7132c970d507eb75c63c22dda27c41f815d7347e38cde0864f1812e2eaaac169

Interactive malware hunting service

General Info

File name: Sample1.zip

Full analysis: https://app.any.run/tasks/cf6654e0-4537-421b-8aa8-12b469088cd0

Verdict: Malicious activity

Analysis date: 8/13/2019, 15:36:46

OS:: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)

Tags:: trojan

lokibot

opendir

Indicators:

MIME:: application/zip

File info:: Zip archive data, at least v2.0 to extract

MD5: fa9afae56bea433998b9ec9e623972dc

SHA1: c71768cae6027f650ac076ea9c8b7c16b7e3692b

SHA256: 7132c970d507eb75c63c22dda27c41f815d7347e38cde0864f1812e2eaaac169

SSDEEP: 3072:yK1zYlGeL781Ws/MbOJGZrxdyAMRJdyEV3esZ0Bom+sT4iE50egQLC++ivxRIFZ5:9RYlxvwWUtGVbyAM7lODoSsiLQLC++i8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distored by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Software environment set and analysis options

Launch configuration

Task duration: 300 seconds

Additional time used: 240 seconds

Fakenet option: off

Heavy Evaision option: off

MITM proxy: off

Route via Tor: off

Network geolocation: off

Privacy: Public submission

Autoconfirmation of UAC: on

Software preset

Internet Explorer 8.0.7601.17514
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (75.0.3770.100)
Google Update Helper (1.3.34.7)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.7.2 (4.7.03062)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.21.27702 (14.21.27702.2)
Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702 (14.21.27702)
Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702 (14.21.27702)
Mozilla Firefox 68.0.1 (x86 en-US) (68.0.1)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
Update for Microsoft .NET Framework 4.7.2 (KB4087364) (1)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB4019990
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Behavior activities

MALICIOUS	SUSPICIOUS	INFO
Detected artifacts of LokiBot ayy.exe (PID: 4040) Connects to CnC server ayy.exe (PID: 4040) LOKIBOT was detected ayy.exe (PID: 4040) Application was dropped or rewritten from another process ayy.exe (PID: 4040) ayy.exe (PID: 2028) ayy.exe (PID: 3160) Actions looks like stealing of personal data ayy.exe (PID: 4040)	Executable content was dropped or overwritten ayy.exe (PID: 4040) Application launched itself ayy.exe (PID: 2028) ayy.exe (PID: 3160) Creates files in the user directory ayy.exe (PID: 4040) Loads DLL from Mozilla Firefox ayy.exe (PID: 4040)	Manual execution by user ayy.exe (PID: 2028)

MALICIOUS

SUSPICIOUS

INFO

Detected artifacts of LokiBot

ayy.exe (PID: 4040)

Connects to CnC server

ayy.exe (PID: 4040)

LOKIBOT was detected

ayy.exe (PID: 4040)

Application was dropped or rewritten from another process

ayy.exe (PID: 4040)
ayy.exe (PID: 2028)
ayy.exe (PID: 3160)

Actions looks like stealing of personal data

ayy.exe (PID: 4040)

Executable content was dropped or overwritten

ayy.exe (PID: 4040)

Application launched itself

ayy.exe (PID: 2028)
ayy.exe (PID: 3160)

Creates files in the user directory

ayy.exe (PID: 4040)

Loads DLL from Mozilla Firefox

ayy.exe (PID: 4040)

Manual execution by user

ayy.exe (PID: 2028)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Static information

TRiD

.zip

| ZIP compressed archive (100%)

EXIF

ZipRequiredVersion:

788

ZipBitFlag:

0x0001

ZipCompression:

Deflated

ZipModifyDate:

2019:08:13 13:36:09

ZipCRC:

0x6ab0e311

ZipCompressedSize:

190433

ZipUncompressedSize:

593920

ZipFileName:

b54d4d1b746bb5eeda836eb657467776b9e086cb8071a6cdc1c7e5d043ab62f0.bin

Screenshots

Screenshot of 7132c970d507eb75c63c22dda27c41f815d7347e38cde0864f1812e2eaaac169 taken from 11798 ms from task started

Screenshot of 7132c970d507eb75c63c22dda27c41f815d7347e38cde0864f1812e2eaaac169 taken from 29027 ms from task started

Screenshot of 7132c970d507eb75c63c22dda27c41f815d7347e38cde0864f1812e2eaaac169 taken from 33045 ms from task started

Screenshot of 7132c970d507eb75c63c22dda27c41f815d7347e38cde0864f1812e2eaaac169 taken from 34081 ms from task started

Screenshot of 7132c970d507eb75c63c22dda27c41f815d7347e38cde0864f1812e2eaaac169 taken from 36083 ms from task started

Screenshot of 7132c970d507eb75c63c22dda27c41f815d7347e38cde0864f1812e2eaaac169 taken from 37084 ms from task started

Screenshot of 7132c970d507eb75c63c22dda27c41f815d7347e38cde0864f1812e2eaaac169 taken from 42098 ms from task started

Processes

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

–

Specs description

Program did not start

Integrity level elevation

Task сontains an error or was rebooted

Process has crashed

Task contains several apps running

Executable file was dropped

Debug information is available

Process was injected

Network attacks were detected

Application downloaded the executable file

Actions similar to stealing personal data

Behavior similar to exploiting the vulnerability

Inspected object has sucpicious PE structure

File is detected by antivirus software

CPU overrun

RAM overrun

Process starts the services

Process was added to the startup

Behavior similar to spam

Low-level access to the HDD

Probably Tor was used

System was rebooted

Connects to the network

Known threat

Process information

Click at the process to see the details.

PID: 360

CMD: "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Sample1.zip"

Path: C:\Program Files\WinRAR\WinRAR.exe

Indicators: No indicators

Parent process: ––

User: admin

Integrity Level: MEDIUM

Exit code: 0

Version:

Company: Alexander Roshal

Description: WinRAR archiver

Version: 5.60.0

Modules

Image
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\shlwapi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\uxtheme.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\riched20.dll
c:\program files\common files\microsoft shared\ink\tiptsf.dll
c:\windows\system32\windowscodecs.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ehstorshell.dll
c:\windows\system32\cscui.dll
c:\windows\system32\cscdll.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\slc.dll
c:\windows\system32\imageres.dll
c:\windows\system32\mpr.dll
c:\windows\system32\drprov.dll
c:\windows\system32\winsta.dll
c:\windows\system32\ntlanman.dll
c:\windows\system32\davclnt.dll
c:\windows\system32\davhlpr.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\wpdshext.dll
c:\windows\system32\winmm.dll
c:\windows\system32\portabledeviceapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\audiodev.dll
c:\windows\system32\wmvcore.dll
c:\windows\system32\wmasf.dll
c:\windows\system32\ehstorapi.dll
c:\windows\system32\shdocvw.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\samcli.dll
c:\windows\system32\samlib.dll
c:\windows\system32\profapi.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\explorerframe.dll
c:\windows\system32\duser.dll
c:\windows\system32\dui70.dll

PID: 2028

CMD: "C:\Users\admin\Desktop\ayy.exe"

Path: C:\Users\admin\Desktop\ayy.exe

Indicators: No indicators

Parent process: ––

User: admin

Integrity Level: MEDIUM

Exit code: 0

Version:

Company

Description

Version: 1.00

Modules

Image
c:\users\admin\desktop\ayy.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\sxs.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\version.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\apphelp.dll

PID: 3160

CMD: "C:\Users\admin\Desktop\ayy.exe"

Path: C:\Users\admin\Desktop\ayy.exe

Indicators: No indicators

Parent process: ayy.exe

User: admin

Integrity Level: MEDIUM

Exit code: 0

Version:

Company

Description

Version: 1.00

Modules

Image
c:\systemroot\system32\ntdll.dll
c:\users\admin\desktop\ayy.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\sxs.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\version.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\apphelp.dll

PID: 4040

CMD: "C:\Users\admin\Desktop\ayy.exe"

Path: C:\Users\admin\Desktop\ayy.exe

Indicators

Parent process: ayy.exe

User: admin

Integrity Level: MEDIUM

Version:

Company

Description

Version: 1.00

Modules

Image
c:\users\admin\desktop\ayy.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\cryptbase.dll
c:\program files\mozilla firefox\nss3.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\api-ms-win-core-timezone-l1-1-0.dll
c:\windows\system32\api-ms-win-core-file-l2-1-0.dll
c:\windows\system32\api-ms-win-core-localization-l1-2-0.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
c:\windows\system32\api-ms-win-core-file-l1-2-0.dll
c:\windows\system32\api-ms-win-crt-heap-l1-1-0.dll
c:\windows\system32\api-ms-win-crt-string-l1-1-0.dll
c:\windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
c:\windows\system32\api-ms-win-crt-convert-l1-1-0.dll
c:\windows\system32\api-ms-win-crt-locale-l1-1-0.dll
c:\windows\system32\api-ms-win-crt-math-l1-1-0.dll
c:\windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
c:\windows\system32\api-ms-win-crt-time-l1-1-0.dll
c:\windows\system32\api-ms-win-crt-environment-l1-1-0.dll
c:\windows\system32\api-ms-win-crt-utility-l1-1-0.dll
c:\windows\system32\winmm.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
c:\program files\mozilla firefox\softokn3.dll
c:\program files\mozilla firefox\freebl3.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\vaultcli.dll
c:\windows\system32\wininet.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\profapi.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\samcli.dll
c:\windows\system32\samlib.dll
c:\windows\system32\userenv.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\wship6.dll
c:\windows\system32\wshtcpip.dll

Registry activity

Total events

472

Read events

447

Write events

Delete events

Modification events

PID

Process

Operation

Key

Name

Value

360

WinRAR.exe

write

HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes

ShellExtBMP

360

WinRAR.exe

write

HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes

ShellExtIcon

360

WinRAR.exe

write

HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E

LanguageList

en-US

360

WinRAR.exe

write

HKEY_CURRENT_USER\Software\WinRAR\ArcHistory

C:\Users\admin\AppData\Local\Temp\Sample1.zip

360

WinRAR.exe

write

HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths

name

120

360

WinRAR.exe

write

HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths

size

360

WinRAR.exe

write

HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths

type

120

360

WinRAR.exe

write

HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths

mtime

100

360

WinRAR.exe

write

HKEY_CURRENT_USER\Software\WinRAR\Interface

ShowPassword

360

WinRAR.exe

write

HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin

Placement

2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000

360

WinRAR.exe

write

HKEY_CURRENT_USER\Software\WinRAR\General

LastFolder

C:\Users\admin\AppData\Local\Temp

360

WinRAR.exe

write