Malware Analysis Report

2025-05-28 17:40

Sample ID 250122-jtpzhswrbk
Target 9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe
SHA256 9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b
Tags
lokibot collection discovery persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b

Threat Level: Known bad

The file 9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe was found to be: Known bad.

Malicious Activity Summary

lokibot collection discovery persistence spyware stealer trojan

Lokibot family

Lokibot

Checks computer location settings

Reads user/profile data of web browsers

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

outlook_win_path

Suspicious use of AdjustPrivilegeToken

outlook_office_path

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-22 07:57

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-22 07:57

Reported

2025-01-22 07:59

Platform

win7-20240903-en

Max time kernel

117s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe"

Signatures

Lokibot

trojan spyware stealer lokibot

Lokibot family

lokibot

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\objectstoff = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\objectpluriseptate.vbs\"" C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe N/A
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe N/A
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe N/A
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3064 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe
PID 3064 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe
PID 3064 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe
PID 3064 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe
PID 2544 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 2544 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 2544 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 2544 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 2472 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 2472 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 2472 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 2472 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 484 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 484 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 484 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 484 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 484 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 484 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 484 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 484 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 484 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 484 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 484 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe

"C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe"

C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe

"C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe"

C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe

"C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe"

C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe

"C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe"

C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe

"C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 itjskjban.gq udp

Files

memory/3064-2-0x0000000000460000-0x0000000000463000-memory.dmp

memory/3064-4-0x0000000076EB1000-0x0000000076FB2000-memory.dmp

memory/3064-5-0x0000000076EB0000-0x0000000077059000-memory.dmp

C:\Windows\win.ini

MD5 d2a2412bddba16d60ec63bd9550d933f
SHA1 deb3d3bdc9055f0b4909b31d3048446848fae0e1
SHA256 79ff2254e38192be1626d05bec6c82e10c85e1cf91df7440c4c443380a1e877a
SHA512 8fecada107f72e59e43a689eeb8e2e18fa6134d0941c122025ed5bd00e5eab8114d7125bd289505be75641385a0c3f112d402c693f142c3ddc870d5fa8116e31

memory/2544-11-0x0000000076EB0000-0x0000000077059000-memory.dmp

memory/3064-10-0x0000000000460000-0x0000000000463000-memory.dmp

memory/3064-12-0x00000000770A0000-0x0000000077176000-memory.dmp

\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe

MD5 80f48fb858fdabdc7434d33750c0d10b
SHA1 3252f4dc28acb6781e5baa9791e01581c4b93833
SHA256 67ea8013e2c974c9f85a49e39e74a9444b186704175379c85f29a5b4e19538e1
SHA512 50c28cd5b781acde177194ff088bf6cbb7be38803c00697039581b6b0a790a3c62d49458bd08a24767b3862933083b32e38004678d66b5b949983eb5a2489059

memory/2848-35-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2848-37-0x0000000000400000-0x00000000004A2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2872745919-2748461613-2989606286-1000\0f5007522459c86e95ffcc62f32308f1_4d69f9e1-559c-46cf-82ac-67913db47c55

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2872745919-2748461613-2989606286-1000\0f5007522459c86e95ffcc62f32308f1_4d69f9e1-559c-46cf-82ac-67913db47c55

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

memory/2848-73-0x0000000000400000-0x00000000004A2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-22 07:57

Reported

2025-01-22 07:59

Platform

win10v2004-20241007-en

Max time kernel

116s

Max time network

94s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe"

Signatures

Lokibot

trojan spyware stealer lokibot

Lokibot family

lokibot

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\objectstoff = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\objectpluriseptate.vbs\"" C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2760 set thread context of 4444 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe N/A
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe N/A
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe N/A
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1464 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe
PID 1464 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe
PID 1464 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe
PID 2380 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 2380 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 2380 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 2184 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 2184 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 2184 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 2760 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 2760 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 2760 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 2760 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 2760 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 2760 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 2760 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 2760 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 2760 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe
PID 2760 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe

"C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe"

C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe

"C:\Users\Admin\AppData\Local\Temp\9581f51fb4bb7ab9258a1671e8f66513d7633c8ac9fbc867ea2d3735fa29c54b.exe"

C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe

"C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe"

C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe

"C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe"

C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe

"C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 181.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 203.109.54.23.in-addr.arpa udp
US 8.8.8.8:53 itjskjban.gq udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 itjskjban.gq udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

memory/1464-2-0x0000000002240000-0x0000000002243000-memory.dmp

memory/1464-4-0x0000000077811000-0x0000000077931000-memory.dmp

memory/1464-5-0x0000000077811000-0x0000000077931000-memory.dmp

memory/1464-6-0x0000000002240000-0x0000000002243000-memory.dmp

C:\Windows\win.ini

MD5 6bf517432f65eb7f0d18d574bf14124c
SHA1 5b9f37c1dd1318ebbec3bd2f07c109eb9d22c727
SHA256 6e2b70dfccabf3cc651545676a3a566c9cfae03f15f772886646abce1da35b46
SHA512 7b0cb8c20034585ec8bf4b45eda5eda5993a56e24931a7426dc5a9f081ec1f82545f3e26a48a4df885c8691fc6e8026d0808aebe3cc3358ba85ddca08ac4cb06

memory/2380-11-0x00000000020C0000-0x00000000020C3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\objectpluriseptate.exe

MD5 80f48fb858fdabdc7434d33750c0d10b
SHA1 3252f4dc28acb6781e5baa9791e01581c4b93833
SHA256 67ea8013e2c974c9f85a49e39e74a9444b186704175379c85f29a5b4e19538e1
SHA512 50c28cd5b781acde177194ff088bf6cbb7be38803c00697039581b6b0a790a3c62d49458bd08a24767b3862933083b32e38004678d66b5b949983eb5a2489059

memory/4444-33-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/4444-35-0x0000000000400000-0x00000000004A2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-940901362-3608833189-1915618603-1000\0f5007522459c86e95ffcc62f32308f1_f2cdb6fb-4ab8-4547-9f25-fad1f7a44351

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-940901362-3608833189-1915618603-1000\0f5007522459c86e95ffcc62f32308f1_f2cdb6fb-4ab8-4547-9f25-fad1f7a44351

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

memory/4444-77-0x0000000000400000-0x00000000004A2000-memory.dmp