxnghd.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook cfhxnghd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\10ac2e565601cd6061779132e5dbef043c2edd7639078edb7367bcd96bcb6be8.exe"C:\Users\Admin\AppData\Local\Temp\10ac2e565601cd6061779132e5dbef043c2edd7639078edb7367bcd96bcb6be8.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cystsdf.cmd" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\cfhxnghd.sfx.execfhxnghd.sfx.exe -pgntmdewsxkopyethnymkdesppodtyuhngfszafugyRhvqxsdfHbgnmeG -dC:\Users\Admin\AppData\Local\Temp3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\cfhxnghd.exe"C:\Users\Admin\AppData\Local\Temp\cfhxnghd.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\cfhxnghd.exeC:\Users\Admin\AppData\Local\Temp\cfhxnghd.exe5⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4988
-
-
C:\Users\Admin\AppData\Local\Temp\cfhxnghd.exeC:\Users\Admin\AppData\Local\Temp\cfhxnghd.exe5⤵
- Executes dropped EXE
PID:1832
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
382KB
MD5e686b67962514cfaac0b4ebe6d6541bd
SHA10d2633cb7769b3b7668d9a6c8493c4e644d1c144
SHA256c3bace19b645a065d8ca464589bcdedb6937228017ae77bdb24444d8afd20240
SHA512bb093879ff668a19dacd33ea754da9ba4961d1ec002f86806aeec0eafcd7f381e7e94ea99e2436bdb52a4d266fd5994dfc8138bf58ab10d1262cb2e10f54a839
-
Filesize
610KB
MD5113c7ad4fbc084f4c54e4f63fc40951b
SHA1396466b81af507cecb8d00fc4dae6bc5e6d7a007
SHA256e9dcbb78f40028dda77bd83b494c17f54d504e02c91cbbda33c244635086653b
SHA512a5fc98b89b73245f9d3438e02db91a4821e054024d4d3c15eff12a23bc705f8463cf786f824a8564d69e97c8f886fd17cdd0d9a2a19aa53a658211133e766e44
-
Filesize
18KB
MD583b548a846f71715022a31eb0d8773e0
SHA1c6267a8e2a9f81c0136e84b0003ed1a1a3e833eb
SHA256be2be80408b5a78dd4d80b7a2365c79457e3e4e9b084a6a749cd19f725ad328d
SHA512005d8cd9298765ecc6ef83b92f0b3b70b3e0e094dbcfe8e8003a248e4726b3e8a8db406438f4ddb4cfbf3fb1cfcc42a8df2469483fcf6e7bde8419832b5f44af
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4182098368-2521458979-3782681353-1000\0f5007522459c86e95ffcc62f32308f1_ea0aa4d6-aa48-4733-9e64-85ab59ce35b0
Filesize46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4182098368-2521458979-3782681353-1000\0f5007522459c86e95ffcc62f32308f1_ea0aa4d6-aa48-4733-9e64-85ab59ce35b0
Filesize46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b