File name: | New Enquiry.docx |
Full analysis: | https://app.any.run/tasks/689f5ef6-7061-4c1a-a29d-b615fb36b37b |
Verdict: | Malicious activity |
Threats: | LokiBot was developed in 2015 to steal information from a variety of applications. Despite the age, this malware is still rather popular among cybercriminals. |
Analysis date: | June 12, 2019, 06:50:42 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.openxmlformats-officedocument.wordprocessingml.document |
File info: | Microsoft Word 2007+ |
MD5: | EF3BE8D86E96620B0FE39F4A0E4E7F64 |
SHA1: | 2E90292BB30DE87419BBF18012A5CE88F3EFB30A |
SHA256: | 584873611703C6C548D906A9F9DD639B3B18EFA93DF3A89EED886FEF1A6B9FB5 |
SSDEEP: | 192:Cyi1UjyMtWNCO0mqQTnhr5O4QT1QzP55ejbFTB8GoA6awkW9mZx:CyiWjyMtiCgLO4QT1QzDe9ds7mL |
.docx | | | Word Microsoft Office Open XML Format document (52.2) |
---|---|---|
.zip | | | Open Packaging Conventions container (38.8) |
.zip | | | ZIP compressed archive (8.8) |
Creator: | Microsoft |
---|
ModifyDate: | 2017:09:24 17:27:00Z |
---|---|
CreateDate: | 2017:09:24 17:26:00Z |
RevisionNumber: | 1 |
LastModifiedBy: | Microsoft |
AppVersion: | 14 |
HyperlinksChanged: | No |
SharedDoc: | No |
CharactersWithSpaces: | 7 |
LinksUpToDate: | No |
Company: | SPecialiST RePack |
TitlesOfParts: | - |
HeadingPairs: |
|
ScaleCrop: | No |
Paragraphs: | 1 |
Lines: | 1 |
DocSecurity: | None |
Application: | Microsoft Office Word |
Characters: | 7 |
Words: | 1 |
Pages: | 1 |
TotalEditTime: | 1 minute |
Template: | dotm.dotm |
ZipFileName: | [Content_Types].xml |
---|---|
ZipUncompressedSize: | 1422 |
ZipCompressedSize: | 358 |
ZipCRC: | 0x82872409 |
ZipModifyDate: | 2019:06:12 03:18:16 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0002 |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2444 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\New Enquiry.docx" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
1820 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
2480 | "C:\Users\admin\AppData\Roaming\roc.exe" | C:\Users\admin\AppData\Roaming\roc.exe | EQNEDT32.EXE | |
User: admin Company: electropoion Integrity Level: MEDIUM Description: unclannishly Exit code: 0 Version: 1.4.2.6 | ||||
2148 | "C:\Users\admin\AppData\Roaming\roc.exe" | C:\Users\admin\AppData\Roaming\roc.exe | roc.exe | |
User: admin Company: electropoion Integrity Level: MEDIUM Description: unclannishly Version: 1.4.2.6 |
(PID) Process: | (2444) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | write | Name: | 2* |
Value: 322A20008C090000010000000000000000000000 | |||
(PID) Process: | (2444) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: Off | |||
(PID) Process: | (2444) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: On | |||
(PID) Process: | (2444) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
Operation: | write | Name: | WORDFiles |
Value: 1321992222 | |||
(PID) Process: | (2444) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
Operation: | write | Name: | ProductFiles |
Value: 1321992336 | |||
(PID) Process: | (2444) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
Operation: | write | Name: | ProductFiles |
Value: 1321992337 | |||
(PID) Process: | (2444) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word |
Operation: | write | Name: | MTTT |
Value: 8C09000014131135EB20D50100000000 | |||
(PID) Process: | (2444) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | write | Name: | f, |
Value: 662C20008C09000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
(PID) Process: | (2444) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | delete value | Name: | f, |
Value: 662C20008C09000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
(PID) Process: | (2444) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2444 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVREEB2.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2444 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\{DF76F30A-65E7-4C46-9456-15CE8308C287} | — | |
MD5:— | SHA256:— | |||
2444 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\{2FE3AA0E-2FF9-415F-AA6D-A1D3698418F5} | — | |
MD5:— | SHA256:— | |||
2444 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9A37B194.doc | — | |
MD5:— | SHA256:— | |||
2444 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F70ED0C2.doc | — | |
MD5:— | SHA256:— | |||
2148 | roc.exe | C:\Users\admin\AppData\Roaming\F63AAA\A71D80.lck | — | |
MD5:— | SHA256:— | |||
2444 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:C111F99CD469831004E4547E39009B06 | SHA256:3479C3CB813B5D1C331B8400A690378D71DF89F98184E62788F05713D903F6AF | |||
2444 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$w Enquiry.docx | pgc | |
MD5:C29A27E550BBDE0D053AE0825E1FD668 | SHA256:20329F02640694F650B6B1B9F8C34B9D54F56F68B1E3F24A83A182F68B1788D4 | |||
2444 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF | binary | |
MD5:D5C03AA87A2838435A9CF1E5E480C16B | SHA256:56EEA040C9A51F39E40D05F90464A21F92B0D1CCE90C17FEEE46BFFB22C7EA91 | |||
2444 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD | binary | |
MD5:7CC241165A1D4E9712E8BD086C66126A | SHA256:ACD9F99B78A4A2DF977CDAAB6522ABC1E6D912D702BFC9EF7711E44AFD37E8C2 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2148 | roc.exe | POST | — | 64.187.229.26:80 | http://ebslaradio.cl/chigo/Panel/five/fre.php | US | — | — | malicious |
2148 | roc.exe | POST | — | 64.187.229.26:80 | http://ebslaradio.cl/chigo/Panel/five/fre.php | US | — | — | malicious |
2148 | roc.exe | POST | — | 64.187.229.26:80 | http://ebslaradio.cl/chigo/Panel/five/fre.php | US | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
972 | svchost.exe | 104.28.14.69:443 | oudheverlee.top | Cloudflare Inc | US | shared |
2444 | WINWORD.EXE | 104.28.14.69:443 | oudheverlee.top | Cloudflare Inc | US | shared |
1820 | EQNEDT32.EXE | 104.28.15.69:443 | oudheverlee.top | Cloudflare Inc | US | shared |
2148 | roc.exe | 64.187.229.26:80 | ebslaradio.cl | Microglobe LLC | US | suspicious |
2444 | WINWORD.EXE | 104.28.15.69:443 | oudheverlee.top | Cloudflare Inc | US | shared |
972 | svchost.exe | 104.28.15.69:443 | oudheverlee.top | Cloudflare Inc | US | shared |
Domain | IP | Reputation |
---|---|---|
oudheverlee.top |
| suspicious |
dns.msftncsi.com |
| shared |
ebslaradio.cl |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |
— | — | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |
2148 | roc.exe | A Network Trojan was detected | ET TROJAN LokiBot User-Agent (Charon/Inferno) |
2148 | roc.exe | A Network Trojan was detected | ET TROJAN LokiBot Checkin |
2148 | roc.exe | A Network Trojan was detected | ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 |
2148 | roc.exe | A Network Trojan was detected | ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 |
2148 | roc.exe | A Network Trojan was detected | MALWARE [PTsecurity] Loki Bot Check-in M2 |
2148 | roc.exe | A Network Trojan was detected | ET TROJAN LokiBot User-Agent (Charon/Inferno) |
2148 | roc.exe | A Network Trojan was detected | ET TROJAN LokiBot Checkin |
2148 | roc.exe | A Network Trojan was detected | ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 |
Process | Message |
---|---|
roc.exe | User32.dll |
roc.exe | User32.dll |
roc.exe | User32.dll |
roc.exe | User32.dll |
roc.exe | User32.dll |
roc.exe | User32.dll |
roc.exe | User32.dll |
roc.exe | User32.dll |
roc.exe | User32.dll |
roc.exe | User32.dll |