analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

$3,845.50USD.doc

Full analysis: https://app.any.run/tasks/43e38f6f-7db5-4b9a-8b13-33fc0e085269
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 11, 2019, 11:37:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
generated-doc
loader
trojan
lokibot
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, unknown character set
MD5:

43B8FA38667E2391A6CD0C851B5D3B35

SHA1:

BA69300E1609AC333EDACCC432A63BC6BEEF68D7

SHA256:

35224E60DD768E7FAC4CC96715715BE814034451AD2E4F042EC6367D19DEF102

SSDEEP:

1536:qdChsDT2A3XFlIWvPehA+fhBLgr+pnmBOQhUAGx3z3adX/Kzmoy+3xcy8OJgU6qE:qd3DTgL7nhX4DTfQ7nxXJ4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • ktfcerh.exe (PID: 3740)
      • ktfcerh.exe (PID: 3980)
      • ktfcerh.exe (PID: 3936)
      • ktfcerh.exe (PID: 3440)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 2480)
      • EXCEL.EXE (PID: 3840)

    • Requests a remote executable file from MS Office

      • EXCEL.EXE (PID: 2480)
      • EXCEL.EXE (PID: 3840)

    • Executable content was dropped or overwritten

      • EXCEL.EXE (PID: 3840)

    • LOKIBOT was detected

      • ktfcerh.exe (PID: 3936)

    • Detected artifacts of LokiBot

      • ktfcerh.exe (PID: 3936)

    • Connects to CnC server

      • ktfcerh.exe (PID: 3936)

    • Actions looks like stealing of personal data

      • ktfcerh.exe (PID: 3936)

  • SUSPICIOUS

    • Unusual connect from Microsoft Office

      • EXCEL.EXE (PID: 2480)
      • EXCEL.EXE (PID: 3840)

    • Application launched itself

      • ktfcerh.exe (PID: 3980)
      • ktfcerh.exe (PID: 3740)

    • Loads DLL from Mozilla Firefox

      • ktfcerh.exe (PID: 3936)

    • Creates files in the user directory

      • ktfcerh.exe (PID: 3936)

    • Executable content was dropped or overwritten

      • ktfcerh.exe (PID: 3936)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2984)
      • EXCEL.EXE (PID: 3840)
      • excelcnv.exe (PID: 2304)
      • EXCEL.EXE (PID: 2480)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)

EXIF

RTF

InternalVersionNumber: 57433
CharactersWithSpaces: 52
Characters: 46
Words: 7
Pages: 1
TotalEditTime: -
RevisionNumber: 1
ModifyDate: 2019:02:11 00:48:00
CreateDate: 2019:02:11 00:48:00
LastModifiedBy: PC
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
8
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start winword.exe no specs excel.exe ktfcerh.exe no specs excel.exe ktfcerh.exe no specs excelcnv.exe no specs #LOKIBOT ktfcerh.exe ktfcerh.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2984"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Roaming\$3,845.50USD.doc.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3840"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -EmbeddingC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
3980"C:\Users\admin\AppData\Local\Temp\ktfcerh.exe" C:\Users\admin\AppData\Local\Temp\ktfcerh.exe—EXCEL.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2480"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -EmbeddingC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
3740"C:\Users\admin\AppData\Local\Temp\ktfcerh.exe" C:\Users\admin\AppData\Local\Temp\ktfcerh.exe—EXCEL.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2304"C:\Program Files\Microsoft Office\Office14\excelcnv.exe" -EmbeddingC:\Program Files\Microsoft Office\Office14\excelcnv.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
3936"C:\Users\admin\AppData\Local\Temp\ktfcerh.exe" C:\Users\admin\AppData\Local\Temp\ktfcerh.exe
ktfcerh.exe
User:
admin
Integrity Level:
MEDIUM
3440"C:\Users\admin\AppData\Local\Temp\ktfcerh.exe" C:\Users\admin\AppData\Local\Temp\ktfcerh.exe—ktfcerh.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Total events
2 729
Read events
2 058
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
0
Text files
3
Unknown types
7

Dropped files

PID
Process
Filename
Type
2984WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR8999.tmp.cvr —
MD5:—
SHA256:—
3840EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR9408.tmp.cvr —
MD5:—
SHA256:—
2480EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRA06C.tmp.cvr —
MD5:—
SHA256:—
2304excelcnv.exeC:\Users\admin\AppData\Local\Temp\CVRA7DF.tmp.cvr —
MD5:—
SHA256:—
2304excelcnv.exeC:\Users\admin\AppData\Local\Temp\~DF122CEF19F6B8DC4B.TMP —
MD5:—
SHA256:—
2984WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DF5646F3FF882D37C3.TMP —
MD5:—
SHA256:—
2304excelcnv.exeC:\Users\admin\AppData\Local\Temp\~DF651C46FB6BC7A8DA.TMP —
MD5:—
SHA256:—
2984WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DF23745CFF6783A1D6.TMP —
MD5:—
SHA256:—
3936ktfcerh.exeC:\Users\admin\AppData\Roaming\F63AAA\A71D80.lck —
MD5:—
SHA256:—
2984WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:1797F0CF7021338C5E99B34FA54B0FCB
SHA256:AABDE02253956BB0D884EE1ECD6C082E0F9822C265745AF2E64D01BA1C331747
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
5
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3840
EXCEL.EXE
GET
200
94.73.146.167:80
http://vektorex.com/source/Z/1009773.exe
TR
executable
1.57 Mb
malicious
2480
EXCEL.EXE
GET
304
94.73.146.167:80
http://vektorex.com/source/Z/1009773.exe
TR
—
—
malicious
3936
ktfcerh.exe
POST
—
185.195.236.146:80
http://avebx.cf/sl5kone/cat.php
AT
—
—
malicious
3936
ktfcerh.exe
POST
—
185.195.236.146:80
http://avebx.cf/sl5kone/cat.php
AT
—
—
malicious
3936
ktfcerh.exe
POST
—
185.195.236.146:80
http://avebx.cf/sl5kone/cat.php
AT
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3936
ktfcerh.exe
185.195.236.146:80
avebx.cf
Cristi Scumpu
AT
malicious
3840
EXCEL.EXE
94.73.146.167:80
vektorex.com
Cizgi Telekomunikasyon Anonim Sirketi
TR
malicious
2480
EXCEL.EXE
94.73.146.167:80
vektorex.com
Cizgi Telekomunikasyon Anonim Sirketi
TR
malicious

DNS requests

Domain
IP
Reputation
vektorex.com
  • 94.73.146.167
unknown
avebx.cf
  • 185.195.236.146
malicious

Threats

PID
Process
Class
Message
3840
EXCEL.EXE
A Network Trojan was detected
ET CURRENT_EVENTS Possible Malicious Macro DL EXE Feb 2016
3840
EXCEL.EXE
A Network Trojan was detected
ET CURRENT_EVENTS Possible Malicious Macro EXE DL AlphaNumL
3840
EXCEL.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2480
EXCEL.EXE
A Network Trojan was detected
ET CURRENT_EVENTS Possible Malicious Macro DL EXE Feb 2016
2480
EXCEL.EXE
A Network Trojan was detected
ET CURRENT_EVENTS Possible Malicious Macro EXE DL AlphaNumL
—
—
Potentially Bad Traffic
ET INFO DNS Query for Suspicious .cf Domain
3936
ktfcerh.exe
A Network Trojan was detected
ET TROJAN LokiBot User-Agent (Charon/Inferno)
3936
ktfcerh.exe
A Network Trojan was detected
ET TROJAN LokiBot Checkin
3936
ktfcerh.exe
Potentially Bad Traffic
ET INFO HTTP POST Request to Suspicious *.cf Domain
3936
ktfcerh.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
$3,845.50USD.doc