Analysis

  • max time kernel
    144s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11/03/2024, 21:30

General

  • Target

    Arrival Notice.xls

  • Size

    317KB

  • MD5

    e5d7a2dd2aafaa4e55c303c3533a36be

  • SHA1

    2e7dae389a400eb1e4e49fda39d9b4a282d735cb

  • SHA256

    008653065299f1e96ecd195fe23948cc3976210bc8d58ba0e1456db17270154d

  • SHA512

    0809255b680d8b7192ea4b79c616243a2d0d6b3a9a9defd05c9292effc68ed2242c7850ba6a81a0233c53908b70b6eefd9d9c590f011f83b7a622d8929446b90

  • SSDEEP

    6144:LuunJJ7wY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVEGMIL0pDt//yVQt/NDH:LvJJ7t3bVEGMIIN/rt/BJZHe64TGF3G

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/b17/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Abuses OpenXML format to download file from external location
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Arrival Notice.xls"
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2748
  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2868
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:3064
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:2760
      • C:\Users\Admin\AppData\Roaming\CNN.exe
        "C:\Users\Admin\AppData\Roaming\CNN.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:280
        • C:\Users\Admin\AppData\Roaming\CNN.exe
          "C:\Users\Admin\AppData\Roaming\CNN.exe"
          3⤵
          • Executes dropped EXE
          PID:892
        • C:\Users\Admin\AppData\Roaming\CNN.exe
          "C:\Users\Admin\AppData\Roaming\CNN.exe"
          3⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious use of AdjustPrivilegeToken
          • outlook_office_path
          • outlook_win_path
          PID:1780

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD

            Filesize

            128KB

            MD5

            e512b4d3769fea3e824ec6f1ea6c2213

            SHA1

            c96bbc9750eebd19ac7683dee7fea3e6ee939ae5

            SHA256

            50fa34a1075ef9b1b64b4c1a9fd218bce78ee8501fd9d13a1888795ae3be41f3

            SHA512

            93d997d7daa627511eb316bb5b37e1ed5d877effc5d33d39795ff4cad056a05e34c67b87999162512e62fe2ab174482008aced0937c61982614c16091d5ed4af

          • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD

            Filesize

            128KB

            MD5

            101efba6e7d4bff89ea9bcb820e80f8c

            SHA1

            60a65e64d531017e74fa75dcdc360ddbd07092a8

            SHA256

            44ea075161b0d061164d95acbe8a83f47c808b58e9072cb1360328c4c8c72911

            SHA512

            82f0abe74df9a7f5d86c219c46763eac3dff052870559d6c386fac8c286349f49294c8a5b1a601a72e34f91531a4bed716a08bab69bd7a5340660fabb4079f71

          • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{E71CAF4B-88F9-4DE5-9EC1-59D315A8088B}.FSD

            Filesize

            128KB

            MD5

            9be1c750db1771cda4925c210786818c

            SHA1

            deaefae9fde44e648a1364c896a74cc4b00110c1

            SHA256

            267089e378ec759f676ea113b14c038ae3eacddf90b655f25dee896e115e40ed

            SHA512

            6c2d728430d3f111fd850d8b8f1355e0a541d9a5450a3574fe67236bc814c9dcf24824de80a00ae91fb9f9b080146b1666225bc3b842a832451cb25c2d0be212

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNQNAXHS\dnamatchedlovesuccessfullycompletedwithanotherlovertouderstandhowshebelievedonmeand___lovedmealotwithlotoflove[1].doc

            Filesize

            68KB

            MD5

            6f915ad0fda4f220768467e5246b1954

            SHA1

            c3d6c3c80ee8445eda839bc3a3e025198d239985

            SHA256

            b5d0c3287bff511f44ccdb36cbee7d5a6d9ae3de5cb809a9d378df18ae52865b

            SHA512

            7489bb6419afc780a27d16c33b3a52d642d3ec809dfc871068cb29df7eda3006c87d0cff1f7d563e0ffd4dd1667f130670746fa15be8b29ad13b1b303f484519

          • C:\Users\Admin\AppData\Local\Temp\{A0E684AA-FE5F-47FC-B074-316FEB1E175A}

            Filesize

            128KB

            MD5

            b68817b3c7a63377370999f9f28c704c

            SHA1

            7ad0e7636270a55421987fbc24e18bb370bb1cb4

            SHA256

            f3f7253415f1774aafd11276ac978c38962e1a405996ef3cc40e9ec1b308b201

            SHA512

            1e6aefcbb918e8e3443991cc868459aa34ea1bead9b3755b6e0312b3052fed1cea9ee275acbd96c17d7907a206974edff56343ce5692f4c0ca12b1a681a49dd6

          • C:\Users\Admin\AppData\Roaming\CNN.exe

            Filesize

            533KB

            MD5

            776caeb561e8838e4561862e2c78cee7

            SHA1

            d691d21e71886d90f660396f056276737a7a50df

            SHA256

            3b5f508d2c80a9e4b17cd492a18ad4f535b5a24d6cc6efe9551c947ddc79fef9

            SHA512

            be36533677bd56ea2ba895daa81df663aa868f3ef5f1863014ae8dcd3c76817709a0cf32ea2a05c0c81c18f77a734c707fb5f5f8b47837d564bbec26555b96d4

          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1650401615-1019878084-3673944445-1000\0f5007522459c86e95ffcc62f32308f1_43e6e718-24fe-4167-ac4b-2355fb5d6031

            Filesize

            46B

            MD5

            d898504a722bff1524134c6ab6a5eaa5

            SHA1

            e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

            SHA256

            878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

            SHA512

            26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1650401615-1019878084-3673944445-1000\0f5007522459c86e95ffcc62f32308f1_43e6e718-24fe-4167-ac4b-2355fb5d6031

            Filesize

            46B

            MD5

            c07225d4e7d01d31042965f048728a0a

            SHA1

            69d70b340fd9f44c89adb9a2278df84faa9906b7

            SHA256

            8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

            SHA512

            23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

          • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

            Filesize

            20KB

            MD5

            9cad87922781d155e02a076abca27292

            SHA1

            64862796d9330899ba394717ded344cc2bc42508

            SHA256

            240c910fbde36f4859969b634c9f1a4fefa09f00f62a82b65602278279873cee

            SHA512

            5d701e9246813bbf3685e0bcba984852ef8650ca4b3ccbf38e43db26f4c219f2e541bfe160577f3ba42301e62bf0244430a4b94949bc75ef13308c1dabe3e02e

          • memory/280-108-0x00000000005E0000-0x00000000005EA000-memory.dmp

            Filesize

            40KB

          • memory/280-107-0x0000000000480000-0x0000000000494000-memory.dmp

            Filesize

            80KB

          • memory/280-124-0x000000006A8E0000-0x000000006AFCE000-memory.dmp

            Filesize

            6.9MB

          • memory/280-110-0x00000000007E0000-0x0000000000842000-memory.dmp

            Filesize

            392KB

          • memory/280-109-0x0000000000730000-0x000000000073E000-memory.dmp

            Filesize

            56KB

          • memory/280-103-0x0000000000320000-0x00000000003AA000-memory.dmp

            Filesize

            552KB

          • memory/280-104-0x000000006A8E0000-0x000000006AFCE000-memory.dmp

            Filesize

            6.9MB

          • memory/280-106-0x0000000004D10000-0x0000000004D50000-memory.dmp

            Filesize

            256KB

          • memory/1780-112-0x0000000000400000-0x00000000004A2000-memory.dmp

            Filesize

            648KB

          • memory/1780-128-0x0000000000400000-0x00000000004A2000-memory.dmp

            Filesize

            648KB

          • memory/1780-123-0x0000000000400000-0x00000000004A2000-memory.dmp

            Filesize

            648KB

          • memory/1780-120-0x0000000000400000-0x00000000004A2000-memory.dmp

            Filesize

            648KB

          • memory/1780-113-0x0000000000400000-0x00000000004A2000-memory.dmp

            Filesize

            648KB

          • memory/1780-118-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

          • memory/1780-114-0x0000000000400000-0x00000000004A2000-memory.dmp

            Filesize

            648KB

          • memory/1780-115-0x0000000000400000-0x00000000004A2000-memory.dmp

            Filesize

            648KB

          • memory/1780-116-0x0000000000400000-0x00000000004A2000-memory.dmp

            Filesize

            648KB

          • memory/2748-10-0x0000000002DD0000-0x0000000002DD2000-memory.dmp

            Filesize

            8KB

          • memory/2748-79-0x000000007233D000-0x0000000072348000-memory.dmp

            Filesize

            44KB

          • memory/2748-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

          • memory/2748-1-0x000000007233D000-0x0000000072348000-memory.dmp

            Filesize

            44KB

          • memory/2868-80-0x000000007233D000-0x0000000072348000-memory.dmp

            Filesize

            44KB

          • memory/2868-9-0x0000000003710000-0x0000000003712000-memory.dmp

            Filesize

            8KB

          • memory/2868-7-0x000000007233D000-0x0000000072348000-memory.dmp

            Filesize

            44KB

          • memory/2868-5-0x000000002FB81000-0x000000002FB82000-memory.dmp

            Filesize

            4KB

          • memory/2868-188-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

          • memory/2868-189-0x000000007233D000-0x0000000072348000-memory.dmp

            Filesize

            44KB