Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
05-07-2022 12:17
Static task
static1
Behavioral task
behavioral1
Sample
PL 991382-991383-991384.xlsx
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PL 991382-991383-991384.xlsx
Resource
win10v2004-20220414-en
General
-
Target
PL 991382-991383-991384.xlsx
-
Size
176KB
-
MD5
3817faf60cd206f173d6aecf7ed163e3
-
SHA1
0a21fb7be56324fe17b5d4c80e46195953044725
-
SHA256
8bd13216d09241dea750d29c96273e1ec4ee7bdca995bdb5501517b015957498
-
SHA512
021f26da724bfcf2a7d98eeaf74aac9360ed032d3fefe862abee7237bc8656af356e6f7acbeac89be2dc12d59c982c89283f1609d2b1d673ae87a6e2db75cf9a
Malware Config
Extracted
lokibot
http://62.197.136.176/health4/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
http://��������������З������Й���Й��я��
Signatures
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 3 1356 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
vbc.exevbc.exevbc.exevbc.exevbc.exepid process 520 vbc.exe 556 vbc.exe 1332 vbc.exe 1804 vbc.exe 544 vbc.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEpid process 1356 EQNEDT32.EXE 1356 EQNEDT32.EXE 1356 EQNEDT32.EXE 1356 EQNEDT32.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook vbc.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook vbc.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
vbc.exedescription pid process target process PID 520 set thread context of 544 520 vbc.exe vbc.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 968 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
vbc.exepid process 520 vbc.exe 520 vbc.exe 520 vbc.exe 520 vbc.exe 520 vbc.exe 520 vbc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
vbc.exevbc.exedescription pid process Token: SeDebugPrivilege 520 vbc.exe Token: SeDebugPrivilege 544 vbc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 968 EXCEL.EXE 968 EXCEL.EXE 968 EXCEL.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
EQNEDT32.EXEvbc.exedescription pid process target process PID 1356 wrote to memory of 520 1356 EQNEDT32.EXE vbc.exe PID 1356 wrote to memory of 520 1356 EQNEDT32.EXE vbc.exe PID 1356 wrote to memory of 520 1356 EQNEDT32.EXE vbc.exe PID 1356 wrote to memory of 520 1356 EQNEDT32.EXE vbc.exe PID 520 wrote to memory of 556 520 vbc.exe vbc.exe PID 520 wrote to memory of 556 520 vbc.exe vbc.exe PID 520 wrote to memory of 556 520 vbc.exe vbc.exe PID 520 wrote to memory of 556 520 vbc.exe vbc.exe PID 520 wrote to memory of 1332 520 vbc.exe vbc.exe PID 520 wrote to memory of 1332 520 vbc.exe vbc.exe PID 520 wrote to memory of 1332 520 vbc.exe vbc.exe PID 520 wrote to memory of 1332 520 vbc.exe vbc.exe PID 520 wrote to memory of 1804 520 vbc.exe vbc.exe PID 520 wrote to memory of 1804 520 vbc.exe vbc.exe PID 520 wrote to memory of 1804 520 vbc.exe vbc.exe PID 520 wrote to memory of 1804 520 vbc.exe vbc.exe PID 520 wrote to memory of 544 520 vbc.exe vbc.exe PID 520 wrote to memory of 544 520 vbc.exe vbc.exe PID 520 wrote to memory of 544 520 vbc.exe vbc.exe PID 520 wrote to memory of 544 520 vbc.exe vbc.exe PID 520 wrote to memory of 544 520 vbc.exe vbc.exe PID 520 wrote to memory of 544 520 vbc.exe vbc.exe PID 520 wrote to memory of 544 520 vbc.exe vbc.exe PID 520 wrote to memory of 544 520 vbc.exe vbc.exe PID 520 wrote to memory of 544 520 vbc.exe vbc.exe PID 520 wrote to memory of 544 520 vbc.exe vbc.exe -
outlook_office_path 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook vbc.exe -
outlook_win_path 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook vbc.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\PL 991382-991383-991384.xlsx"1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\vbc.exeFilesize
533KB
MD5be5415532da50d9832276f5dce099325
SHA114f36c405dad88d9c6a3d851ad5aac307eef3824
SHA256c849faef0daef7d35e39a56257df5f060503bb6f6759a96e5f8e86de2de7249f
SHA512b90b947be24deff515421f64b9428405197963707aca42ca5bc560f98e3c6efea5b3e1ce2c5326d51fdfc531c451e0e23b8ea86d9ffae3f2d0298ecae997de97
-
C:\Users\Public\vbc.exeFilesize
533KB
MD5be5415532da50d9832276f5dce099325
SHA114f36c405dad88d9c6a3d851ad5aac307eef3824
SHA256c849faef0daef7d35e39a56257df5f060503bb6f6759a96e5f8e86de2de7249f
SHA512b90b947be24deff515421f64b9428405197963707aca42ca5bc560f98e3c6efea5b3e1ce2c5326d51fdfc531c451e0e23b8ea86d9ffae3f2d0298ecae997de97
-
C:\Users\Public\vbc.exeFilesize
533KB
MD5be5415532da50d9832276f5dce099325
SHA114f36c405dad88d9c6a3d851ad5aac307eef3824
SHA256c849faef0daef7d35e39a56257df5f060503bb6f6759a96e5f8e86de2de7249f
SHA512b90b947be24deff515421f64b9428405197963707aca42ca5bc560f98e3c6efea5b3e1ce2c5326d51fdfc531c451e0e23b8ea86d9ffae3f2d0298ecae997de97
-
C:\Users\Public\vbc.exeFilesize
533KB
MD5be5415532da50d9832276f5dce099325
SHA114f36c405dad88d9c6a3d851ad5aac307eef3824
SHA256c849faef0daef7d35e39a56257df5f060503bb6f6759a96e5f8e86de2de7249f
SHA512b90b947be24deff515421f64b9428405197963707aca42ca5bc560f98e3c6efea5b3e1ce2c5326d51fdfc531c451e0e23b8ea86d9ffae3f2d0298ecae997de97
-
C:\Users\Public\vbc.exeFilesize
533KB
MD5be5415532da50d9832276f5dce099325
SHA114f36c405dad88d9c6a3d851ad5aac307eef3824
SHA256c849faef0daef7d35e39a56257df5f060503bb6f6759a96e5f8e86de2de7249f
SHA512b90b947be24deff515421f64b9428405197963707aca42ca5bc560f98e3c6efea5b3e1ce2c5326d51fdfc531c451e0e23b8ea86d9ffae3f2d0298ecae997de97
-
C:\Users\Public\vbc.exeFilesize
533KB
MD5be5415532da50d9832276f5dce099325
SHA114f36c405dad88d9c6a3d851ad5aac307eef3824
SHA256c849faef0daef7d35e39a56257df5f060503bb6f6759a96e5f8e86de2de7249f
SHA512b90b947be24deff515421f64b9428405197963707aca42ca5bc560f98e3c6efea5b3e1ce2c5326d51fdfc531c451e0e23b8ea86d9ffae3f2d0298ecae997de97
-
\Users\Public\vbc.exeFilesize
533KB
MD5be5415532da50d9832276f5dce099325
SHA114f36c405dad88d9c6a3d851ad5aac307eef3824
SHA256c849faef0daef7d35e39a56257df5f060503bb6f6759a96e5f8e86de2de7249f
SHA512b90b947be24deff515421f64b9428405197963707aca42ca5bc560f98e3c6efea5b3e1ce2c5326d51fdfc531c451e0e23b8ea86d9ffae3f2d0298ecae997de97
-
\Users\Public\vbc.exeFilesize
533KB
MD5be5415532da50d9832276f5dce099325
SHA114f36c405dad88d9c6a3d851ad5aac307eef3824
SHA256c849faef0daef7d35e39a56257df5f060503bb6f6759a96e5f8e86de2de7249f
SHA512b90b947be24deff515421f64b9428405197963707aca42ca5bc560f98e3c6efea5b3e1ce2c5326d51fdfc531c451e0e23b8ea86d9ffae3f2d0298ecae997de97
-
\Users\Public\vbc.exeFilesize
533KB
MD5be5415532da50d9832276f5dce099325
SHA114f36c405dad88d9c6a3d851ad5aac307eef3824
SHA256c849faef0daef7d35e39a56257df5f060503bb6f6759a96e5f8e86de2de7249f
SHA512b90b947be24deff515421f64b9428405197963707aca42ca5bc560f98e3c6efea5b3e1ce2c5326d51fdfc531c451e0e23b8ea86d9ffae3f2d0298ecae997de97
-
\Users\Public\vbc.exeFilesize
533KB
MD5be5415532da50d9832276f5dce099325
SHA114f36c405dad88d9c6a3d851ad5aac307eef3824
SHA256c849faef0daef7d35e39a56257df5f060503bb6f6759a96e5f8e86de2de7249f
SHA512b90b947be24deff515421f64b9428405197963707aca42ca5bc560f98e3c6efea5b3e1ce2c5326d51fdfc531c451e0e23b8ea86d9ffae3f2d0298ecae997de97
-
memory/520-72-0x0000000004F80000-0x0000000004FE2000-memory.dmpFilesize
392KB
-
memory/520-73-0x0000000004E20000-0x0000000004E40000-memory.dmpFilesize
128KB
-
memory/520-67-0x0000000000270000-0x00000000002FA000-memory.dmpFilesize
552KB
-
memory/520-69-0x0000000000410000-0x0000000000430000-memory.dmpFilesize
128KB
-
memory/520-64-0x0000000000000000-mapping.dmp
-
memory/520-71-0x0000000000860000-0x000000000086E000-memory.dmpFilesize
56KB
-
memory/544-85-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/544-83-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/544-92-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/544-91-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/544-89-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/544-77-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/544-78-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/544-80-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/544-82-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/544-86-0x00000000004139DE-mapping.dmp
-
memory/968-70-0x0000000071F2D000-0x0000000071F38000-memory.dmpFilesize
44KB
-
memory/968-54-0x000000002FC41000-0x000000002FC44000-memory.dmpFilesize
12KB
-
memory/968-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/968-55-0x0000000070F41000-0x0000000070F43000-memory.dmpFilesize
8KB
-
memory/968-57-0x0000000075B61000-0x0000000075B63000-memory.dmpFilesize
8KB
-
memory/968-58-0x0000000071F2D000-0x0000000071F38000-memory.dmpFilesize
44KB
-
memory/968-93-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/968-94-0x0000000071F2D000-0x0000000071F38000-memory.dmpFilesize
44KB