Analysis

  • max time kernel
    104s
  • max time network
    108s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    02-02-2023 11:39

General

  • Target

    2.docx

  • Size

    10KB

  • MD5

    964435a9422be8e9212752151d6e2045

  • SHA1

    7bf1fa0295f31caca8f93b986e1980764695683b

  • SHA256

    b9cd7f34e5260b2002c3b3514c8756e4f211fa5a8cdad2c107b90131996605e7

  • SHA512

    86e8e259e4244210201502a0da6e7bacd730b9e92f21dc2ab07328a4148bcf9af383610aac0089e431558efe5e7dc32d3775aebdb6a9d509a35dab06f930a2ee

  • SSDEEP

    192:ScIMmtP5hG/b7XN+eOUeO+5+5F7Jar/YEChI3uN:SPXRE7XtOUe7wtar/YECO+

Malware Config

Extracted

Family

lokibot

C2

https://sempersim.su/ha4/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Abuses OpenXML format to download file from external location 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2.docx"
    1⤵
    • Abuses OpenXML format to download file from external location
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:988
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:820
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:1740
      • C:\Users\Public\vbc.exe
        "C:\Users\Public\vbc.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1384
        • C:\Users\Admin\AppData\Local\Temp\jzolhsxw.exe
          "C:\Users\Admin\AppData\Local\Temp\jzolhsxw.exe" C:\Users\Admin\AppData\Local\Temp\ciwsqdvkaak.zs
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:1964
          • C:\Users\Admin\AppData\Local\Temp\jzolhsxw.exe
            "C:\Users\Admin\AppData\Local\Temp\jzolhsxw.exe"
            4⤵
            • Executes dropped EXE
            • Accesses Microsoft Outlook profiles
            • Suspicious use of AdjustPrivilegeToken
            • outlook_office_path
            • outlook_win_path
            PID:1320

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scripting

    1
    T1064

    Exploitation for Client Execution

    1
    T1203

    Defense Evasion

    Scripting

    1
    T1064

    Modify Registry

    1
    T1112

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    System Information Discovery

    1
    T1082

    Collection

    Data from Local System

    1
    T1005

    Email Collection

    1
    T1114

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\ciwsqdvkaak.zs
      Filesize

      6KB

      MD5

      cfb53f7aa820aec8d06ac535876a6955

      SHA1

      a33a5d690490c00c40366d447406f86dcd041566

      SHA256

      40316a07886744103ad4c37eba801e32886a1c717f6d0d0774d31bf649ecbdc3

      SHA512

      d2ae194573b248dcc2846f36e611a65766b743a53fa8b3d81b1356d3292e4b09f7a4afd67698d240b628583cff517534bde66398b88a78eb186bdebd4eaab2a3

    • C:\Users\Admin\AppData\Local\Temp\jzolhsxw.exe
      Filesize

      164KB

      MD5

      b7e125f8eeb6a22522a8ea9de90b0863

      SHA1

      f4520417cc50768cbbe7db5fa7dbc153c44c219f

      SHA256

      46a8abcfed3ac0235ae3ace2976235a9fb9ae00a1c6463efca0db9dd76b7d9e3

      SHA512

      ce697ee38b5ee465bb4720a1b822e2e1617e0b70bad2689197c7a0e70c44157088d4dae9f7657625ebcfa655c7aa0b01189f6f4097c7db8f05be0bdd11fffd1f

    • C:\Users\Admin\AppData\Local\Temp\jzolhsxw.exe
      Filesize

      164KB

      MD5

      b7e125f8eeb6a22522a8ea9de90b0863

      SHA1

      f4520417cc50768cbbe7db5fa7dbc153c44c219f

      SHA256

      46a8abcfed3ac0235ae3ace2976235a9fb9ae00a1c6463efca0db9dd76b7d9e3

      SHA512

      ce697ee38b5ee465bb4720a1b822e2e1617e0b70bad2689197c7a0e70c44157088d4dae9f7657625ebcfa655c7aa0b01189f6f4097c7db8f05be0bdd11fffd1f

    • C:\Users\Admin\AppData\Local\Temp\jzolhsxw.exe
      Filesize

      164KB

      MD5

      b7e125f8eeb6a22522a8ea9de90b0863

      SHA1

      f4520417cc50768cbbe7db5fa7dbc153c44c219f

      SHA256

      46a8abcfed3ac0235ae3ace2976235a9fb9ae00a1c6463efca0db9dd76b7d9e3

      SHA512

      ce697ee38b5ee465bb4720a1b822e2e1617e0b70bad2689197c7a0e70c44157088d4dae9f7657625ebcfa655c7aa0b01189f6f4097c7db8f05be0bdd11fffd1f

    • C:\Users\Admin\AppData\Local\Temp\nicaybhe.hps
      Filesize

      124KB

      MD5

      93b3e47016acc540c5e66243e6178ae2

      SHA1

      083e6285d48e5efc89725ada09ab13416386739f

      SHA256

      af1cbff98b4411e33c657eed3a2788b487810297f46e2179b45533a5eaa3a0fa

      SHA512

      4ef043a57cb55d8af033ae40e835a7a085d02509ece5aea357c2f8c1f5b41051b758fda9fff7e8f92b2213c364c64da1642093266f84f412651c403c378c2432

    • C:\Users\Public\vbc.exe
      Filesize

      217KB

      MD5

      3c6368b561ab649a24c56e83ddff04b9

      SHA1

      a318d03da411d02cea18f3cc50f3922a2f3f4c9a

      SHA256

      d0141a1ffd171ac766d2e964db91c7042d922ceea3ad4d46fbd77c5e9fb52274

      SHA512

      9a81a36758ba3d2c4107a53658a04809894e370d8824aae98c55c35edba0dfe8b55c46fefda58fe947d048f24cc5618ee5475ae58d1906646df7bb32436eeacf

    • C:\Users\Public\vbc.exe
      Filesize

      217KB

      MD5

      3c6368b561ab649a24c56e83ddff04b9

      SHA1

      a318d03da411d02cea18f3cc50f3922a2f3f4c9a

      SHA256

      d0141a1ffd171ac766d2e964db91c7042d922ceea3ad4d46fbd77c5e9fb52274

      SHA512

      9a81a36758ba3d2c4107a53658a04809894e370d8824aae98c55c35edba0dfe8b55c46fefda58fe947d048f24cc5618ee5475ae58d1906646df7bb32436eeacf

    • \Users\Admin\AppData\Local\Temp\jzolhsxw.exe
      Filesize

      164KB

      MD5

      b7e125f8eeb6a22522a8ea9de90b0863

      SHA1

      f4520417cc50768cbbe7db5fa7dbc153c44c219f

      SHA256

      46a8abcfed3ac0235ae3ace2976235a9fb9ae00a1c6463efca0db9dd76b7d9e3

      SHA512

      ce697ee38b5ee465bb4720a1b822e2e1617e0b70bad2689197c7a0e70c44157088d4dae9f7657625ebcfa655c7aa0b01189f6f4097c7db8f05be0bdd11fffd1f

    • \Users\Admin\AppData\Local\Temp\jzolhsxw.exe
      Filesize

      164KB

      MD5

      b7e125f8eeb6a22522a8ea9de90b0863

      SHA1

      f4520417cc50768cbbe7db5fa7dbc153c44c219f

      SHA256

      46a8abcfed3ac0235ae3ace2976235a9fb9ae00a1c6463efca0db9dd76b7d9e3

      SHA512

      ce697ee38b5ee465bb4720a1b822e2e1617e0b70bad2689197c7a0e70c44157088d4dae9f7657625ebcfa655c7aa0b01189f6f4097c7db8f05be0bdd11fffd1f

    • \Users\Admin\AppData\Local\Temp\jzolhsxw.exe
      Filesize

      164KB

      MD5

      b7e125f8eeb6a22522a8ea9de90b0863

      SHA1

      f4520417cc50768cbbe7db5fa7dbc153c44c219f

      SHA256

      46a8abcfed3ac0235ae3ace2976235a9fb9ae00a1c6463efca0db9dd76b7d9e3

      SHA512

      ce697ee38b5ee465bb4720a1b822e2e1617e0b70bad2689197c7a0e70c44157088d4dae9f7657625ebcfa655c7aa0b01189f6f4097c7db8f05be0bdd11fffd1f

    • \Users\Public\vbc.exe
      Filesize

      217KB

      MD5

      3c6368b561ab649a24c56e83ddff04b9

      SHA1

      a318d03da411d02cea18f3cc50f3922a2f3f4c9a

      SHA256

      d0141a1ffd171ac766d2e964db91c7042d922ceea3ad4d46fbd77c5e9fb52274

      SHA512

      9a81a36758ba3d2c4107a53658a04809894e370d8824aae98c55c35edba0dfe8b55c46fefda58fe947d048f24cc5618ee5475ae58d1906646df7bb32436eeacf

    • memory/820-70-0x0000000000000000-mapping.dmp
    • memory/820-71-0x000007FEFBDE1000-0x000007FEFBDE3000-memory.dmp
      Filesize

      8KB

    • memory/988-57-0x0000000075021000-0x0000000075023000-memory.dmp
      Filesize

      8KB

    • memory/988-58-0x000000007119D000-0x00000000711A8000-memory.dmp
      Filesize

      44KB

    • memory/988-56-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/988-54-0x0000000072731000-0x0000000072734000-memory.dmp
      Filesize

      12KB

    • memory/988-55-0x00000000701B1000-0x00000000701B3000-memory.dmp
      Filesize

      8KB

    • memory/988-81-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/988-82-0x000000007119D000-0x00000000711A8000-memory.dmp
      Filesize

      44KB

    • memory/1320-76-0x00000000004139DE-mapping.dmp
    • memory/1320-79-0x0000000000400000-0x00000000004A2000-memory.dmp
      Filesize

      648KB

    • memory/1320-80-0x0000000000400000-0x00000000004A2000-memory.dmp
      Filesize

      648KB

    • memory/1384-61-0x0000000000000000-mapping.dmp
    • memory/1964-67-0x0000000000000000-mapping.dmp