Analysis

  • max time kernel
    128s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    20-01-2023 09:38

General

  • Target

    SecuriteInfo.com.Exploit.MathType-Obfs.Gen.1535.13330.xls

  • Size

    248KB

  • MD5

    9315cff2ed7e63ba2731f828957424fe

  • SHA1

    063b6b535513c048ad1a472373bcbf83491a73d0

  • SHA256

    c087ab1e19d3868b8e99dbc4efcc104e540101d95a3d0cba45321b2733f02793

  • SHA512

    77931a33a04a8ef1ee2947b297b0114ce0bb2e7f2dff1e4952e6905e5be58f1640e431696d006780c996b5cefd1fab8e5299f37240d4d1c4b634199ad16c2c24

  • SSDEEP

    6144:BcBIcuhZ+RwPONXoRjDhIcp0fDlavx+W26nAS7qHtCIZOBY7ZTO7c8xaD1:Bc2ciz+77F4c

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.164/zang/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Exploit.MathType-Obfs.Gen.1535.13330.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1676
  • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
    1⤵
    • Blocklisted process makes network request
    • Loads dropped DLL
    • Launches Equation Editor
    • Suspicious use of WriteProcessMemory
    PID:780
    • C:\Users\Public\vbc.exe
      "C:\Users\Public\vbc.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1652
      • C:\Users\Public\vbc.exe
        "C:\Users\Public\vbc.exe"
        3⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:1792

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Public\vbc.exe

    Filesize

    806KB

    MD5

    54b70bbfe10136b7e5386397362be742

    SHA1

    0faad80fbaa71d3659eaf3152073a32f5af29ec1

    SHA256

    bfb61209af275628632fadfb1a72c8a22e5bf64d0ecdea40461b493fe3e6ca80

    SHA512

    a03e086ec6ec67c63882de017c7cc2b395a8e1e52d09028709e516d92bd36aa1ca443b4bc271ed0c7deab658c2e9a06cfb42ef9b597bebff06e9e6055aef43c1

  • C:\Users\Public\vbc.exe

    Filesize

    806KB

    MD5

    54b70bbfe10136b7e5386397362be742

    SHA1

    0faad80fbaa71d3659eaf3152073a32f5af29ec1

    SHA256

    bfb61209af275628632fadfb1a72c8a22e5bf64d0ecdea40461b493fe3e6ca80

    SHA512

    a03e086ec6ec67c63882de017c7cc2b395a8e1e52d09028709e516d92bd36aa1ca443b4bc271ed0c7deab658c2e9a06cfb42ef9b597bebff06e9e6055aef43c1

  • C:\Users\Public\vbc.exe

    Filesize

    806KB

    MD5

    54b70bbfe10136b7e5386397362be742

    SHA1

    0faad80fbaa71d3659eaf3152073a32f5af29ec1

    SHA256

    bfb61209af275628632fadfb1a72c8a22e5bf64d0ecdea40461b493fe3e6ca80

    SHA512

    a03e086ec6ec67c63882de017c7cc2b395a8e1e52d09028709e516d92bd36aa1ca443b4bc271ed0c7deab658c2e9a06cfb42ef9b597bebff06e9e6055aef43c1

  • \Users\Public\vbc.exe

    Filesize

    806KB

    MD5

    54b70bbfe10136b7e5386397362be742

    SHA1

    0faad80fbaa71d3659eaf3152073a32f5af29ec1

    SHA256

    bfb61209af275628632fadfb1a72c8a22e5bf64d0ecdea40461b493fe3e6ca80

    SHA512

    a03e086ec6ec67c63882de017c7cc2b395a8e1e52d09028709e516d92bd36aa1ca443b4bc271ed0c7deab658c2e9a06cfb42ef9b597bebff06e9e6055aef43c1

  • \Users\Public\vbc.exe

    Filesize

    806KB

    MD5

    54b70bbfe10136b7e5386397362be742

    SHA1

    0faad80fbaa71d3659eaf3152073a32f5af29ec1

    SHA256

    bfb61209af275628632fadfb1a72c8a22e5bf64d0ecdea40461b493fe3e6ca80

    SHA512

    a03e086ec6ec67c63882de017c7cc2b395a8e1e52d09028709e516d92bd36aa1ca443b4bc271ed0c7deab658c2e9a06cfb42ef9b597bebff06e9e6055aef43c1

  • \Users\Public\vbc.exe

    Filesize

    806KB

    MD5

    54b70bbfe10136b7e5386397362be742

    SHA1

    0faad80fbaa71d3659eaf3152073a32f5af29ec1

    SHA256

    bfb61209af275628632fadfb1a72c8a22e5bf64d0ecdea40461b493fe3e6ca80

    SHA512

    a03e086ec6ec67c63882de017c7cc2b395a8e1e52d09028709e516d92bd36aa1ca443b4bc271ed0c7deab658c2e9a06cfb42ef9b597bebff06e9e6055aef43c1

  • \Users\Public\vbc.exe

    Filesize

    806KB

    MD5

    54b70bbfe10136b7e5386397362be742

    SHA1

    0faad80fbaa71d3659eaf3152073a32f5af29ec1

    SHA256

    bfb61209af275628632fadfb1a72c8a22e5bf64d0ecdea40461b493fe3e6ca80

    SHA512

    a03e086ec6ec67c63882de017c7cc2b395a8e1e52d09028709e516d92bd36aa1ca443b4bc271ed0c7deab658c2e9a06cfb42ef9b597bebff06e9e6055aef43c1

  • memory/1652-70-0x00000000005D0000-0x00000000005E6000-memory.dmp

    Filesize

    88KB

  • memory/1652-71-0x0000000000630000-0x000000000063A000-memory.dmp

    Filesize

    40KB

  • memory/1652-64-0x0000000000000000-mapping.dmp

  • memory/1652-73-0x0000000000AD0000-0x0000000000AF2000-memory.dmp

    Filesize

    136KB

  • memory/1652-72-0x0000000005190000-0x00000000051EA000-memory.dmp

    Filesize

    360KB

  • memory/1652-67-0x0000000000CA0000-0x0000000000D6E000-memory.dmp

    Filesize

    824KB

  • memory/1676-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1676-54-0x000000002FD91000-0x000000002FD94000-memory.dmp

    Filesize

    12KB

  • memory/1676-69-0x00000000729BD000-0x00000000729C8000-memory.dmp

    Filesize

    44KB

  • memory/1676-55-0x00000000719D1000-0x00000000719D3000-memory.dmp

    Filesize

    8KB

  • memory/1676-57-0x00000000729BD000-0x00000000729C8000-memory.dmp

    Filesize

    44KB

  • memory/1676-58-0x0000000076201000-0x0000000076203000-memory.dmp

    Filesize

    8KB

  • memory/1676-91-0x00000000729BD000-0x00000000729C8000-memory.dmp

    Filesize

    44KB

  • memory/1676-90-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1792-74-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/1792-80-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/1792-82-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/1792-79-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/1792-83-0x00000000004139DE-mapping.dmp

  • memory/1792-86-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/1792-88-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/1792-89-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/1792-77-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/1792-75-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB