Analysis
-
max time kernel
131s -
max time network
135s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
22-01-2021 07:15
Static task
static1
Behavioral task
behavioral1
Sample
Proof_of_Payment_2020112.xlsx
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Proof_of_Payment_2020112.xlsx
Resource
win10v20201028
General
-
Target
Proof_of_Payment_2020112.xlsx
-
Size
2.0MB
-
MD5
153d89ab5de4c8d7283531e179bc4db0
-
SHA1
ab2948d1dfae6c4a29241dd5c4abe261b5dd0c20
-
SHA256
f4033e5baff349334f140f3560640157f8753543576b64e8254f0523c28d1051
-
SHA512
eec417abf49cb12ebb340046d1b1394dd8d0ea4ed49c29b50131de4444a3f99b86dbf99fe87f382541a9eb724f1ea97a0cf5d3cfd738de13c81444718fe8d6c6
Malware Config
Extracted
lokibot
http://becharnise.ir/fa11/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 7 1664 EQNEDT32.EXE -
Executes dropped EXE 2 IoCs
Processes:
vbc.exevbc.exepid process 980 vbc.exe 2016 vbc.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEpid process 1664 EQNEDT32.EXE 1664 EQNEDT32.EXE 1664 EQNEDT32.EXE 1664 EQNEDT32.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
vbc.exedescription pid process target process PID 980 set thread context of 2016 980 vbc.exe vbc.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1652 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
vbc.exepid process 980 vbc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
vbc.exevbc.exedescription pid process Token: SeDebugPrivilege 980 vbc.exe Token: SeDebugPrivilege 2016 vbc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1652 EXCEL.EXE 1652 EXCEL.EXE 1652 EXCEL.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
EQNEDT32.EXEvbc.exedescription pid process target process PID 1664 wrote to memory of 980 1664 EQNEDT32.EXE vbc.exe PID 1664 wrote to memory of 980 1664 EQNEDT32.EXE vbc.exe PID 1664 wrote to memory of 980 1664 EQNEDT32.EXE vbc.exe PID 1664 wrote to memory of 980 1664 EQNEDT32.EXE vbc.exe PID 980 wrote to memory of 2016 980 vbc.exe vbc.exe PID 980 wrote to memory of 2016 980 vbc.exe vbc.exe PID 980 wrote to memory of 2016 980 vbc.exe vbc.exe PID 980 wrote to memory of 2016 980 vbc.exe vbc.exe PID 980 wrote to memory of 2016 980 vbc.exe vbc.exe PID 980 wrote to memory of 2016 980 vbc.exe vbc.exe PID 980 wrote to memory of 2016 980 vbc.exe vbc.exe PID 980 wrote to memory of 2016 980 vbc.exe vbc.exe PID 980 wrote to memory of 2016 980 vbc.exe vbc.exe PID 980 wrote to memory of 2016 980 vbc.exe vbc.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Proof_of_Payment_2020112.xlsx1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\vbc.exeMD5
2d31bc161507742b30db3cad58237e65
SHA15eb132989ad2cdf0f14b82f263a15da96d9eb31f
SHA2566ba2fb387dae83da4316cf44ad041851763f9b5e2647ef27a6820c0cf54f8f0b
SHA512a577b98e9eaf0ef06a1a31a7c88d740eeae99455b2495e6d403d222b57d99aae24698d8883babc3068353f6cebb1622190777005efe88bfc51dc41ae27ac2063
-
C:\Users\Public\vbc.exeMD5
2d31bc161507742b30db3cad58237e65
SHA15eb132989ad2cdf0f14b82f263a15da96d9eb31f
SHA2566ba2fb387dae83da4316cf44ad041851763f9b5e2647ef27a6820c0cf54f8f0b
SHA512a577b98e9eaf0ef06a1a31a7c88d740eeae99455b2495e6d403d222b57d99aae24698d8883babc3068353f6cebb1622190777005efe88bfc51dc41ae27ac2063
-
C:\Users\Public\vbc.exeMD5
2d31bc161507742b30db3cad58237e65
SHA15eb132989ad2cdf0f14b82f263a15da96d9eb31f
SHA2566ba2fb387dae83da4316cf44ad041851763f9b5e2647ef27a6820c0cf54f8f0b
SHA512a577b98e9eaf0ef06a1a31a7c88d740eeae99455b2495e6d403d222b57d99aae24698d8883babc3068353f6cebb1622190777005efe88bfc51dc41ae27ac2063
-
\Users\Public\vbc.exeMD5
2d31bc161507742b30db3cad58237e65
SHA15eb132989ad2cdf0f14b82f263a15da96d9eb31f
SHA2566ba2fb387dae83da4316cf44ad041851763f9b5e2647ef27a6820c0cf54f8f0b
SHA512a577b98e9eaf0ef06a1a31a7c88d740eeae99455b2495e6d403d222b57d99aae24698d8883babc3068353f6cebb1622190777005efe88bfc51dc41ae27ac2063
-
\Users\Public\vbc.exeMD5
2d31bc161507742b30db3cad58237e65
SHA15eb132989ad2cdf0f14b82f263a15da96d9eb31f
SHA2566ba2fb387dae83da4316cf44ad041851763f9b5e2647ef27a6820c0cf54f8f0b
SHA512a577b98e9eaf0ef06a1a31a7c88d740eeae99455b2495e6d403d222b57d99aae24698d8883babc3068353f6cebb1622190777005efe88bfc51dc41ae27ac2063
-
\Users\Public\vbc.exeMD5
2d31bc161507742b30db3cad58237e65
SHA15eb132989ad2cdf0f14b82f263a15da96d9eb31f
SHA2566ba2fb387dae83da4316cf44ad041851763f9b5e2647ef27a6820c0cf54f8f0b
SHA512a577b98e9eaf0ef06a1a31a7c88d740eeae99455b2495e6d403d222b57d99aae24698d8883babc3068353f6cebb1622190777005efe88bfc51dc41ae27ac2063
-
\Users\Public\vbc.exeMD5
2d31bc161507742b30db3cad58237e65
SHA15eb132989ad2cdf0f14b82f263a15da96d9eb31f
SHA2566ba2fb387dae83da4316cf44ad041851763f9b5e2647ef27a6820c0cf54f8f0b
SHA512a577b98e9eaf0ef06a1a31a7c88d740eeae99455b2495e6d403d222b57d99aae24698d8883babc3068353f6cebb1622190777005efe88bfc51dc41ae27ac2063
-
memory/860-6-0x000007FEF7800000-0x000007FEF7A7A000-memory.dmpFilesize
2.5MB
-
memory/980-15-0x0000000000960000-0x0000000000961000-memory.dmpFilesize
4KB
-
memory/980-11-0x0000000000000000-mapping.dmp
-
memory/980-14-0x000000006BFB0000-0x000000006C69E000-memory.dmpFilesize
6.9MB
-
memory/980-17-0x0000000005060000-0x0000000005061000-memory.dmpFilesize
4KB
-
memory/980-18-0x00000000002B0000-0x00000000002D3000-memory.dmpFilesize
140KB
-
memory/980-19-0x00000000048A0000-0x00000000048FC000-memory.dmpFilesize
368KB
-
memory/1652-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1652-2-0x000000002FD91000-0x000000002FD94000-memory.dmpFilesize
12KB
-
memory/1652-3-0x00000000715B1000-0x00000000715B3000-memory.dmpFilesize
8KB
-
memory/1664-5-0x0000000075571000-0x0000000075573000-memory.dmpFilesize
8KB
-
memory/2016-20-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2016-21-0x00000000004139DE-mapping.dmp
-
memory/2016-24-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB