lokibot | 85a3337570282d52fffcf91b2cbf5e8064a81265beffa155baba6ca8d6ac2993

Analysis

max time kernel
100s
max time network
95s
platform
windows7_x64
resource
win7-20220414-en
submitted
16/05/2022, 07:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
swift.xlsx
Size 223KB
Sample220516-h28adsfed7
SHA256 85a3337570282d52fffcf91b2cbf5e8064a81265beffa155baba6ca8d6ac2993
MD5 f151564283ab534fb2a0bf71d9a6ff2d
SHA1 cb38295acb4130c7b03aa3959ea139b94d99cafd
SHA512 3d586835c86a84fa9c39a9afbb4002a405274a4ed2b44183bb8dfa71045b87be8994f0905948d9b26388eb5f7f4fb1f056813a204895d76c6810a36a6762e458
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

http://45.133.1.20/healthone/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata
suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016
suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016
suricata

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	1204	EQNEDT32.EXE

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
1164	vbc.exe
1544	othcdkkf.exe
1580	othcdkkf.exe

Loads dropped DLL 3 IoCs

pid	Process
1204	EQNEDT32.EXE
1164	vbc.exe
1544	othcdkkf.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	othcdkkf.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	othcdkkf.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	othcdkkf.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1544 set thread context of 1580	1544	othcdkkf.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Launches Equation Editor 1 TTPs 1 IoCs

Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

exploit

Exploitation for Client Execution

T1203

pid	Process
1204	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
316	EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1580	othcdkkf.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
316	EXCEL.EXE
316	EXCEL.EXE
316	EXCEL.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1164	1204	EQNEDT32.EXE	31
PID 1204 wrote to memory of 1164	1204	EQNEDT32.EXE	31
PID 1204 wrote to memory of 1164	1204	EQNEDT32.EXE	31
PID 1204 wrote to memory of 1164	1204	EQNEDT32.EXE	31
PID 1164 wrote to memory of 1544	1164	vbc.exe	32
PID 1164 wrote to memory of 1544	1164	vbc.exe	32
PID 1164 wrote to memory of 1544	1164	vbc.exe	32
PID 1164 wrote to memory of 1544	1164	vbc.exe	32
PID 1544 wrote to memory of 1580	1544	othcdkkf.exe	33
PID 1544 wrote to memory of 1580	1544	othcdkkf.exe	33
PID 1544 wrote to memory of 1580	1544	othcdkkf.exe	33
PID 1544 wrote to memory of 1580	1544	othcdkkf.exe	33
PID 1544 wrote to memory of 1580	1544	othcdkkf.exe	33
PID 1544 wrote to memory of 1580	1544	othcdkkf.exe	33
PID 1544 wrote to memory of 1580	1544	othcdkkf.exe	33
PID 1544 wrote to memory of 1580	1544	othcdkkf.exe	33
PID 1544 wrote to memory of 1580	1544	othcdkkf.exe	33
PID 1544 wrote to memory of 1580	1544	othcdkkf.exe	33

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	othcdkkf.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	othcdkkf.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\swift.xlsx
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:316

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Public\vbc.exe
  "C:\Users\Public\vbc.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Users\Admin\AppData\Local\Temp\othcdkkf.exe
    C:\Users\Admin\AppData\Local\Temp\othcdkkf.exe C:\Users\Admin\AppData\Local\Temp\grwsgi
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\othcdkkf.exe
      C:\Users\Admin\AppData\Local\Temp\othcdkkf.exe C:\Users\Admin\AppData\Local\Temp\grwsgi
      4⤵
      Executes dropped EXE
      Accesses Microsoft Outlook profiles
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:1580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Exploitation for Client Execution

T1203

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1b67yqbkjha

Path C:\Users\Admin\AppData\Local\Temp\1b67yqbkjha
Size 103KB
SHA256 c79919c9e5569f0d0312a453fd413c8ab53d7eccf6cce914aed2757fb98abc9d
MD5 26e2dd729b26ca6307b0076a2fe6cc98
SHA1 fc48e32f0421b515ca14cfb231062a3fbc3bd32a
SHA512 dfdcefe8e4b089a055e01480acb01efd10126888ed4e9c1064692204bfb8526ed7d0543b7a0fdb8a486fe8d4107f46051765d3fad3f03bd0f6ad4ae840e80778
SSDEEP 3072:qPTP5Vz+Sqt1wE+doN0GiJOkCsC5E+0Bb:qNVz+Di1QsL1
MD5 SHA1 SHA512 SSDEEP

Submit Download

grwsgi

Path C:\Users\Admin\AppData\Local\Temp\grwsgi
Size 5KB
SHA256 50dc5a49f272d3d2360560b2bd1acb79b1485a38c38f6f8da86a4617d68b5211
MD5 1a91740891709fb08065b7251b5d3e66
SHA1 df593080bf85299dbb90f4e157e43d0a55c24503
SHA512 bbb9cd29726e9988867665956ca88ada0d71025a44b511850e2d233c21dee2e1372b5f2a9a8f00abb33ea8c7c2c7c852c612b0e56d631eb4bedfb446f2978e20
SSDEEP 96:fX0K0X2WcdgH0378A1vQjzM1fHnRNp8FW1aTUyCQliRvGuRbXp52+:fX6X2Zas7pIjOfnRbUykilhbXp5z
MD5 SHA1 SHA512 SSDEEP

Submit Download

othcdkkf.exe

Path C:\Users\Admin\AppData\Local\Temp\othcdkkf.exe
Size 78KB
SHA256 35c398a21e59f801b4174c4d83d5b5f6914a1e9e645892aae4a934cf9033480e
MD5 0167454cf13599afc8433dc75c4ee12f
SHA1 be05cdcefc3973d663cf62caee2fbdc435c7a33c
SHA512 e37e0fb4cc8c4104c0f704a8fb7fdea3f9bef53233c36184256e1c11505af0eea17c77e803b9faf28d9b1f62393d3dfbe45428c84587cd352a53e195b901e168
SSDEEP 1536:FsHiCaQLWonr4oxAoenjcXqPvx2rsWjcd+kj:giKyorpat+k
MD5 SHA1 SHA512 SSDEEP

Submit Download

othcdkkf.exe

Path C:\Users\Admin\AppData\Local\Temp\othcdkkf.exe
Size 78KB
SHA256 35c398a21e59f801b4174c4d83d5b5f6914a1e9e645892aae4a934cf9033480e
MD5 0167454cf13599afc8433dc75c4ee12f
SHA1 be05cdcefc3973d663cf62caee2fbdc435c7a33c
SHA512 e37e0fb4cc8c4104c0f704a8fb7fdea3f9bef53233c36184256e1c11505af0eea17c77e803b9faf28d9b1f62393d3dfbe45428c84587cd352a53e195b901e168
SSDEEP 1536:FsHiCaQLWonr4oxAoenjcXqPvx2rsWjcd+kj:giKyorpat+k
MD5 SHA1 SHA512 SSDEEP

Submit Download

othcdkkf.exe

Path C:\Users\Admin\AppData\Local\Temp\othcdkkf.exe
Size 78KB
SHA256 35c398a21e59f801b4174c4d83d5b5f6914a1e9e645892aae4a934cf9033480e
MD5 0167454cf13599afc8433dc75c4ee12f
SHA1 be05cdcefc3973d663cf62caee2fbdc435c7a33c
SHA512 e37e0fb4cc8c4104c0f704a8fb7fdea3f9bef53233c36184256e1c11505af0eea17c77e803b9faf28d9b1f62393d3dfbe45428c84587cd352a53e195b901e168
SSDEEP 1536:FsHiCaQLWonr4oxAoenjcXqPvx2rsWjcd+kj:giKyorpat+k
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc.exe

Path C:\Users\Public\vbc.exe
Size 182KB
SHA256 295c7dda6e10a88f9600251ee00494baab8703bd86f064298ab150feb49c3b15
MD5 6b652bdcd4da5e522480b3175938b26c
SHA1 ac2580682511d1b7b22791764412e57cbc8bfcb1
SHA512 656e3f981bdffab99ad86797d8c7e81b13e12f36d3f5922cf8d9e9ab614064f2ac91d64cee72ec21947a6b5097860f609c66596300fba007f130e8da5c334d7e
SSDEEP 3072:LODZGPEounbaMtN0b3Zx2OlDbToxnTBiiLwbDsoLVAFHM+IknjsMDv+uV:LOtIOP3Azv1UxTBBqDsowHXNgMbb
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc.exe

Path C:\Users\Public\vbc.exe
Size 182KB
SHA256 295c7dda6e10a88f9600251ee00494baab8703bd86f064298ab150feb49c3b15
MD5 6b652bdcd4da5e522480b3175938b26c
SHA1 ac2580682511d1b7b22791764412e57cbc8bfcb1
SHA512 656e3f981bdffab99ad86797d8c7e81b13e12f36d3f5922cf8d9e9ab614064f2ac91d64cee72ec21947a6b5097860f609c66596300fba007f130e8da5c334d7e
SSDEEP 3072:LODZGPEounbaMtN0b3Zx2OlDbToxnTBiiLwbDsoLVAFHM+IknjsMDv+uV:LOtIOP3Azv1UxTBBqDsowHXNgMbb
MD5 SHA1 SHA512 SSDEEP

Submit Download

othcdkkf.exe

Path \Users\Admin\AppData\Local\Temp\othcdkkf.exe
Size 78KB
SHA256 35c398a21e59f801b4174c4d83d5b5f6914a1e9e645892aae4a934cf9033480e
MD5 0167454cf13599afc8433dc75c4ee12f
SHA1 be05cdcefc3973d663cf62caee2fbdc435c7a33c
SHA512 e37e0fb4cc8c4104c0f704a8fb7fdea3f9bef53233c36184256e1c11505af0eea17c77e803b9faf28d9b1f62393d3dfbe45428c84587cd352a53e195b901e168
SSDEEP 1536:FsHiCaQLWonr4oxAoenjcXqPvx2rsWjcd+kj:giKyorpat+k
MD5 SHA1 SHA512 SSDEEP

Submit Download

othcdkkf.exe

Path \Users\Admin\AppData\Local\Temp\othcdkkf.exe
Size 78KB
SHA256 35c398a21e59f801b4174c4d83d5b5f6914a1e9e645892aae4a934cf9033480e
MD5 0167454cf13599afc8433dc75c4ee12f
SHA1 be05cdcefc3973d663cf62caee2fbdc435c7a33c
SHA512 e37e0fb4cc8c4104c0f704a8fb7fdea3f9bef53233c36184256e1c11505af0eea17c77e803b9faf28d9b1f62393d3dfbe45428c84587cd352a53e195b901e168
SSDEEP 1536:FsHiCaQLWonr4oxAoenjcXqPvx2rsWjcd+kj:giKyorpat+k
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc.exe

Path \Users\Public\vbc.exe
Size 182KB
SHA256 295c7dda6e10a88f9600251ee00494baab8703bd86f064298ab150feb49c3b15
MD5 6b652bdcd4da5e522480b3175938b26c
SHA1 ac2580682511d1b7b22791764412e57cbc8bfcb1
SHA512 656e3f981bdffab99ad86797d8c7e81b13e12f36d3f5922cf8d9e9ab614064f2ac91d64cee72ec21947a6b5097860f609c66596300fba007f130e8da5c334d7e
SSDEEP 3072:LODZGPEounbaMtN0b3Zx2OlDbToxnTBiiLwbDsoLVAFHM+IknjsMDv+uV:LOtIOP3Azv1UxTBBqDsowHXNgMbb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/316-54-0x000000002FCC1000-0x000000002FCC4000-memory.dmp

Download

memory/316-58-0x0000000076431000-0x0000000076433000-memory.dmp

Download

memory/316-57-0x00000000722FD000-0x0000000072308000-memory.dmp

Download

memory/316-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Download

memory/316-55-0x0000000071311000-0x0000000071313000-memory.dmp

Download

memory/316-79-0x000000005FFF0000-0x0000000060000000-memory.dmp

Download

memory/1580-72-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1580-76-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1580-78-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads