hxxps://pixeldrain[.]com/u/TcV2BREC

Analysis

max time kernel
62s
max time network
64s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
26/03/2025, 15:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://pixeldrain.com/u/TcV2BREC

Score

8^/10

agilenet defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
100	4856	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
1504	Lokibot.exe
8	Lokibot.exe

Obfuscated with Agile.Net obfuscator 2 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/1504-696-0x00000000025C0000-0x00000000025D4000-memory.dmp	agile_net
behavioral1/memory/8-732-0x0000000001240000-0x0000000001254000-memory.dmp	agile_net

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
98	raw.githubusercontent.com
99	raw.githubusercontent.com
100	raw.githubusercontent.com
95	raw.githubusercontent.com
96	raw.githubusercontent.com
97	raw.githubusercontent.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Lokibot.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lokibot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lokibot.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133874778437208290"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3712238951-2226310826-298817577-1000\{0D6F3E67-59B5-4A52-84A2-090810B1EC71}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Lokibot.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1504	Lokibot.exe
1504	Lokibot.exe
8	Lokibot.exe
8	Lokibot.exe
1504	Lokibot.exe
1504	Lokibot.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	Lokibot.exe
Token: SeDebugPrivilege	8	Lokibot.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 3356	3500	msedge.exe	82
PID 3500 wrote to memory of 3356	3500	msedge.exe	82
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 4856	3500	msedge.exe	84
PID 3500 wrote to memory of 4856	3500	msedge.exe	84
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5608	3500	msedge.exe	83
PID 3500 wrote to memory of 5048	3500	msedge.exe	85
PID 3500 wrote to memory of 5048	3500	msedge.exe	85
PID 3500 wrote to memory of 5048	3500	msedge.exe	85
PID 3500 wrote to memory of 5048	3500	msedge.exe	85
PID 3500 wrote to memory of 5048	3500	msedge.exe	85
PID 3500 wrote to memory of 5048	3500	msedge.exe	85
PID 3500 wrote to memory of 5048	3500	msedge.exe	85
PID 3500 wrote to memory of 5048	3500	msedge.exe	85
PID 3500 wrote to memory of 5048	3500	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://pixeldrain.com/u/TcV2BREC
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x264,0x7ffe83c0f208,0x7ffe83c0f214,0x7ffe83c0f220
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2124,i,1409232399258596925,15346147627988119351,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1888,i,1409232399258596925,15346147627988119351,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2340,i,1409232399258596925,15346147627988119351,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:13
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3480,i,1409232399258596925,15346147627988119351,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3484,i,1409232399258596925,15346147627988119351,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4888,i,1409232399258596925,15346147627988119351,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4896,i,1409232399258596925,15346147627988119351,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5288,i,1409232399258596925,15346147627988119351,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5688,i,1409232399258596925,15346147627988119351,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
  2⤵
  PID:916
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5772,i,1409232399258596925,15346147627988119351,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5772,i,1409232399258596925,15346147627988119351,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6108,i,1409232399258596925,15346147627988119351,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=6300,i,1409232399258596925,15346147627988119351,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3616,i,1409232399258596925,15346147627988119351,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=6064,i,1409232399258596925,15346147627988119351,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=6076,i,1409232399258596925,15346147627988119351,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=6372,i,1409232399258596925,15346147627988119351,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5812,i,1409232399258596925,15346147627988119351,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4728,i,1409232399258596925,15346147627988119351,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:14
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6612,i,1409232399258596925,15346147627988119351,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6872,i,1409232399258596925,15346147627988119351,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:14
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=6880,i,1409232399258596925,15346147627988119351,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7288,i,1409232399258596925,15346147627988119351,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4220
- C:\Users\Admin\Downloads\Lokibot.exe
  "C:\Users\Admin\Downloads\Lokibot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1504
- - C:\Users\Admin\Downloads\Lokibot.exe
    "C:\Users\Admin\Downloads\Lokibot.exe"
    3⤵
    PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6908,i,1409232399258596925,15346147627988119351,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:14
  2⤵
  PID:2740

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1204

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4160

C:\Users\Admin\Downloads\Lokibot.exe
"C:\Users\Admin\Downloads\Lokibot.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
682ff716e69471147f7a0e231efe86ac

SHA1
937de827ecedfb18ed3f399ac647f88f2579c6bb

SHA256
11e566a5d7934e7f13ddb561000aafff386430a3df22a36424f2101e9ba76662

SHA512
4fffcccf9a78aed772e46ff48f817d586934c8d46434535d25b080c4fa264e018e6c2fe389d8d42b1f3b911e402abbf00affd9b890b77ae68d7074a31ee3e93e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
d00fec945cb41c0c53e39bc6adc0fa9e

SHA1
0163df07ebc2021ead647f956fe4a3dffe1f562c

SHA256
b826dfe295c42e3a9756145aa859b47636eccf46648c809d17db2a34053fa795

SHA512
37b4c7c1c64e32106b5f73257d7eee4fe476e0282d8dcfebc49474cb8a1915c5f22067d4678bbdfef5a447ce938b147f701e982fa0fbcb9131e335803d5c2f57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe581855.TMP

Filesize
3KB

MD5
f15531f15b67d41dc657a3c771365088

SHA1
168362fa7cfcd1c25f9021e90a40eebf578c0bd5

SHA256
6fabcd1b894ac15d42c2c3837f63ac5d2cf4cd72675c4dc10fe7669f3570b583

SHA512
ce4134bdd6fc9a1a100e9504d555f1b002d91d7b57b38cf1ff7834af6e5203cf3880b7c18688b7135efa276bd1d1d202f9673a4bf26d1899b0e656d1b4e48a6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
211B

MD5
70b26d5ee6fd5980bc340634f4f6f754

SHA1
ce68a99fabdc583dc2a3e02c58119e59e3476a32

SHA256
d1ce710152d8145a3f5cb0d825c87734e54c93687396fe796d69ab13115a3f07

SHA512
9c1c83f956a3ad7bf40bda126bb050ea1c217e7bce008cb0f45f0969532a807dd672d17934dbfc5e478b4fedf0d5632d09859224c2baba4c57391d8524b2bcf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
9d41f4b0544fae4fd68be0f907c7879e

SHA1
e2ad164332e3315d9b0db4d0c1c9174176455442

SHA256
3e8cb59b90b46db8843989a71622fb13e07d8c1d408cb4498ab5ac0b23953247

SHA512
d4ff33c981fd92b2309c7174d20afaed2a48541179f7dfcd066e12757e2877f49160afda34284663ff099ec13a15488205289547e303f448edce86dc701fa943

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
a50380714e5331de4d3b0c759bbfb83e

SHA1
863c43552d7281b03394370c29f4aaf8c1d7ef5d

SHA256
c8313806fa349c320f50a1c3bf7ad7a154f980e71bd407fccbdda9d4aff7fe85

SHA512
762b581e06cf31a6a3850a5d3ec91f6d14c3bb55f4d398c5a2654dcfb8f6d75964f09a23e8ed1d1caacaba687b74a44fbd1349ff4ddc03a108ec54373f52f9c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
1d5ab0b8c2006b63a50f0412daa8a140

SHA1
d73a39c020d48b63a88018da0eb6aafc48e32a4f

SHA256
a472a68e67f50284575966483a34786ec463569fdf6eb05aeb7add6633b37105

SHA512
4656590ed90a673a9abf009e3c5a08c2869b013fb8eee4074bb84c185f7ab3b55c5193603d57903e9709e9d66fc280e798fedbce9999b4369286c47afcc78fcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
22de83eb4b0873a562e5ed31b503cd60

SHA1
5263661198c4a81b2c2067581fda904277c14aa9

SHA256
676872716b8fb43a86d5ac5ef549de150d3fa1c7d376cab4aca9ce68b682e8b7

SHA512
e02e9f3f4e3f87f598e87a43ce81c85cfbd93bad46a83f2f0a7705ceaaa586d913d0d6474b5441ad5fe6bb09020aa90ddd7e1736c9f59946db012295e7cd9c72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
9e042b86206585c95a6e9f27230b830d

SHA1
a9b5827b305360ccbbbc089d9ea9cd8a4e9fce47

SHA256
9ee349e2bbbd74110ee1f11b9bd91a60094e3385381a57551221d9da583e4f34

SHA512
06a32c5df54ea2a4724a224811cf5f1826ec0f979663ef3ecbb3281c5723711ad73a7a8f6b75ff2772404bc29069c4b78f173e5198f8f26b7dd50c10340cdd0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
2ac64e1e496f4974e271e6637be4f4cf

SHA1
8a6dc9410e15a0ff56166b9e945958b91e206f44

SHA256
5e89a29a31c88b257f3f31f00c8440c7310559deb57b41fb00cc4b226685c15d

SHA512
6b2c330a90173311ba88e4963ddf79e63bb5d22609828e340e808f6f4a0f2db62043f3b4442e09cd9e87ce4d313bef74efd551adff01fa561c315acbfd5feb99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
6f9f12a810fbdd411d454d3b2938d30f

SHA1
225b9f4562178c7149a4db6a03b043ad2cf4982a

SHA256
f9ee2f58e1f21ffdadc7a7e6058e24e47c49c7a1e37814eb846f8d0ff96d66c4

SHA512
871f7d61de1d3c2c76865afd6a35d781a504357fa829207e50a90310e4fb1aabd545b913f0d1c4e2f4979da6bb7886b75934c197ea9e4176e832d3cc1edc3100

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
df701da3692a2c11796461b9f515dd6c

SHA1
87db2658541e1aeb58874c9fcc82ede6bbc763eb

SHA256
e88cae124c4301b1ac07d6f6903c7895fdcb0e5c93f5bfa5c7894bc3cf1eeaac

SHA512
2d46be205f7847a33794640319f577b386892e1741acea6b6cc9923b97587d4c103413c6754bfe105a655d6146e00ef73ae1d053aeaa3f86632cceca6f9afc5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
e77eb1157d91127b2688c860fc0f3cbd

SHA1
16da33fe217c309a6a042222f25e05dc6543e827

SHA256
73b98d26e3483a9324d1521f245c7e80a8b9e506df59371c44bc0de621a14f35

SHA512
31a882d8b1865faf4f24be893534a3f3f9e0397e4d0dac0172612f36f191754dd3b94955a1ecd10f8f132725ddb4219af2f9705db01ad1bc831c33361a6e395c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
7ad30dfd1acb1f57e589a9d4224ec1c3

SHA1
fb3a64462e3033d0334fc0705a0d6f0a647901dc

SHA256
97deefba4baec8b59fc144cb2747b6770e5c9d80ecd2768b36965245e5473ba5

SHA512
cf2ab5bd2519195f574c6c15a12b4ad07c394883b03b3a550d4606b4caa4aa80a4df9ae096b9bb0b337c7b1c4f8120611d8d989cba34107bbf9f668498e04706

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
b96783ef4b8d7e3addfe80ec917835cb

SHA1
4e5ba42bd2312263ab1f0e9095ab8e8d7c795c76

SHA256
67c1d182f3c0235671ad4155668f1c41164ab15012bdfc56188da15ea336b8c9

SHA512
5fe740e3f486eada864649850dcfc9b2da93505301317e2c1cfc1a432216565656739a717f777ecad9a99d2f914ea824988aa542c55d35101c5f6c5c7dad4367

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
df0bd25d0892736bb5a83e16eb090a03

SHA1
2ac96d0cc42c1d5a8d2f7eddc261be0b836c5da6

SHA256
be9165990a0e5e1474b8bb0e45a9bef0fff74994f8b5fd272c16e49c56e65c35

SHA512
4e6c7085879ac7dd9c8c2303eada710b65ce74c2924a31a5ff97c8a4c479f674ae1d09f71634e1034ca6f9d691b04855b2cf1bbd85d9d7d7349b9bac9c740b34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
2510e5cd4d618350badb2016c692438a

SHA1
eebcc1794152347e138c53698bebeb6c7380e3bb

SHA256
10e573489878b674545484af1f4d415f0cedb7f6aa321f9f358c8652b41dd389

SHA512
858579d9ae1abec0377cd92daeb18e962ff1be10a94444b6ca87089ac8020be762f235d1b0a105a46970996d82beec9c949ccbd0e675e0d753547156e0b0055f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe57dd12.TMP

Filesize
392B

MD5
716a2b03c4dcddcf379a8f60d08789aa

SHA1
0c4ab166c9fc1aa6d65ab1643560e4496454cede

SHA256
fe1276dfc9ca79fc01eff1395f624156e5dfcb70f508ed563dafd5832f0f0952

SHA512
81637c8cdca0828db42c6ad7f737d63afc09c5740189967d7e5d786fcf3e0e2ed75a4acc1b21118c6a461a46ae063f79dfc300e3d5bde450ddf10c4eaa6933f8

Download Submit
C:\Users\Admin\Downloads\Lokibot.exe.crdownload

Filesize
300KB

MD5
f52fbb02ac0666cae74fc389b1844e98

SHA1
f7721d590770e2076e64f148a4ba1241404996b8

SHA256
a885b1f5377c2a1cead4e2d7261fab6199f83610ffdd35d20c653d52279d4683

SHA512
78b4bf4d048bda5e4e109d4dd9dafaa250eac1c5a3558c2faecf88ef0ee5dd4f2c82a791756e2f5aa42f7890efcc0c420156308689a27e0ad9fb90156b8dc1c0

Download Submit
C:\Users\Admin\Downloads\Lokibot.exe:Zone.Identifier

Filesize
223B

MD5
32d4864b32b54102e784741dc78e9c60

SHA1
64e0f911a13a4cc1f654645e7eff8589b5d38629

SHA256
17800123e143b28f2f2db7b9a734a6f7b9eb0720341f6a0b9a522577f7344ab7

SHA512
8e9904cd81860a7a5aa2cb79ad7d706e916335d5714ae7bde2affb76f2d4a3cc0d6bf870d22b383bdf372c7cf45d42890e86eb99faf17adc80b2e74ed28f4bd2

Download Submit
memory/8-732-0x0000000001240000-0x0000000001254000-memory.dmp

Filesize
80KB

Download
memory/1504-712-0x0000000005F20000-0x0000000005F64000-memory.dmp

Filesize
272KB

Download
memory/1504-711-0x0000000005C90000-0x0000000005C98000-memory.dmp

Filesize
32KB

Download
memory/1504-710-0x0000000005A70000-0x0000000005B02000-memory.dmp

Filesize
584KB

Download
memory/1504-709-0x00000000052D0000-0x00000000052D8000-memory.dmp

Filesize
32KB

Download
memory/1504-734-0x0000000005CD0000-0x0000000005CF2000-memory.dmp

Filesize
136KB

Download
memory/1504-698-0x00000000052E0000-0x0000000005886000-memory.dmp

Filesize
5.6MB

Download
memory/1504-696-0x00000000025C0000-0x00000000025D4000-memory.dmp

Filesize
80KB

Download
memory/1504-695-0x0000000000210000-0x0000000000262000-memory.dmp

Filesize
328KB

Download