Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
22-01-2021 07:15
Static task
static1
Behavioral task
behavioral1
Sample
NEW ORDER.xlsx
Resource
win7v20201028
Behavioral task
behavioral2
Sample
NEW ORDER.xlsx
Resource
win10v20201028
General
-
Target
NEW ORDER.xlsx
-
Size
2.3MB
-
MD5
5ce08c29f2632b716acc24b405c379a1
-
SHA1
599f3ed25603c0315ac8f85449c708095069d1ff
-
SHA256
2e8ccd25523029d5fb95e26d019b7730c0e22d15572c7ddc272828f2e99d9633
-
SHA512
07cb7e63e526f0a7c82cc0bfaeb27020478304964488fb1215c90fb968b7abcbf7d74e9c80a9109f29c75f298827d13824da6d9b387b455ba0fff330d3013a91
Malware Config
Extracted
lokibot
http://becharnise.ir/fa9/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 7 1716 EQNEDT32.EXE -
Executes dropped EXE 2 IoCs
Processes:
vbc.exevbc.exepid process 1840 vbc.exe 1216 vbc.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEpid process 1716 EQNEDT32.EXE 1716 EQNEDT32.EXE 1716 EQNEDT32.EXE 1716 EQNEDT32.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
vbc.exedescription pid process target process PID 1840 set thread context of 1216 1840 vbc.exe vbc.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1872 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
vbc.exedescription pid process Token: SeDebugPrivilege 1216 vbc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1872 EXCEL.EXE 1872 EXCEL.EXE 1872 EXCEL.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
EQNEDT32.EXEvbc.exedescription pid process target process PID 1716 wrote to memory of 1840 1716 EQNEDT32.EXE vbc.exe PID 1716 wrote to memory of 1840 1716 EQNEDT32.EXE vbc.exe PID 1716 wrote to memory of 1840 1716 EQNEDT32.EXE vbc.exe PID 1716 wrote to memory of 1840 1716 EQNEDT32.EXE vbc.exe PID 1840 wrote to memory of 1216 1840 vbc.exe vbc.exe PID 1840 wrote to memory of 1216 1840 vbc.exe vbc.exe PID 1840 wrote to memory of 1216 1840 vbc.exe vbc.exe PID 1840 wrote to memory of 1216 1840 vbc.exe vbc.exe PID 1840 wrote to memory of 1216 1840 vbc.exe vbc.exe PID 1840 wrote to memory of 1216 1840 vbc.exe vbc.exe PID 1840 wrote to memory of 1216 1840 vbc.exe vbc.exe PID 1840 wrote to memory of 1216 1840 vbc.exe vbc.exe PID 1840 wrote to memory of 1216 1840 vbc.exe vbc.exe PID 1840 wrote to memory of 1216 1840 vbc.exe vbc.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\NEW ORDER.xlsx"1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"{path}"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\vbc.exeMD5
472e637499fc849a7158ea979035bf54
SHA15ba6cba5be772c037336e17c92c0e1f8055e2bc7
SHA2562f86d6a428c7cacbdb5330d5d48907a60cbd2318e78a7997ebb7f5dd35ab0044
SHA51235db45837a58116c1712cf4c6a3a321a6a83a29ec5d889bc64973bddd82c1ca161f842802e9ea6b19a86c7f64c9f97cfb3385f4479d12af9c3c0064e235edd19
-
C:\Users\Public\vbc.exeMD5
472e637499fc849a7158ea979035bf54
SHA15ba6cba5be772c037336e17c92c0e1f8055e2bc7
SHA2562f86d6a428c7cacbdb5330d5d48907a60cbd2318e78a7997ebb7f5dd35ab0044
SHA51235db45837a58116c1712cf4c6a3a321a6a83a29ec5d889bc64973bddd82c1ca161f842802e9ea6b19a86c7f64c9f97cfb3385f4479d12af9c3c0064e235edd19
-
C:\Users\Public\vbc.exeMD5
472e637499fc849a7158ea979035bf54
SHA15ba6cba5be772c037336e17c92c0e1f8055e2bc7
SHA2562f86d6a428c7cacbdb5330d5d48907a60cbd2318e78a7997ebb7f5dd35ab0044
SHA51235db45837a58116c1712cf4c6a3a321a6a83a29ec5d889bc64973bddd82c1ca161f842802e9ea6b19a86c7f64c9f97cfb3385f4479d12af9c3c0064e235edd19
-
\Users\Public\vbc.exeMD5
472e637499fc849a7158ea979035bf54
SHA15ba6cba5be772c037336e17c92c0e1f8055e2bc7
SHA2562f86d6a428c7cacbdb5330d5d48907a60cbd2318e78a7997ebb7f5dd35ab0044
SHA51235db45837a58116c1712cf4c6a3a321a6a83a29ec5d889bc64973bddd82c1ca161f842802e9ea6b19a86c7f64c9f97cfb3385f4479d12af9c3c0064e235edd19
-
\Users\Public\vbc.exeMD5
472e637499fc849a7158ea979035bf54
SHA15ba6cba5be772c037336e17c92c0e1f8055e2bc7
SHA2562f86d6a428c7cacbdb5330d5d48907a60cbd2318e78a7997ebb7f5dd35ab0044
SHA51235db45837a58116c1712cf4c6a3a321a6a83a29ec5d889bc64973bddd82c1ca161f842802e9ea6b19a86c7f64c9f97cfb3385f4479d12af9c3c0064e235edd19
-
\Users\Public\vbc.exeMD5
472e637499fc849a7158ea979035bf54
SHA15ba6cba5be772c037336e17c92c0e1f8055e2bc7
SHA2562f86d6a428c7cacbdb5330d5d48907a60cbd2318e78a7997ebb7f5dd35ab0044
SHA51235db45837a58116c1712cf4c6a3a321a6a83a29ec5d889bc64973bddd82c1ca161f842802e9ea6b19a86c7f64c9f97cfb3385f4479d12af9c3c0064e235edd19
-
\Users\Public\vbc.exeMD5
472e637499fc849a7158ea979035bf54
SHA15ba6cba5be772c037336e17c92c0e1f8055e2bc7
SHA2562f86d6a428c7cacbdb5330d5d48907a60cbd2318e78a7997ebb7f5dd35ab0044
SHA51235db45837a58116c1712cf4c6a3a321a6a83a29ec5d889bc64973bddd82c1ca161f842802e9ea6b19a86c7f64c9f97cfb3385f4479d12af9c3c0064e235edd19
-
memory/996-6-0x000007FEF7810000-0x000007FEF7A8A000-memory.dmpFilesize
2.5MB
-
memory/1216-20-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1216-21-0x00000000004139DE-mapping.dmp
-
memory/1216-24-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1716-5-0x00000000760B1000-0x00000000760B3000-memory.dmpFilesize
8KB
-
memory/1840-11-0x0000000000000000-mapping.dmp
-
memory/1840-14-0x000000006C360000-0x000000006CA4E000-memory.dmpFilesize
6.9MB
-
memory/1840-15-0x00000000009A0000-0x00000000009A1000-memory.dmpFilesize
4KB
-
memory/1840-17-0x0000000004DF0000-0x0000000004DF1000-memory.dmpFilesize
4KB
-
memory/1840-18-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1840-19-0x0000000005180000-0x0000000005202000-memory.dmpFilesize
520KB
-
memory/1872-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1872-2-0x000000002F421000-0x000000002F424000-memory.dmpFilesize
12KB
-
memory/1872-3-0x0000000071201000-0x0000000071203000-memory.dmpFilesize
8KB