lokibot | 4b67a9ddf9fc9d3df0b158bdae523144c329080a0e949a71584b7339b204e5c5

Analysis

max time kernel
186s
max time network
234s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
16-01-2023 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

P.I 99220345.docx
Size

10KB
MD5

28d506098937d7ddaf58805011f8d45d
SHA1

24229cc8d80884084c1addb04c65681c9233dad0
SHA256

4b67a9ddf9fc9d3df0b158bdae523144c329080a0e949a71584b7339b204e5c5
SHA512

cf5e2af854adec3a6657e2fac63aefaa8484a30fbe78e074760bc54a00aec4046724fad6b8c03ab87e2675e6476130138582b64c722e5737d97946653c46e5ef
SSDEEP

192:ScIMmtP8ar5G/bfIdTOpULnamWBX8ex6y3PWFl:SPXt4ATOqLnosM+D

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

https://sempersim.su/ha1/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Blocklisted process makes network request 1 IoCs

Processes:

EQNEDT32.EXE

flow pid process

8 976 EQNEDT32.EXE
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

vbc.exedpgvxmdtum.exedpgvxmdtum.exe

pid process

868 vbc.exe
2028 dpgvxmdtum.exe
1752 dpgvxmdtum.exe

flow	pid	process
8	976	EQNEDT32.EXE

pid	process
868	vbc.exe
2028	dpgvxmdtum.exe
1752	dpgvxmdtum.exe

Abuses OpenXML format to download file from external location 2 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\14.0\Common	WINWORD.EXE
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\Common\Offline\Files\http://392097655/_--00_o______---00o0_00-o_o0-__________o0o-__________/jpooofggjdfjghjfdggsahfhfghf.doc	WINWORD.EXE

Loads dropped DLL 4 IoCs

Processes:

EQNEDT32.EXEvbc.exedpgvxmdtum.exe

pid process

976 EQNEDT32.EXE
868 vbc.exe
868 vbc.exe
2028 dpgvxmdtum.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
976	EQNEDT32.EXE
868	vbc.exe
868	vbc.exe
2028	dpgvxmdtum.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

dpgvxmdtum.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	dpgvxmdtum.exe
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	dpgvxmdtum.exe
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	dpgvxmdtum.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

dpgvxmdtum.exe

description pid process target process

PID 2028 set thread context of 1752 2028 dpgvxmdtum.exe dpgvxmdtum.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

976 EQNEDT32.EXE

description	pid	process	target process
PID 2028 set thread context of 1752	2028	dpgvxmdtum.exe	dpgvxmdtum.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

pid	process
976	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1496 WINWORD.EXE
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

dpgvxmdtum.exe

pid process

2028 dpgvxmdtum.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

dpgvxmdtum.exeWINWORD.EXE

description pid process

Token: SeDebugPrivilege 1752 dpgvxmdtum.exe
Token: SeShutdownPrivilege 1496 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1496 WINWORD.EXE
1496 WINWORD.EXE

pid	process
1496	WINWORD.EXE

pid	process
2028	dpgvxmdtum.exe

description	pid	process
Token: SeDebugPrivilege	1752	dpgvxmdtum.exe
Token: SeShutdownPrivilege	1496	WINWORD.EXE

pid	process
1496	WINWORD.EXE
1496	WINWORD.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

EQNEDT32.EXEvbc.exedpgvxmdtum.exeWINWORD.EXE

description	pid	process	target process
PID 976 wrote to memory of 868	976	EQNEDT32.EXE	vbc.exe
PID 976 wrote to memory of 868	976	EQNEDT32.EXE	vbc.exe
PID 976 wrote to memory of 868	976	EQNEDT32.EXE	vbc.exe
PID 976 wrote to memory of 868	976	EQNEDT32.EXE	vbc.exe
PID 868 wrote to memory of 2028	868	vbc.exe	dpgvxmdtum.exe
PID 868 wrote to memory of 2028	868	vbc.exe	dpgvxmdtum.exe
PID 868 wrote to memory of 2028	868	vbc.exe	dpgvxmdtum.exe
PID 868 wrote to memory of 2028	868	vbc.exe	dpgvxmdtum.exe
PID 2028 wrote to memory of 1752	2028	dpgvxmdtum.exe	dpgvxmdtum.exe
PID 2028 wrote to memory of 1752	2028	dpgvxmdtum.exe	dpgvxmdtum.exe
PID 2028 wrote to memory of 1752	2028	dpgvxmdtum.exe	dpgvxmdtum.exe
PID 2028 wrote to memory of 1752	2028	dpgvxmdtum.exe	dpgvxmdtum.exe
PID 2028 wrote to memory of 1752	2028	dpgvxmdtum.exe	dpgvxmdtum.exe
PID 1496 wrote to memory of 1380	1496	WINWORD.EXE	splwow64.exe
PID 1496 wrote to memory of 1380	1496	WINWORD.EXE	splwow64.exe
PID 1496 wrote to memory of 1380	1496	WINWORD.EXE	splwow64.exe
PID 1496 wrote to memory of 1380	1496	WINWORD.EXE	splwow64.exe

outlook_office_path 1 IoCs

Processes:

dpgvxmdtum.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	dpgvxmdtum.exe

outlook_win_path 1 IoCs

Processes:

dpgvxmdtum.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	dpgvxmdtum.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\P.I 99220345.docx"
1⤵
- Abuses OpenXML format to download file from external location
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1380

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:976

C:\Users\Public\vbc.exe
"C:\Users\Public\vbc.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:868

C:\Users\Admin\AppData\Local\Temp\dpgvxmdtum.exe
"C:\Users\Admin\AppData\Local\Temp\dpgvxmdtum.exe" C:\Users\Admin\AppData\Local\Temp\feiewqxkkjf.osb
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2028

C:\Users\Admin\AppData\Local\Temp\dpgvxmdtum.exe
"C:\Users\Admin\AppData\Local\Temp\dpgvxmdtum.exe"
4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1752

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Exploitation for Client Execution

T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dpgvxmdtum.exe
Filesize
53KB

MD5
7161a61f688e63fb69df4767de016a43

SHA1
f23558f27c54f967b0519ccf8e6085cf12cf43e2

SHA256
5d99cd5ff1a6c8d9183cc7132e171bd5b35d0a0abd96947226e8c187277323cd

SHA512
90768522122136e8788465bae7973c13d022c1ff104271dccee66ddd478ea4460cce4b3febc63d6efad38780b7f4c7a3b3048a434c6354d42b1e6eba28f7e68c

Download Submit
C:\Users\Admin\AppData\Local\Temp\dpgvxmdtum.exe
Filesize
53KB

MD5
7161a61f688e63fb69df4767de016a43

SHA1
f23558f27c54f967b0519ccf8e6085cf12cf43e2

SHA256
5d99cd5ff1a6c8d9183cc7132e171bd5b35d0a0abd96947226e8c187277323cd

SHA512
90768522122136e8788465bae7973c13d022c1ff104271dccee66ddd478ea4460cce4b3febc63d6efad38780b7f4c7a3b3048a434c6354d42b1e6eba28f7e68c

Download Submit
C:\Users\Admin\AppData\Local\Temp\dpgvxmdtum.exe
Filesize
53KB

MD5
7161a61f688e63fb69df4767de016a43

SHA1
f23558f27c54f967b0519ccf8e6085cf12cf43e2

SHA256
5d99cd5ff1a6c8d9183cc7132e171bd5b35d0a0abd96947226e8c187277323cd

SHA512
90768522122136e8788465bae7973c13d022c1ff104271dccee66ddd478ea4460cce4b3febc63d6efad38780b7f4c7a3b3048a434c6354d42b1e6eba28f7e68c

Download Submit
C:\Users\Admin\AppData\Local\Temp\dvhldofr.lla
Filesize
124KB

MD5
3d4a6f79291d3875db38ee4294a5ff94

SHA1
3bade4e8c0b0000b6f61b7f569f03f85775a13ce

SHA256
5aadeb18553e1c5518cb4722652bc46d2a1ce48b9fa1bc98f0d367dec6aaa842

SHA512
5789b8a8da6ae3c130dd2768c3307e05272eb4f8913f48cb4548ac65a1171a3e8cdc25d54fefa5eec62bf0adaa30a716718aa9849bbe8fa18c6922dfe6d1255b

Download Submit
C:\Users\Admin\AppData\Local\Temp\feiewqxkkjf.osb
Filesize
5KB

MD5
530c3bfc50912d630e557662e70a7b7d

SHA1
e5c58863693d12cb6f5c6cf8918ca65c7db92e24

SHA256
9dc0d8295b0154b6a2382fbb3d8558662b4674501784cdbf3b1bebde54756ffa

SHA512
80ff35d9122e8d667a96efbfe10faefe5518935094475a0510c417f016e464af2e42edb077aaf0d57c6fd9b40d30df28df0d1f29aec2c5e8ec6aed3dd5b30b1e

Download Submit
C:\Users\Public\vbc.exe
Filesize
344KB

MD5
419d97afbdef4d3bbdfed37cf2522cc1

SHA1
da5890bca82bbdaaa771426f64bb888c7ab2479d

SHA256
c60e5978dd457e4e51c9df1d33c844aaab32a873aec48372adb988ca9647cd9b

SHA512
e70a5466d76308ebd20aba1149e07250561fc36bf823847d80c3629fd84b8a8c2c321a62bc23d5972e15b11db397d314923940945d956c5ceaf95f55c07db66b

Download Submit
C:\Users\Public\vbc.exe
Filesize
344KB

MD5
419d97afbdef4d3bbdfed37cf2522cc1

SHA1
da5890bca82bbdaaa771426f64bb888c7ab2479d

SHA256
c60e5978dd457e4e51c9df1d33c844aaab32a873aec48372adb988ca9647cd9b

SHA512
e70a5466d76308ebd20aba1149e07250561fc36bf823847d80c3629fd84b8a8c2c321a62bc23d5972e15b11db397d314923940945d956c5ceaf95f55c07db66b

Download Submit
\Users\Admin\AppData\Local\Temp\dpgvxmdtum.exe
Filesize
53KB

MD5
7161a61f688e63fb69df4767de016a43

SHA1
f23558f27c54f967b0519ccf8e6085cf12cf43e2

SHA256
5d99cd5ff1a6c8d9183cc7132e171bd5b35d0a0abd96947226e8c187277323cd

SHA512
90768522122136e8788465bae7973c13d022c1ff104271dccee66ddd478ea4460cce4b3febc63d6efad38780b7f4c7a3b3048a434c6354d42b1e6eba28f7e68c

Download Submit
\Users\Admin\AppData\Local\Temp\dpgvxmdtum.exe
Filesize
53KB

MD5
7161a61f688e63fb69df4767de016a43

SHA1
f23558f27c54f967b0519ccf8e6085cf12cf43e2

SHA256
5d99cd5ff1a6c8d9183cc7132e171bd5b35d0a0abd96947226e8c187277323cd

SHA512
90768522122136e8788465bae7973c13d022c1ff104271dccee66ddd478ea4460cce4b3febc63d6efad38780b7f4c7a3b3048a434c6354d42b1e6eba28f7e68c

Download Submit
\Users\Admin\AppData\Local\Temp\dpgvxmdtum.exe
Filesize
53KB

MD5
7161a61f688e63fb69df4767de016a43

SHA1
f23558f27c54f967b0519ccf8e6085cf12cf43e2

SHA256
5d99cd5ff1a6c8d9183cc7132e171bd5b35d0a0abd96947226e8c187277323cd

SHA512
90768522122136e8788465bae7973c13d022c1ff104271dccee66ddd478ea4460cce4b3febc63d6efad38780b7f4c7a3b3048a434c6354d42b1e6eba28f7e68c

Download Submit
\Users\Public\vbc.exe
Filesize
344KB

MD5
419d97afbdef4d3bbdfed37cf2522cc1

SHA1
da5890bca82bbdaaa771426f64bb888c7ab2479d

SHA256
c60e5978dd457e4e51c9df1d33c844aaab32a873aec48372adb988ca9647cd9b

SHA512
e70a5466d76308ebd20aba1149e07250561fc36bf823847d80c3629fd84b8a8c2c321a62bc23d5972e15b11db397d314923940945d956c5ceaf95f55c07db66b

Download Submit
memory/868-62-0x0000000000000000-mapping.dmp

Download
memory/1380-80-0x000007FEFBCD1000-0x000007FEFBCD3000-memory.dmp

Filesize
8KB

Download
memory/1380-79-0x0000000000000000-mapping.dmp

Download
memory/1496-54-0x00000000727C1000-0x00000000727C4000-memory.dmp

Filesize
12KB

Download
memory/1496-55-0x0000000070241000-0x0000000070243000-memory.dmp

Filesize
8KB

Download
memory/1496-83-0x000000007122D000-0x0000000071238000-memory.dmp

Filesize
44KB

Download
memory/1496-57-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1496-59-0x000000007122D000-0x0000000071238000-memory.dmp

Filesize
44KB

Download
memory/1496-58-0x000000007122D000-0x0000000071238000-memory.dmp

Filesize
44KB

Download
memory/1496-82-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1496-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1752-81-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1752-75-0x00000000004139DE-mapping.dmp

Download
memory/1752-78-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2028-68-0x0000000000000000-mapping.dmp

Download