Analysis
-
max time kernel
134s -
max time network
135s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
04-07-2024 08:54
Static task
static1
Behavioral task
behavioral1
Sample
Zahtjevzaponudubroj20240704.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Zahtjevzaponudubroj20240704.exe
Resource
win10-20240404-en
General
-
Target
Zahtjevzaponudubroj20240704.exe
-
Size
654KB
-
MD5
e014b69d3bff34e00e3aa99e7b383cf3
-
SHA1
27a6cba46a6de403420cc1a1f205a800ba418580
-
SHA256
11b5aa868e0562612520de22f135ad0a1a768cfa6fa0a8708b7f02f49594d925
-
SHA512
3f0d823183a6c9c08a2fbb5c7d3552f2f62b1f049be4370a99ca445156716cf82d139cc6269cf08e398e6e20c1c3c08a58daa72fcc8a6deccac59fd474fbf039
-
SSDEEP
12288:loGcaZaofC1PN5MhJ889qTxvgjg2fUsCeG9CCZ8ltoFzPwS4MABsPqijlmLt5kR:lhXS17MJhm5ifUsCN9CCZOtoCMb
Malware Config
Extracted
lokibot
http://45.61.136.239/index.php/gyr.php?id=1
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Zahtjevzaponudubroj20240704.exedescription pid process target process PID 2820 set thread context of 1448 2820 Zahtjevzaponudubroj20240704.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
Zahtjevzaponudubroj20240704.exepowershell.exepid process 2820 Zahtjevzaponudubroj20240704.exe 2820 Zahtjevzaponudubroj20240704.exe 3100 powershell.exe 3100 powershell.exe 3100 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Zahtjevzaponudubroj20240704.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2820 Zahtjevzaponudubroj20240704.exe Token: SeDebugPrivilege 3100 powershell.exe Token: SeDebugPrivilege 1448 RegSvcs.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Zahtjevzaponudubroj20240704.exedescription pid process target process PID 2820 wrote to memory of 3100 2820 Zahtjevzaponudubroj20240704.exe powershell.exe PID 2820 wrote to memory of 3100 2820 Zahtjevzaponudubroj20240704.exe powershell.exe PID 2820 wrote to memory of 3100 2820 Zahtjevzaponudubroj20240704.exe powershell.exe PID 2820 wrote to memory of 1524 2820 Zahtjevzaponudubroj20240704.exe RegSvcs.exe PID 2820 wrote to memory of 1524 2820 Zahtjevzaponudubroj20240704.exe RegSvcs.exe PID 2820 wrote to memory of 1524 2820 Zahtjevzaponudubroj20240704.exe RegSvcs.exe PID 2820 wrote to memory of 1448 2820 Zahtjevzaponudubroj20240704.exe RegSvcs.exe PID 2820 wrote to memory of 1448 2820 Zahtjevzaponudubroj20240704.exe RegSvcs.exe PID 2820 wrote to memory of 1448 2820 Zahtjevzaponudubroj20240704.exe RegSvcs.exe PID 2820 wrote to memory of 1448 2820 Zahtjevzaponudubroj20240704.exe RegSvcs.exe PID 2820 wrote to memory of 1448 2820 Zahtjevzaponudubroj20240704.exe RegSvcs.exe PID 2820 wrote to memory of 1448 2820 Zahtjevzaponudubroj20240704.exe RegSvcs.exe PID 2820 wrote to memory of 1448 2820 Zahtjevzaponudubroj20240704.exe RegSvcs.exe PID 2820 wrote to memory of 1448 2820 Zahtjevzaponudubroj20240704.exe RegSvcs.exe PID 2820 wrote to memory of 1448 2820 Zahtjevzaponudubroj20240704.exe RegSvcs.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Zahtjevzaponudubroj20240704.exe"C:\Users\Admin\AppData\Local\Temp\Zahtjevzaponudubroj20240704.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Zahtjevzaponudubroj20240704.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bui0rafp.j5r.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3699363923-1875576828-3287151903-1000\0f5007522459c86e95ffcc62f32308f1_98f325b1-1085-43b7-8e27-43d9cdb6ea3fFilesize
46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3699363923-1875576828-3287151903-1000\0f5007522459c86e95ffcc62f32308f1_98f325b1-1085-43b7-8e27-43d9cdb6ea3fFilesize
46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
-
memory/1448-13-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1448-275-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1448-11-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1448-15-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2820-8-0x0000000005F50000-0x0000000005F5C000-memory.dmpFilesize
48KB
-
memory/2820-0-0x0000000073DEE000-0x0000000073DEF000-memory.dmpFilesize
4KB
-
memory/2820-9-0x0000000007250000-0x00000000072B2000-memory.dmpFilesize
392KB
-
memory/2820-10-0x00000000097A0000-0x000000000983C000-memory.dmpFilesize
624KB
-
memory/2820-7-0x0000000007330000-0x0000000007338000-memory.dmpFilesize
32KB
-
memory/2820-6-0x0000000007310000-0x000000000732A000-memory.dmpFilesize
104KB
-
memory/2820-16-0x0000000073DE0000-0x00000000744CE000-memory.dmpFilesize
6.9MB
-
memory/2820-5-0x0000000004950000-0x000000000495A000-memory.dmpFilesize
40KB
-
memory/2820-1-0x00000000004F0000-0x0000000000596000-memory.dmpFilesize
664KB
-
memory/2820-2-0x00000000077D0000-0x0000000007CCE000-memory.dmpFilesize
5.0MB
-
memory/2820-3-0x0000000007370000-0x0000000007402000-memory.dmpFilesize
584KB
-
memory/2820-4-0x0000000073DE0000-0x00000000744CE000-memory.dmpFilesize
6.9MB
-
memory/3100-24-0x00000000080D0000-0x0000000008420000-memory.dmpFilesize
3.3MB
-
memory/3100-48-0x0000000070920000-0x000000007096B000-memory.dmpFilesize
300KB
-
memory/3100-25-0x00000000085B0000-0x00000000085CC000-memory.dmpFilesize
112KB
-
memory/3100-26-0x00000000085E0000-0x000000000862B000-memory.dmpFilesize
300KB
-
memory/3100-27-0x0000000008970000-0x00000000089E6000-memory.dmpFilesize
472KB
-
memory/3100-22-0x00000000078B0000-0x0000000007916000-memory.dmpFilesize
408KB
-
memory/3100-47-0x0000000009980000-0x00000000099B3000-memory.dmpFilesize
204KB
-
memory/3100-23-0x0000000007920000-0x0000000007986000-memory.dmpFilesize
408KB
-
memory/3100-49-0x0000000009960000-0x000000000997E000-memory.dmpFilesize
120KB
-
memory/3100-54-0x0000000009AC0000-0x0000000009B65000-memory.dmpFilesize
660KB
-
memory/3100-55-0x0000000009CA0000-0x0000000009D34000-memory.dmpFilesize
592KB
-
memory/3100-248-0x0000000009C40000-0x0000000009C5A000-memory.dmpFilesize
104KB
-
memory/3100-253-0x0000000009C30000-0x0000000009C38000-memory.dmpFilesize
32KB
-
memory/3100-21-0x0000000007800000-0x0000000007822000-memory.dmpFilesize
136KB
-
memory/3100-20-0x00000000079A0000-0x0000000007FC8000-memory.dmpFilesize
6.2MB
-
memory/3100-19-0x0000000004DB0000-0x0000000004DE6000-memory.dmpFilesize
216KB