Analysis
- max time kernel
144s - max time network
145s - platform
windows7_x64 - resource
win7-20240705-en - resource tags
- submitted
10/07/2024, 05:54
General
- Target Packing List,BL & Final Invoice.xls
- Size 367KB
- Sample240710-glv5fssdnh
- SHA256 dee188a1e94375c2ca0b7f82bb3f2d12ccfebd302fdf7ce1b21a15ca3c2e55d2
Malware Config
Extracted
-
lokibot
-
http://dashboardproducts.info/bally/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Blocklisted process makes network request 1 IoCs
- Downloads MZ/PE file
- Abuses OpenXML format to download file from external location 2 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Office loads VBA resources, possible macro or embedded object present
- Enumerates system info in registry 2 TTPs 1 IoCs
- Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Packing List,BL & Final Invoice.xls"1⤵
- Abuses OpenXML format to download file from external location
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" -Embedding1⤵
- Abuses OpenXML format to download file from external location
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\igcc.exe"C:\Users\Admin\AppData\Roaming\igcc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\igcc.exe"C:\Users\Admin\AppData\Roaming\igcc.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\igcc.exe"C:\Users\Admin\AppData\Roaming\igcc.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
FSD-{252B0510-E153-4C09-A835-17C540F3EF59}.FSD
FSD-CNRY.FSD
FSD-{114563D8-FF81-4E09-B294-02779FBE9CCA}.FSD
mk.mk.mk.mkmkmk[1].doc
{2829C0EE-DF5B-4C89-A3FA-438A92CA75F7}
0f5007522459c86e95ffcc62f32308f1_635445d0-2fc2-4150-8a92-100f79c7c9d7
0f5007522459c86e95ffcc62f32308f1_635445d0-2fc2-4150-8a92-100f79c7c9d7
igcc.exe
memory/1180-118-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/1180-119-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1180-140-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1180-108-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1180-110-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1180-114-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1180-121-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1180-116-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1180-112-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1788-101-0x0000000000040000-0x00000000000D8000-memory.dmp
memory/1788-102-0x00000000047B0000-0x0000000004852000-memory.dmp
memory/1788-106-0x0000000004CE0000-0x0000000004D42000-memory.dmp
memory/1788-104-0x00000000007A0000-0x00000000007A8000-memory.dmp
memory/1788-105-0x00000000007B0000-0x00000000007BE000-memory.dmp
memory/1788-103-0x0000000000370000-0x0000000000382000-memory.dmp
memory/2436-26-0x0000000002D60000-0x0000000002D62000-memory.dmp
memory/2436-0-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/2436-20-0x000000007228D000-0x0000000072298000-memory.dmp
memory/2436-1-0x000000007228D000-0x0000000072298000-memory.dmp
memory/2936-21-0x000000002FF71000-0x000000002FF72000-memory.dmp
memory/2936-23-0x000000007228D000-0x0000000072298000-memory.dmp
memory/2936-85-0x000000007228D000-0x0000000072298000-memory.dmp
memory/2936-25-0x0000000003810000-0x0000000003812000-memory.dmp