Analysis

  • max time kernel
    104s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    12/05/2023, 01:11

General

  • Target

    96935f118fdeae482ef56256b22acf86.rtf

  • Size

    27KB

  • MD5

    96935f118fdeae482ef56256b22acf86

  • SHA1

    326ee56fe73a4257aea97bb58a1b1bc38cbf43f9

  • SHA256

    5d6fbafbed3befc57c4ce0889e1d381e98fba1f084b6fe169b6d692420854210

  • SHA512

    1c471044598efa457f3448a1765ead8fe5e1284872c985eddcd0caf632b8c2f74abd480a08a37c4b4e87623c43f223ebf653cddcb8c4559725d8266bd2dc6603

  • SSDEEP

    768:/e4fY4IkeG7nRDxfUgbSik3p9gDuN3l9CS66r2OYPOhv4/G7CA8j7XBAcJKW:/LwKpN1Uak3BlkS66r2VOhIU8+Al

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.164/mancho/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\96935f118fdeae482ef56256b22acf86.rtf"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:924
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:1484
      • C:\Users\Public\vbc.exe
        "C:\Users\Public\vbc.exe"
        2⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:1504

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      14066d58ca784cfc5e675dc0fd69c5c2

      SHA1

      deac088d2c53a002fb82cc44f82c0de17fb1fb73

      SHA256

      e4d4a824b9894b437f5c14e740553baaae164b5f385a0204cd93ecfeab68891b

      SHA512

      2ba4590daf023fbfaa7405de9b9595de8fecd1364e8334a91417f0ce3b3a09025712fd72e090f3f53333a9c80b0fff2cf73460c807596511ec46369faf254208

    • C:\Users\Public\vbc.exe

      Filesize

      327KB

      MD5

      44bd0753b6efa39826e713e4c6bc9353

      SHA1

      5e55d9175c6cbe8cd8e16b1550ad44ba68d2ca55

      SHA256

      59670b71664cf6f6124a0035a8496daebef5027522a0d0efb37aa52fb09a65cc

      SHA512

      b0070e41ccec455f6149747be995f5497311dc372229a5ab6b724183ba9a9606cef952b43f04dc13f21e6b2f54fd6a8cc992ea9648eb9b0b719bbc120e40c533

    • C:\Users\Public\vbc.exe

      Filesize

      327KB

      MD5

      44bd0753b6efa39826e713e4c6bc9353

      SHA1

      5e55d9175c6cbe8cd8e16b1550ad44ba68d2ca55

      SHA256

      59670b71664cf6f6124a0035a8496daebef5027522a0d0efb37aa52fb09a65cc

      SHA512

      b0070e41ccec455f6149747be995f5497311dc372229a5ab6b724183ba9a9606cef952b43f04dc13f21e6b2f54fd6a8cc992ea9648eb9b0b719bbc120e40c533

    • C:\Users\Public\vbc.exe

      Filesize

      327KB

      MD5

      44bd0753b6efa39826e713e4c6bc9353

      SHA1

      5e55d9175c6cbe8cd8e16b1550ad44ba68d2ca55

      SHA256

      59670b71664cf6f6124a0035a8496daebef5027522a0d0efb37aa52fb09a65cc

      SHA512

      b0070e41ccec455f6149747be995f5497311dc372229a5ab6b724183ba9a9606cef952b43f04dc13f21e6b2f54fd6a8cc992ea9648eb9b0b719bbc120e40c533

    • \Users\Public\vbc.exe

      Filesize

      327KB

      MD5

      44bd0753b6efa39826e713e4c6bc9353

      SHA1

      5e55d9175c6cbe8cd8e16b1550ad44ba68d2ca55

      SHA256

      59670b71664cf6f6124a0035a8496daebef5027522a0d0efb37aa52fb09a65cc

      SHA512

      b0070e41ccec455f6149747be995f5497311dc372229a5ab6b724183ba9a9606cef952b43f04dc13f21e6b2f54fd6a8cc992ea9648eb9b0b719bbc120e40c533

    • \Users\Public\vbc.exe

      Filesize

      327KB

      MD5

      44bd0753b6efa39826e713e4c6bc9353

      SHA1

      5e55d9175c6cbe8cd8e16b1550ad44ba68d2ca55

      SHA256

      59670b71664cf6f6124a0035a8496daebef5027522a0d0efb37aa52fb09a65cc

      SHA512

      b0070e41ccec455f6149747be995f5497311dc372229a5ab6b724183ba9a9606cef952b43f04dc13f21e6b2f54fd6a8cc992ea9648eb9b0b719bbc120e40c533

    • \Users\Public\vbc.exe

      Filesize

      327KB

      MD5

      44bd0753b6efa39826e713e4c6bc9353

      SHA1

      5e55d9175c6cbe8cd8e16b1550ad44ba68d2ca55

      SHA256

      59670b71664cf6f6124a0035a8496daebef5027522a0d0efb37aa52fb09a65cc

      SHA512

      b0070e41ccec455f6149747be995f5497311dc372229a5ab6b724183ba9a9606cef952b43f04dc13f21e6b2f54fd6a8cc992ea9648eb9b0b719bbc120e40c533

    • \Users\Public\vbc.exe

      Filesize

      327KB

      MD5

      44bd0753b6efa39826e713e4c6bc9353

      SHA1

      5e55d9175c6cbe8cd8e16b1550ad44ba68d2ca55

      SHA256

      59670b71664cf6f6124a0035a8496daebef5027522a0d0efb37aa52fb09a65cc

      SHA512

      b0070e41ccec455f6149747be995f5497311dc372229a5ab6b724183ba9a9606cef952b43f04dc13f21e6b2f54fd6a8cc992ea9648eb9b0b719bbc120e40c533

    • memory/1504-81-0x00000000001B0000-0x00000000001CB000-memory.dmp

      Filesize

      108KB

    • memory/1504-84-0x0000000000400000-0x00000000006CF000-memory.dmp

      Filesize

      2.8MB

    • memory/1504-87-0x0000000000400000-0x00000000006CF000-memory.dmp

      Filesize

      2.8MB

    • memory/2020-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2020-108-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB