Analysis

  • max time kernel
    121s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    20-09-2023 16:58

General

  • Target

    Purchase Order.rtf

  • Size

    82KB

  • MD5

    de8dccb1065c19531df50171d73ed6be

  • SHA1

    460332fa5c184a49e4d2a6012608a5b08004b4a8

  • SHA256

    e96b78b304d36170a18e1aaf50547133ddf8ab10925da128946136ce87e02cfc

  • SHA512

    33c7d634c3892b3288c77fb185d554316ec35e2510dd6cc240186f24edbaa166b77bcb130a51931a32552946522e995f3a7ad9974e6f3a31e889236fc509aef7

  • SSDEEP

    768:kwAbZSibMX9gRWjGwWgmbZWoUpEcU5igQc+B5Sr82lQXvuc4F:kwAlRr2EcaigQc+B5Sg6m4F

Malware Config

Extracted

Family

lokibot

C2

http://kelly.chinacarbonfiber.buzz/_errorpages/kelly/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Purchase Order.rtf"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1284
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2504
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:2664
      • C:\Users\Admin\AppData\Roaming\kellyebnf589678.exe
        "C:\Users\Admin\AppData\Roaming\kellyebnf589678.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2632
        • C:\Users\Admin\AppData\Roaming\kellyebnf589678.exe
          "C:\Users\Admin\AppData\Roaming\kellyebnf589678.exe"
          3⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious use of AdjustPrivilegeToken
          • outlook_office_path
          • outlook_win_path
          PID:1964

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Execution

    Exploitation for Client Execution

    1
    T1203

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Collection

    Data from Local System

    1
    T1005

    Email Collection

    1
    T1114

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3513876443-2771975297-1923446376-1000\0f5007522459c86e95ffcc62f32308f1_5016df78-a5e8-4bdc-97f8-57576812d32b
      Filesize

      46B

      MD5

      d898504a722bff1524134c6ab6a5eaa5

      SHA1

      e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

      SHA256

      878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

      SHA512

      26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3513876443-2771975297-1923446376-1000\0f5007522459c86e95ffcc62f32308f1_5016df78-a5e8-4bdc-97f8-57576812d32b
      Filesize

      46B

      MD5

      c07225d4e7d01d31042965f048728a0a

      SHA1

      69d70b340fd9f44c89adb9a2278df84faa9906b7

      SHA256

      8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

      SHA512

      23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      9633624bafacc39ab329a662dc503856

      SHA1

      f2f892b99922af3dbce93c535879183a0be18057

      SHA256

      f4aca15270d957512add4c739beb899010488106ce13d4136322b468dbce3e79

      SHA512

      1231a507bbfd86a10537aba0c50b4030ecfee7d04f4a2d0de599f49899c2963447105deac669736fb9fe1cc09cbfd39146d35bd864fa89ab5d37d4357964fd84

    • C:\Users\Admin\AppData\Roaming\kellyebnf589678.exe
      Filesize

      579KB

      MD5

      266a47606154ba4cb18ded2bd45268b7

      SHA1

      81de5a6019f45a1fdaab59ddd5e7ef24abb9d064

      SHA256

      49632e67b9bae4d091595818b037fb4d25678238bd069483ea3c5f299ea3487d

      SHA512

      94deb2a9788621f949cdae321cbfdc73dc3de61a5fa25cff137f8dc284bd9b89558ac3b8b753688dd550578229d469052d4e0363fe5ef92f919020072309c91d

    • C:\Users\Admin\AppData\Roaming\kellyebnf589678.exe
      Filesize

      579KB

      MD5

      266a47606154ba4cb18ded2bd45268b7

      SHA1

      81de5a6019f45a1fdaab59ddd5e7ef24abb9d064

      SHA256

      49632e67b9bae4d091595818b037fb4d25678238bd069483ea3c5f299ea3487d

      SHA512

      94deb2a9788621f949cdae321cbfdc73dc3de61a5fa25cff137f8dc284bd9b89558ac3b8b753688dd550578229d469052d4e0363fe5ef92f919020072309c91d

    • C:\Users\Admin\AppData\Roaming\kellyebnf589678.exe
      Filesize

      579KB

      MD5

      266a47606154ba4cb18ded2bd45268b7

      SHA1

      81de5a6019f45a1fdaab59ddd5e7ef24abb9d064

      SHA256

      49632e67b9bae4d091595818b037fb4d25678238bd069483ea3c5f299ea3487d

      SHA512

      94deb2a9788621f949cdae321cbfdc73dc3de61a5fa25cff137f8dc284bd9b89558ac3b8b753688dd550578229d469052d4e0363fe5ef92f919020072309c91d

    • C:\Users\Admin\AppData\Roaming\kellyebnf589678.exe
      Filesize

      579KB

      MD5

      266a47606154ba4cb18ded2bd45268b7

      SHA1

      81de5a6019f45a1fdaab59ddd5e7ef24abb9d064

      SHA256

      49632e67b9bae4d091595818b037fb4d25678238bd069483ea3c5f299ea3487d

      SHA512

      94deb2a9788621f949cdae321cbfdc73dc3de61a5fa25cff137f8dc284bd9b89558ac3b8b753688dd550578229d469052d4e0363fe5ef92f919020072309c91d

    • \Users\Admin\AppData\Roaming\kellyebnf589678.exe
      Filesize

      579KB

      MD5

      266a47606154ba4cb18ded2bd45268b7

      SHA1

      81de5a6019f45a1fdaab59ddd5e7ef24abb9d064

      SHA256

      49632e67b9bae4d091595818b037fb4d25678238bd069483ea3c5f299ea3487d

      SHA512

      94deb2a9788621f949cdae321cbfdc73dc3de61a5fa25cff137f8dc284bd9b89558ac3b8b753688dd550578229d469052d4e0363fe5ef92f919020072309c91d

    • memory/1284-1-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1284-2-0x00000000710AD000-0x00000000710B8000-memory.dmp
      Filesize

      44KB

    • memory/1284-81-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1284-23-0x00000000710AD000-0x00000000710B8000-memory.dmp
      Filesize

      44KB

    • memory/1284-0-0x000000002FBB1000-0x000000002FBB2000-memory.dmp
      Filesize

      4KB

    • memory/1284-82-0x00000000710AD000-0x00000000710B8000-memory.dmp
      Filesize

      44KB

    • memory/1964-31-0x0000000000400000-0x00000000004A2000-memory.dmp
      Filesize

      648KB

    • memory/1964-90-0x0000000000400000-0x00000000004A2000-memory.dmp
      Filesize

      648KB

    • memory/1964-46-0x0000000000400000-0x00000000004A2000-memory.dmp
      Filesize

      648KB

    • memory/1964-62-0x0000000000400000-0x00000000004A2000-memory.dmp
      Filesize

      648KB

    • memory/1964-30-0x0000000000400000-0x00000000004A2000-memory.dmp
      Filesize

      648KB

    • memory/1964-32-0x0000000000400000-0x00000000004A2000-memory.dmp
      Filesize

      648KB

    • memory/1964-33-0x0000000000400000-0x00000000004A2000-memory.dmp
      Filesize

      648KB

    • memory/1964-34-0x0000000000400000-0x00000000004A2000-memory.dmp
      Filesize

      648KB

    • memory/1964-36-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
      Filesize

      4KB

    • memory/1964-38-0x0000000000400000-0x00000000004A2000-memory.dmp
      Filesize

      648KB

    • memory/1964-42-0x0000000000400000-0x00000000004A2000-memory.dmp
      Filesize

      648KB

    • memory/2632-16-0x000000006B260000-0x000000006B94E000-memory.dmp
      Filesize

      6MB

    • memory/2632-41-0x000000006B260000-0x000000006B94E000-memory.dmp
      Filesize

      6MB

    • memory/2632-29-0x0000000001020000-0x000000000107A000-memory.dmp
      Filesize

      360KB

    • memory/2632-28-0x00000000004A0000-0x00000000004AC000-memory.dmp
      Filesize

      48KB

    • memory/2632-27-0x0000000000490000-0x0000000000498000-memory.dmp
      Filesize

      32KB

    • memory/2632-25-0x0000000004C70000-0x0000000004CB0000-memory.dmp
      Filesize

      256KB

    • memory/2632-24-0x000000006B260000-0x000000006B94E000-memory.dmp
      Filesize

      6MB

    • memory/2632-22-0x0000000000360000-0x0000000000372000-memory.dmp
      Filesize

      72KB

    • memory/2632-21-0x0000000004C70000-0x0000000004CB0000-memory.dmp
      Filesize

      256KB

    • memory/2632-15-0x0000000001200000-0x0000000001298000-memory.dmp
      Filesize

      608KB