Analysis
-
max time kernel
841s -
max time network
889s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
28-07-2021 05:20
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASE ORDER NO_2807.xlsx
Resource
win7v20210408
Behavioral task
behavioral2
Sample
PURCHASE ORDER NO_2807.xlsx
Resource
win10v20210410
General
-
Target
PURCHASE ORDER NO_2807.xlsx
-
Size
672KB
-
MD5
2902877e609d74de1bbdc56c23aabcb1
-
SHA1
f07665cce2f3ac96345aa0d00a0562572eb8e496
-
SHA256
8a80b6705686eaae47aba889cdf519403bb009f0e2c74432b1afad406a12522f
-
SHA512
3b0fbb6e97a516b9d02302f0444d6e53a973281fa3d19c390e5b6db2c3d7ab3773db76f202b0f91ed2cc58100cdc750d98b0c8db2c11eba4029999bbd86d1599
Malware Config
Extracted
lokibot
http://arku.xyz/tkrr/T1/w2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 7 688 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
uybfyqazr.exeuybfyqazr.exepid process 388 uybfyqazr.exe 2028 uybfyqazr.exe -
Loads dropped DLL 1 IoCs
Processes:
EQNEDT32.EXEpid process 688 EQNEDT32.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
uybfyqazr.exedescription pid process target process PID 388 set thread context of 2028 388 uybfyqazr.exe uybfyqazr.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1076 EXCEL.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
EXCEL.EXEpid process 1076 EXCEL.EXE -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
uybfyqazr.exepid process 388 uybfyqazr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
uybfyqazr.exeEXCEL.EXEdescription pid process Token: SeDebugPrivilege 2028 uybfyqazr.exe Token: SeShutdownPrivilege 1076 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
EXCEL.EXEpid process 1076 EXCEL.EXE 1076 EXCEL.EXE 1076 EXCEL.EXE 1076 EXCEL.EXE 1076 EXCEL.EXE 1076 EXCEL.EXE 1076 EXCEL.EXE 1076 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
EQNEDT32.EXEuybfyqazr.exedescription pid process target process PID 688 wrote to memory of 388 688 EQNEDT32.EXE uybfyqazr.exe PID 688 wrote to memory of 388 688 EQNEDT32.EXE uybfyqazr.exe PID 688 wrote to memory of 388 688 EQNEDT32.EXE uybfyqazr.exe PID 688 wrote to memory of 388 688 EQNEDT32.EXE uybfyqazr.exe PID 388 wrote to memory of 2028 388 uybfyqazr.exe uybfyqazr.exe PID 388 wrote to memory of 2028 388 uybfyqazr.exe uybfyqazr.exe PID 388 wrote to memory of 2028 388 uybfyqazr.exe uybfyqazr.exe PID 388 wrote to memory of 2028 388 uybfyqazr.exe uybfyqazr.exe PID 388 wrote to memory of 2028 388 uybfyqazr.exe uybfyqazr.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER NO_2807.xlsx"1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\uybfyqazr.exeC:\Users\Admin\AppData\Roaming\uybfyqazr.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\uybfyqazr.exeC:\Users\Admin\AppData\Roaming\uybfyqazr.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\uybfyqazr.exeMD5
4bd029fab2e1855b65f19af615d5af49
SHA11fdcbad64e3513f887e359ed8411b415cc43ba23
SHA25619bb2b0774e1638edbdcccc7e2fb936773727966acd3977137a8acfe0823266d
SHA51221de8fa96ec71de42f2501029d96baca5a5fd34f06a4729ecc779b53410fa9a979412ce965d9792127416dad81758ac5623d0b3d20349de8488e7a330df9e282
-
C:\Users\Admin\AppData\Roaming\uybfyqazr.exeMD5
4bd029fab2e1855b65f19af615d5af49
SHA11fdcbad64e3513f887e359ed8411b415cc43ba23
SHA25619bb2b0774e1638edbdcccc7e2fb936773727966acd3977137a8acfe0823266d
SHA51221de8fa96ec71de42f2501029d96baca5a5fd34f06a4729ecc779b53410fa9a979412ce965d9792127416dad81758ac5623d0b3d20349de8488e7a330df9e282
-
C:\Users\Admin\AppData\Roaming\uybfyqazr.exeMD5
4bd029fab2e1855b65f19af615d5af49
SHA11fdcbad64e3513f887e359ed8411b415cc43ba23
SHA25619bb2b0774e1638edbdcccc7e2fb936773727966acd3977137a8acfe0823266d
SHA51221de8fa96ec71de42f2501029d96baca5a5fd34f06a4729ecc779b53410fa9a979412ce965d9792127416dad81758ac5623d0b3d20349de8488e7a330df9e282
-
\Users\Admin\AppData\Roaming\uybfyqazr.exeMD5
4bd029fab2e1855b65f19af615d5af49
SHA11fdcbad64e3513f887e359ed8411b415cc43ba23
SHA25619bb2b0774e1638edbdcccc7e2fb936773727966acd3977137a8acfe0823266d
SHA51221de8fa96ec71de42f2501029d96baca5a5fd34f06a4729ecc779b53410fa9a979412ce965d9792127416dad81758ac5623d0b3d20349de8488e7a330df9e282
-
memory/388-64-0x0000000000000000-mapping.dmp
-
memory/388-67-0x0000000000080000-0x0000000000082000-memory.dmpFilesize
8KB
-
memory/688-62-0x0000000075AA1000-0x0000000075AA3000-memory.dmpFilesize
8KB
-
memory/1076-59-0x000000002F7A1000-0x000000002F7A4000-memory.dmpFilesize
12KB
-
memory/1076-60-0x0000000071091000-0x0000000071093000-memory.dmpFilesize
8KB
-
memory/1076-61-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2028-68-0x00000000004139DE-mapping.dmp
-
memory/2028-71-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB