Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2025, 11:55
Behavioral task
behavioral1
Sample
Purchase_Order.xls
Resource
win7-20240903-en
General
-
Target
Purchase_Order.xls
-
Size
62KB
-
MD5
69706b59e0a9a130bc805feea9a012a8
-
SHA1
412c5e987a7daa26587c57153832343e7e5dea19
-
SHA256
614e337e02f5cdedb1408523051dc458cc2faa2a5557808d4116bfb39616bce6
-
SHA512
fab78de8d85fd560ed7f87f2843581c15713cb6a4bbe83cd5bef3ac83ac7a8664439e4a6f5b7f1ef5be4936dd6d083c249f3c3d8599b070d9bf8eefab31dfc98
-
SSDEEP
1536:tnxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAq6/EmoPR+Dz:tnxEtjPOtioVjDGUU1qfDlaGGx+cL2QX
Malware Config
Extracted
lokibot
http://85.31.47.84:5336/adsafref/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Downloads MZ/PE file 1 IoCs
flow pid Process 23 3536 EXCEL.EXE -
Executes dropped EXE 3 IoCs
pid Process 3112 EXXLQW.exe 2380 EXXLQW.exe 3132 EXXLQW.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook EXXLQW.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook EXXLQW.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook EXXLQW.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3112 set thread context of 2380 3112 EXXLQW.exe 91 PID 3112 set thread context of 3132 3112 EXXLQW.exe 92 -
Program crash 1 IoCs
pid pid_target Process procid_target 1140 2380 WerFault.exe 91 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXXLQW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXXLQW.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3536 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3112 EXXLQW.exe Token: SeDebugPrivilege 3132 EXXLQW.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3536 EXCEL.EXE 3536 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 3536 EXCEL.EXE 3536 EXCEL.EXE 3536 EXCEL.EXE 3536 EXCEL.EXE 3536 EXCEL.EXE 3536 EXCEL.EXE 3536 EXCEL.EXE 3536 EXCEL.EXE 3536 EXCEL.EXE 3536 EXCEL.EXE 3536 EXCEL.EXE 3536 EXCEL.EXE 3536 EXCEL.EXE 3536 EXCEL.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3536 wrote to memory of 3112 3536 EXCEL.EXE 88 PID 3536 wrote to memory of 3112 3536 EXCEL.EXE 88 PID 3536 wrote to memory of 3112 3536 EXCEL.EXE 88 PID 3112 wrote to memory of 2380 3112 EXXLQW.exe 91 PID 3112 wrote to memory of 2380 3112 EXXLQW.exe 91 PID 3112 wrote to memory of 2380 3112 EXXLQW.exe 91 PID 3112 wrote to memory of 2380 3112 EXXLQW.exe 91 PID 3112 wrote to memory of 2380 3112 EXXLQW.exe 91 PID 3112 wrote to memory of 2380 3112 EXXLQW.exe 91 PID 3112 wrote to memory of 2380 3112 EXXLQW.exe 91 PID 3112 wrote to memory of 2380 3112 EXXLQW.exe 91 PID 3112 wrote to memory of 2380 3112 EXXLQW.exe 91 PID 3112 wrote to memory of 3132 3112 EXXLQW.exe 92 PID 3112 wrote to memory of 3132 3112 EXXLQW.exe 92 PID 3112 wrote to memory of 3132 3112 EXXLQW.exe 92 PID 3112 wrote to memory of 3132 3112 EXXLQW.exe 92 PID 3112 wrote to memory of 3132 3112 EXXLQW.exe 92 PID 3112 wrote to memory of 3132 3112 EXXLQW.exe 92 PID 3112 wrote to memory of 3132 3112 EXXLQW.exe 92 PID 3112 wrote to memory of 3132 3112 EXXLQW.exe 92 PID 3112 wrote to memory of 3132 3112 EXXLQW.exe 92 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook EXXLQW.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook EXXLQW.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Purchase_Order.xls"1⤵
- Downloads MZ/PE file
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\EXXLQW.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\EXXLQW.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\EXXLQW.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\EXXLQW.exe"3⤵
- Executes dropped EXE
PID:2380 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 804⤵
- Program crash
PID:1140
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\EXXLQW.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\EXXLQW.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3132
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2380 -ip 23801⤵PID:3824
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3350944739-639801879-157714471-1000\0f5007522459c86e95ffcc62f32308f1_dd2803c7-d377-4f06-bdfe-aea230fc7b0e
Filesize46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3350944739-639801879-157714471-1000\0f5007522459c86e95ffcc62f32308f1_dd2803c7-d377-4f06-bdfe-aea230fc7b0e
Filesize46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
-
Filesize
306KB
MD573f90e1f101dd65da64b3f51d5c73c79
SHA1998e9def1a207bbb72353b537daba688d7c6862c
SHA25682dc89757479317dcf084448dd8411b1503442fbcb30589d0f3dbd97d5762c59
SHA512ef909586df9d3ebac48333a34eb6f231ec7faa88bab3befdc037f8d0bb1b2bb32b0b2f2efbe0ac97bbdd85bfdfcfa6dc32f027f6e458cc8d17733168ae17642e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD5d1e16790964f87fd82a1efc262b4ae73
SHA1a1c9f9610405dcaf112ebd4576a64093af24766f
SHA256dd3f400ba1565c34b6a509188dde948194e9ceefc717f0b4a6c7037451f4ca01
SHA512e220315832715601a4ec90056c499572eeb714270cb8250ced1442276d65afe7f4d9c633980ae010d38cbf97bc5eacf933d39f7e2198a8cab51d9722e60bd832