Analysis
-
max time kernel
102s -
max time network
113s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
22-07-2021 11:58
Static task
static1
Behavioral task
behavioral1
Sample
swift.xlsx
Resource
win7v20210408
Behavioral task
behavioral2
Sample
swift.xlsx
Resource
win10v20210410
General
-
Target
swift.xlsx
-
Size
1.2MB
-
MD5
79cbe5c736dca5564640e51892f32c1b
-
SHA1
dca92a17d05be974c19ddea73ced3786d0eebe0f
-
SHA256
ceef223bf6dc75ffe9eb1af19d6d440b59def1fa06230ca79511eae1c155d37a
-
SHA512
09cfc9c650ac39e6f8963ddff58f4307b66ff8134406cbe9d676f4559f10c0aa0859c9d1ffb15d670bcc94dcde3959768f09a3a6fe2de7433bbdf21882226add
Malware Config
Extracted
lokibot
http://vikinproducts.com/Mrlogs/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 5 1184 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
vbc.exevbc.exevbc.exepid process 1076 vbc.exe 1688 vbc.exe 1668 vbc.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEpid process 1184 EQNEDT32.EXE 1184 EQNEDT32.EXE 1184 EQNEDT32.EXE 1184 EQNEDT32.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
vbc.exedescription pid process target process PID 1076 set thread context of 1668 1076 vbc.exe vbc.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1948 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
vbc.exepid process 1076 vbc.exe 1076 vbc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
vbc.exevbc.exedescription pid process Token: SeDebugPrivilege 1076 vbc.exe Token: SeDebugPrivilege 1668 vbc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1948 EXCEL.EXE 1948 EXCEL.EXE 1948 EXCEL.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
EQNEDT32.EXEvbc.exedescription pid process target process PID 1184 wrote to memory of 1076 1184 EQNEDT32.EXE vbc.exe PID 1184 wrote to memory of 1076 1184 EQNEDT32.EXE vbc.exe PID 1184 wrote to memory of 1076 1184 EQNEDT32.EXE vbc.exe PID 1184 wrote to memory of 1076 1184 EQNEDT32.EXE vbc.exe PID 1076 wrote to memory of 1688 1076 vbc.exe vbc.exe PID 1076 wrote to memory of 1688 1076 vbc.exe vbc.exe PID 1076 wrote to memory of 1688 1076 vbc.exe vbc.exe PID 1076 wrote to memory of 1688 1076 vbc.exe vbc.exe PID 1076 wrote to memory of 1668 1076 vbc.exe vbc.exe PID 1076 wrote to memory of 1668 1076 vbc.exe vbc.exe PID 1076 wrote to memory of 1668 1076 vbc.exe vbc.exe PID 1076 wrote to memory of 1668 1076 vbc.exe vbc.exe PID 1076 wrote to memory of 1668 1076 vbc.exe vbc.exe PID 1076 wrote to memory of 1668 1076 vbc.exe vbc.exe PID 1076 wrote to memory of 1668 1076 vbc.exe vbc.exe PID 1076 wrote to memory of 1668 1076 vbc.exe vbc.exe PID 1076 wrote to memory of 1668 1076 vbc.exe vbc.exe PID 1076 wrote to memory of 1668 1076 vbc.exe vbc.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\swift.xlsx1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1948
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1668
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\vbc.exeMD5
a0339a15a2f219b54b3c1a6b4afbc6be
SHA17df7a7515715283591582974eb47197c9369efe3
SHA256eef89bbd9fcfb6e1b095b5302af5c176ed593bf9c6ce26d0be6ebeddc7fa0e6a
SHA51230037c5446b79946da950d99ba0b315134d7793307f8fb25255a0db8121d70f8df201029ffd00d7cb4b1ed6201ab60795727b983296a03a0a5a2fac28d792a84
-
C:\Users\Public\vbc.exeMD5
a0339a15a2f219b54b3c1a6b4afbc6be
SHA17df7a7515715283591582974eb47197c9369efe3
SHA256eef89bbd9fcfb6e1b095b5302af5c176ed593bf9c6ce26d0be6ebeddc7fa0e6a
SHA51230037c5446b79946da950d99ba0b315134d7793307f8fb25255a0db8121d70f8df201029ffd00d7cb4b1ed6201ab60795727b983296a03a0a5a2fac28d792a84
-
C:\Users\Public\vbc.exeMD5
a0339a15a2f219b54b3c1a6b4afbc6be
SHA17df7a7515715283591582974eb47197c9369efe3
SHA256eef89bbd9fcfb6e1b095b5302af5c176ed593bf9c6ce26d0be6ebeddc7fa0e6a
SHA51230037c5446b79946da950d99ba0b315134d7793307f8fb25255a0db8121d70f8df201029ffd00d7cb4b1ed6201ab60795727b983296a03a0a5a2fac28d792a84
-
C:\Users\Public\vbc.exeMD5
a0339a15a2f219b54b3c1a6b4afbc6be
SHA17df7a7515715283591582974eb47197c9369efe3
SHA256eef89bbd9fcfb6e1b095b5302af5c176ed593bf9c6ce26d0be6ebeddc7fa0e6a
SHA51230037c5446b79946da950d99ba0b315134d7793307f8fb25255a0db8121d70f8df201029ffd00d7cb4b1ed6201ab60795727b983296a03a0a5a2fac28d792a84
-
\Users\Public\vbc.exeMD5
a0339a15a2f219b54b3c1a6b4afbc6be
SHA17df7a7515715283591582974eb47197c9369efe3
SHA256eef89bbd9fcfb6e1b095b5302af5c176ed593bf9c6ce26d0be6ebeddc7fa0e6a
SHA51230037c5446b79946da950d99ba0b315134d7793307f8fb25255a0db8121d70f8df201029ffd00d7cb4b1ed6201ab60795727b983296a03a0a5a2fac28d792a84
-
\Users\Public\vbc.exeMD5
a0339a15a2f219b54b3c1a6b4afbc6be
SHA17df7a7515715283591582974eb47197c9369efe3
SHA256eef89bbd9fcfb6e1b095b5302af5c176ed593bf9c6ce26d0be6ebeddc7fa0e6a
SHA51230037c5446b79946da950d99ba0b315134d7793307f8fb25255a0db8121d70f8df201029ffd00d7cb4b1ed6201ab60795727b983296a03a0a5a2fac28d792a84
-
\Users\Public\vbc.exeMD5
a0339a15a2f219b54b3c1a6b4afbc6be
SHA17df7a7515715283591582974eb47197c9369efe3
SHA256eef89bbd9fcfb6e1b095b5302af5c176ed593bf9c6ce26d0be6ebeddc7fa0e6a
SHA51230037c5446b79946da950d99ba0b315134d7793307f8fb25255a0db8121d70f8df201029ffd00d7cb4b1ed6201ab60795727b983296a03a0a5a2fac28d792a84
-
\Users\Public\vbc.exeMD5
a0339a15a2f219b54b3c1a6b4afbc6be
SHA17df7a7515715283591582974eb47197c9369efe3
SHA256eef89bbd9fcfb6e1b095b5302af5c176ed593bf9c6ce26d0be6ebeddc7fa0e6a
SHA51230037c5446b79946da950d99ba0b315134d7793307f8fb25255a0db8121d70f8df201029ffd00d7cb4b1ed6201ab60795727b983296a03a0a5a2fac28d792a84
-
memory/1076-82-0x0000000000430000-0x0000000000451000-memory.dmpFilesize
132KB
-
memory/1076-80-0x0000000000250000-0x000000000026B000-memory.dmpFilesize
108KB
-
memory/1076-71-0x0000000000D00000-0x0000000000D01000-memory.dmpFilesize
4KB
-
memory/1076-73-0x00000000021B0000-0x0000000002249000-memory.dmpFilesize
612KB
-
memory/1076-74-0x00000000022A0000-0x00000000022A1000-memory.dmpFilesize
4KB
-
memory/1076-68-0x0000000000000000-mapping.dmp
-
memory/1076-81-0x00000000052C0000-0x0000000005326000-memory.dmpFilesize
408KB
-
memory/1184-63-0x0000000075B31000-0x0000000075B33000-memory.dmpFilesize
8KB
-
memory/1668-88-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1668-84-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1668-85-0x00000000004139DE-mapping.dmp
-
memory/1948-77-0x0000000005A93000-0x0000000005A95000-memory.dmpFilesize
8KB
-
memory/1948-79-0x0000000005A9A000-0x0000000005A9D000-memory.dmpFilesize
12KB
-
memory/1948-60-0x000000002F071000-0x000000002F074000-memory.dmpFilesize
12KB
-
memory/1948-62-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1948-78-0x0000000005A98000-0x0000000005A9A000-memory.dmpFilesize
8KB
-
memory/1948-76-0x0000000005A90000-0x0000000005A93000-memory.dmpFilesize
12KB
-
memory/1948-61-0x0000000071AE1000-0x0000000071AE3000-memory.dmpFilesize
8KB
-
memory/1948-75-0x0000000005A90000-0x0000000005A93000-memory.dmpFilesize
12KB
-
memory/1948-89-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB