Analysis
-
max time kernel
101s -
max time network
139s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-07-2021 14:42
Static task
static1
Behavioral task
behavioral1
Sample
MT103 101T000000018.xlsx
Resource
win7v20210410
Behavioral task
behavioral2
Sample
MT103 101T000000018.xlsx
Resource
win10v20210410
General
-
Target
MT103 101T000000018.xlsx
-
Size
1.2MB
-
MD5
7c13958c9636c3b2542a71d3eacf93b9
-
SHA1
61bab72e6b532ef51cfd36e7836c97b992e62fce
-
SHA256
0f77e014b10cc25d53aeb14e1eff9271f9b7f16aca4c196fc082dd3207191b28
-
SHA512
18f7820c0bde66589a0982ca3f570e6d56666215d32053a61cd8f42d2d13c145ac12b875937d4d2cbd07abe2a1d9514c9064a60c5d52d533b0ea461c25168ea8
Malware Config
Extracted
lokibot
http://asiatrans.cf/BN1/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 5 672 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
vbc.exevbc.exepid process 732 vbc.exe 1636 vbc.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEpid process 672 EQNEDT32.EXE 672 EQNEDT32.EXE 672 EQNEDT32.EXE 672 EQNEDT32.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
vbc.exedescription pid process target process PID 732 set thread context of 1636 732 vbc.exe vbc.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1672 EXCEL.EXE -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
vbc.exepid process 732 vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
vbc.exedescription pid process Token: SeDebugPrivilege 1636 vbc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1672 EXCEL.EXE 1672 EXCEL.EXE 1672 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
EQNEDT32.EXEvbc.exedescription pid process target process PID 672 wrote to memory of 732 672 EQNEDT32.EXE vbc.exe PID 672 wrote to memory of 732 672 EQNEDT32.EXE vbc.exe PID 672 wrote to memory of 732 672 EQNEDT32.EXE vbc.exe PID 672 wrote to memory of 732 672 EQNEDT32.EXE vbc.exe PID 732 wrote to memory of 1636 732 vbc.exe vbc.exe PID 732 wrote to memory of 1636 732 vbc.exe vbc.exe PID 732 wrote to memory of 1636 732 vbc.exe vbc.exe PID 732 wrote to memory of 1636 732 vbc.exe vbc.exe PID 732 wrote to memory of 1636 732 vbc.exe vbc.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\MT103 101T000000018.xlsx"1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\vbc.exeMD5
07c01497b1a48bd763519c1b2561ab2d
SHA17cd72784c6a4e251068a43cba935ebc8a1531c84
SHA256a60e97778614ab28c9e6acf9a2a76e8f42c09372af1a9e5e6802018e3cee2829
SHA51209213f2033186a671dad819e50d5740dc0b953f20fb2fddefc5798ce6bb5d1d40a3c8ed00b446104430541dd21f4bfdcee3e630215fba466f9cfe51fd9aea6b6
-
C:\Users\Public\vbc.exeMD5
07c01497b1a48bd763519c1b2561ab2d
SHA17cd72784c6a4e251068a43cba935ebc8a1531c84
SHA256a60e97778614ab28c9e6acf9a2a76e8f42c09372af1a9e5e6802018e3cee2829
SHA51209213f2033186a671dad819e50d5740dc0b953f20fb2fddefc5798ce6bb5d1d40a3c8ed00b446104430541dd21f4bfdcee3e630215fba466f9cfe51fd9aea6b6
-
C:\Users\Public\vbc.exeMD5
07c01497b1a48bd763519c1b2561ab2d
SHA17cd72784c6a4e251068a43cba935ebc8a1531c84
SHA256a60e97778614ab28c9e6acf9a2a76e8f42c09372af1a9e5e6802018e3cee2829
SHA51209213f2033186a671dad819e50d5740dc0b953f20fb2fddefc5798ce6bb5d1d40a3c8ed00b446104430541dd21f4bfdcee3e630215fba466f9cfe51fd9aea6b6
-
\Users\Public\vbc.exeMD5
07c01497b1a48bd763519c1b2561ab2d
SHA17cd72784c6a4e251068a43cba935ebc8a1531c84
SHA256a60e97778614ab28c9e6acf9a2a76e8f42c09372af1a9e5e6802018e3cee2829
SHA51209213f2033186a671dad819e50d5740dc0b953f20fb2fddefc5798ce6bb5d1d40a3c8ed00b446104430541dd21f4bfdcee3e630215fba466f9cfe51fd9aea6b6
-
\Users\Public\vbc.exeMD5
07c01497b1a48bd763519c1b2561ab2d
SHA17cd72784c6a4e251068a43cba935ebc8a1531c84
SHA256a60e97778614ab28c9e6acf9a2a76e8f42c09372af1a9e5e6802018e3cee2829
SHA51209213f2033186a671dad819e50d5740dc0b953f20fb2fddefc5798ce6bb5d1d40a3c8ed00b446104430541dd21f4bfdcee3e630215fba466f9cfe51fd9aea6b6
-
\Users\Public\vbc.exeMD5
07c01497b1a48bd763519c1b2561ab2d
SHA17cd72784c6a4e251068a43cba935ebc8a1531c84
SHA256a60e97778614ab28c9e6acf9a2a76e8f42c09372af1a9e5e6802018e3cee2829
SHA51209213f2033186a671dad819e50d5740dc0b953f20fb2fddefc5798ce6bb5d1d40a3c8ed00b446104430541dd21f4bfdcee3e630215fba466f9cfe51fd9aea6b6
-
\Users\Public\vbc.exeMD5
07c01497b1a48bd763519c1b2561ab2d
SHA17cd72784c6a4e251068a43cba935ebc8a1531c84
SHA256a60e97778614ab28c9e6acf9a2a76e8f42c09372af1a9e5e6802018e3cee2829
SHA51209213f2033186a671dad819e50d5740dc0b953f20fb2fddefc5798ce6bb5d1d40a3c8ed00b446104430541dd21f4bfdcee3e630215fba466f9cfe51fd9aea6b6
-
memory/672-63-0x00000000767B1000-0x00000000767B3000-memory.dmpFilesize
8KB
-
memory/732-75-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/732-68-0x0000000000000000-mapping.dmp
-
memory/1636-72-0x00000000004139DE-mapping.dmp
-
memory/1636-76-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1672-61-0x0000000071B01000-0x0000000071B03000-memory.dmpFilesize
8KB
-
memory/1672-60-0x000000002FDD1000-0x000000002FDD4000-memory.dmpFilesize
12KB
-
memory/1672-62-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1672-77-0x0000000005ED0000-0x0000000006B1A000-memory.dmpFilesize
12.3MB
-
memory/1672-79-0x0000000005ED0000-0x0000000006B1A000-memory.dmpFilesize
12.3MB
-
memory/1672-78-0x0000000005ED0000-0x0000000006B1A000-memory.dmpFilesize
12.3MB
-
memory/1672-80-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB