Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2025, 11:21
Behavioral task
behavioral1
Sample
Order.xls
Resource
win7-20240903-en
General
-
Target
Order.xls
-
Size
62KB
-
MD5
641cfd5a568fae40164ad2f493c6a6ce
-
SHA1
7aff16774ebcb88d3081bbe4b56c4237c30b89ae
-
SHA256
a9f6314789b922b612cf971c0e7dfcfa758b7f192827b1b6304e8e6c90029c22
-
SHA512
af9b5c26ed1b0368f8c3a78b4228c6433089f54201c1769d31075878cdc4d34901998771f524aa5609ac4d28bbe787f1dc11bba6b4919197859d503b17123f8a
-
SSDEEP
1536:j5555stZggEGeNDNlWqAnCnxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAs6/EmoBPGL:FnxEtjPOtioVjDGUU1qfDlaGGx+cL2Qe
Malware Config
Extracted
lokibot
http://46.183.222.162/bcxgfhgsf/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Downloads MZ/PE file 1 IoCs
flow pid Process 23 1500 EXCEL.EXE -
Executes dropped EXE 3 IoCs
pid Process 4468 HIMRP.exe 400 HIMRP.exe 1132 HIMRP.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook HIMRP.exe Key opened \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook HIMRP.exe Key opened \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook HIMRP.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4468 set thread context of 400 4468 HIMRP.exe 88 PID 4468 set thread context of 1132 4468 HIMRP.exe 89 -
Program crash 1 IoCs
pid pid_target Process procid_target 3508 1132 WerFault.exe 89 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HIMRP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HIMRP.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1500 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4468 HIMRP.exe Token: SeDebugPrivilege 400 HIMRP.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 1500 EXCEL.EXE 1500 EXCEL.EXE 1500 EXCEL.EXE 1500 EXCEL.EXE 1500 EXCEL.EXE 1500 EXCEL.EXE 1500 EXCEL.EXE 1500 EXCEL.EXE 1500 EXCEL.EXE 1500 EXCEL.EXE 1500 EXCEL.EXE 1500 EXCEL.EXE 1500 EXCEL.EXE 1500 EXCEL.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1500 wrote to memory of 4468 1500 EXCEL.EXE 86 PID 1500 wrote to memory of 4468 1500 EXCEL.EXE 86 PID 1500 wrote to memory of 4468 1500 EXCEL.EXE 86 PID 4468 wrote to memory of 400 4468 HIMRP.exe 88 PID 4468 wrote to memory of 400 4468 HIMRP.exe 88 PID 4468 wrote to memory of 400 4468 HIMRP.exe 88 PID 4468 wrote to memory of 400 4468 HIMRP.exe 88 PID 4468 wrote to memory of 400 4468 HIMRP.exe 88 PID 4468 wrote to memory of 400 4468 HIMRP.exe 88 PID 4468 wrote to memory of 400 4468 HIMRP.exe 88 PID 4468 wrote to memory of 400 4468 HIMRP.exe 88 PID 4468 wrote to memory of 400 4468 HIMRP.exe 88 PID 4468 wrote to memory of 1132 4468 HIMRP.exe 89 PID 4468 wrote to memory of 1132 4468 HIMRP.exe 89 PID 4468 wrote to memory of 1132 4468 HIMRP.exe 89 PID 4468 wrote to memory of 1132 4468 HIMRP.exe 89 PID 4468 wrote to memory of 1132 4468 HIMRP.exe 89 PID 4468 wrote to memory of 1132 4468 HIMRP.exe 89 PID 4468 wrote to memory of 1132 4468 HIMRP.exe 89 PID 4468 wrote to memory of 1132 4468 HIMRP.exe 89 PID 4468 wrote to memory of 1132 4468 HIMRP.exe 89 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook HIMRP.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook HIMRP.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Order.xls"1⤵
- Downloads MZ/PE file
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\HIMRP.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\HIMRP.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\HIMRP.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\HIMRP.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:400
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\HIMRP.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\HIMRP.exe"3⤵
- Executes dropped EXE
PID:1132 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 804⤵
- Program crash
PID:3508
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1132 -ip 11321⤵PID:2260
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4050598569-1597076380-177084960-1000\0f5007522459c86e95ffcc62f32308f1_cca0d105-8260-4611-8c12-bd85a7208b9f
Filesize46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4050598569-1597076380-177084960-1000\0f5007522459c86e95ffcc62f32308f1_cca0d105-8260-4611-8c12-bd85a7208b9f
Filesize46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
Filesize
267KB
MD5524d8e883108dec6d7ce2f96fdd8985d
SHA1931af8ea63d58a25f34e14a9ac8aa80d33949eeb
SHA256e70b780a4e98503745b72ba33f45812c75d27d88bbeb58ce4feba484c016e14e
SHA512a1bff8235da4964f571068ce9581e9e12a466ad714729d21d80aac24e29f2e0cc510ddb2f6717ee8a07a0cbd4f8ad646ab25b7f5b409d0badc9b041536c8a595
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD5664566d172c8817761db98e8f74164b0
SHA13554f235226eea85198dd482be4d890f7caaee15
SHA25603e178a70533ca0b160b5f3f29cb57492e0de6cadd873de9de1c26868f5b33b3
SHA5120f2c7a2f2a9a8cb79e6a3f8d9863dc17ec7cb9250c0a57559b9c7b1c8cbb926e5c50a27ed00293873f3c4247fa15ab376c405b33b9c83764f6f964700fb8f7c3