Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
04-07-2024 08:54
Static task
static1
Behavioral task
behavioral1
Sample
Zahtjevzaponudubroj20240704.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Zahtjevzaponudubroj20240704.exe
Resource
win10-20240404-en
General
-
Target
Zahtjevzaponudubroj20240704.exe
-
Size
654KB
-
MD5
e014b69d3bff34e00e3aa99e7b383cf3
-
SHA1
27a6cba46a6de403420cc1a1f205a800ba418580
-
SHA256
11b5aa868e0562612520de22f135ad0a1a768cfa6fa0a8708b7f02f49594d925
-
SHA512
3f0d823183a6c9c08a2fbb5c7d3552f2f62b1f049be4370a99ca445156716cf82d139cc6269cf08e398e6e20c1c3c08a58daa72fcc8a6deccac59fd474fbf039
-
SSDEEP
12288:loGcaZaofC1PN5MhJ889qTxvgjg2fUsCeG9CCZ8ltoFzPwS4MABsPqijlmLt5kR:lhXS17MJhm5ifUsCN9CCZOtoCMb
Malware Config
Extracted
lokibot
http://45.61.136.239/index.php/gyr.php?id=1
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Zahtjevzaponudubroj20240704.exedescription pid process target process PID 2428 set thread context of 4888 2428 Zahtjevzaponudubroj20240704.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Zahtjevzaponudubroj20240704.exepowershell.exepid process 2428 Zahtjevzaponudubroj20240704.exe 2428 Zahtjevzaponudubroj20240704.exe 3632 powershell.exe 3632 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Zahtjevzaponudubroj20240704.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2428 Zahtjevzaponudubroj20240704.exe Token: SeDebugPrivilege 3632 powershell.exe Token: SeDebugPrivilege 4888 RegSvcs.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Zahtjevzaponudubroj20240704.exedescription pid process target process PID 2428 wrote to memory of 3632 2428 Zahtjevzaponudubroj20240704.exe powershell.exe PID 2428 wrote to memory of 3632 2428 Zahtjevzaponudubroj20240704.exe powershell.exe PID 2428 wrote to memory of 3632 2428 Zahtjevzaponudubroj20240704.exe powershell.exe PID 2428 wrote to memory of 2716 2428 Zahtjevzaponudubroj20240704.exe RegSvcs.exe PID 2428 wrote to memory of 2716 2428 Zahtjevzaponudubroj20240704.exe RegSvcs.exe PID 2428 wrote to memory of 2716 2428 Zahtjevzaponudubroj20240704.exe RegSvcs.exe PID 2428 wrote to memory of 4888 2428 Zahtjevzaponudubroj20240704.exe RegSvcs.exe PID 2428 wrote to memory of 4888 2428 Zahtjevzaponudubroj20240704.exe RegSvcs.exe PID 2428 wrote to memory of 4888 2428 Zahtjevzaponudubroj20240704.exe RegSvcs.exe PID 2428 wrote to memory of 4888 2428 Zahtjevzaponudubroj20240704.exe RegSvcs.exe PID 2428 wrote to memory of 4888 2428 Zahtjevzaponudubroj20240704.exe RegSvcs.exe PID 2428 wrote to memory of 4888 2428 Zahtjevzaponudubroj20240704.exe RegSvcs.exe PID 2428 wrote to memory of 4888 2428 Zahtjevzaponudubroj20240704.exe RegSvcs.exe PID 2428 wrote to memory of 4888 2428 Zahtjevzaponudubroj20240704.exe RegSvcs.exe PID 2428 wrote to memory of 4888 2428 Zahtjevzaponudubroj20240704.exe RegSvcs.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Zahtjevzaponudubroj20240704.exe"C:\Users\Admin\AppData\Local\Temp\Zahtjevzaponudubroj20240704.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Zahtjevzaponudubroj20240704.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yzsr5x4g.zvj.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1672260578-815027929-964132517-1000\0f5007522459c86e95ffcc62f32308f1_576e87d5-c470-468f-9651-5b4f0984bf51Filesize
46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1672260578-815027929-964132517-1000\0f5007522459c86e95ffcc62f32308f1_576e87d5-c470-468f-9651-5b4f0984bf51Filesize
46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
-
memory/2428-6-0x0000000007E80000-0x0000000007E9A000-memory.dmpFilesize
104KB
-
memory/2428-4-0x0000000005280000-0x000000000528A000-memory.dmpFilesize
40KB
-
memory/2428-5-0x0000000074C00000-0x00000000753B1000-memory.dmpFilesize
7.7MB
-
memory/2428-3-0x0000000007D70000-0x0000000007E02000-memory.dmpFilesize
584KB
-
memory/2428-7-0x0000000006950000-0x0000000006958000-memory.dmpFilesize
32KB
-
memory/2428-8-0x0000000007960000-0x000000000796C000-memory.dmpFilesize
48KB
-
memory/2428-9-0x0000000005950000-0x00000000059B2000-memory.dmpFilesize
392KB
-
memory/2428-10-0x0000000005AA0000-0x0000000005B3C000-memory.dmpFilesize
624KB
-
memory/2428-2-0x0000000008280000-0x0000000008826000-memory.dmpFilesize
5.6MB
-
memory/2428-1-0x0000000000D00000-0x0000000000DA6000-memory.dmpFilesize
664KB
-
memory/2428-15-0x0000000074C00000-0x00000000753B1000-memory.dmpFilesize
7.7MB
-
memory/2428-0-0x0000000074C0E000-0x0000000074C0F000-memory.dmpFilesize
4KB
-
memory/3632-53-0x0000000007240000-0x000000000724A000-memory.dmpFilesize
40KB
-
memory/3632-50-0x0000000007090000-0x0000000007134000-memory.dmpFilesize
656KB
-
memory/3632-20-0x0000000005320000-0x000000000594A000-memory.dmpFilesize
6.2MB
-
memory/3632-19-0x0000000074C80000-0x0000000075431000-memory.dmpFilesize
7.7MB
-
memory/3632-22-0x0000000005080000-0x00000000050E6000-memory.dmpFilesize
408KB
-
memory/3632-23-0x00000000050F0000-0x0000000005156000-memory.dmpFilesize
408KB
-
memory/3632-21-0x0000000004EE0000-0x0000000004F02000-memory.dmpFilesize
136KB
-
memory/3632-24-0x0000000074C80000-0x0000000075431000-memory.dmpFilesize
7.7MB
-
memory/3632-18-0x0000000002670000-0x00000000026A6000-memory.dmpFilesize
216KB
-
memory/3632-31-0x0000000005950000-0x0000000005CA7000-memory.dmpFilesize
3.3MB
-
memory/3632-34-0x0000000005E70000-0x0000000005E8E000-memory.dmpFilesize
120KB
-
memory/3632-35-0x0000000005F30000-0x0000000005F7C000-memory.dmpFilesize
304KB
-
memory/3632-39-0x0000000006E50000-0x0000000006E84000-memory.dmpFilesize
208KB
-
memory/3632-40-0x0000000070DF0000-0x0000000070E3C000-memory.dmpFilesize
304KB
-
memory/3632-49-0x0000000006470000-0x000000000648E000-memory.dmpFilesize
120KB
-
memory/3632-17-0x0000000074C8E000-0x0000000074C8F000-memory.dmpFilesize
4KB
-
memory/3632-51-0x0000000007800000-0x0000000007E7A000-memory.dmpFilesize
6.5MB
-
memory/3632-52-0x00000000071C0000-0x00000000071DA000-memory.dmpFilesize
104KB
-
memory/3632-62-0x0000000074C80000-0x0000000075431000-memory.dmpFilesize
7.7MB
-
memory/3632-54-0x0000000007450000-0x00000000074E6000-memory.dmpFilesize
600KB
-
memory/3632-55-0x00000000073D0000-0x00000000073E1000-memory.dmpFilesize
68KB
-
memory/3632-56-0x0000000007400000-0x000000000740E000-memory.dmpFilesize
56KB
-
memory/3632-57-0x0000000007410000-0x0000000007425000-memory.dmpFilesize
84KB
-
memory/3632-58-0x0000000007510000-0x000000000752A000-memory.dmpFilesize
104KB
-
memory/3632-59-0x0000000007500000-0x0000000007508000-memory.dmpFilesize
32KB
-
memory/4888-11-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4888-63-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4888-16-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4888-13-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB