File name:

Request for quotation -6001845515-XLSX.exe

Full analysis: https://app.any.run/tasks/7684e2cb-b11c-4186-bf49-42f0c70f50d8
Verdict: Malicious activity
Threats:

LokiBot was developed in 2015 to steal information from a variety of applications. Despite the age, this malware is still rather popular among cybercriminals.

Malware Trends Tracker     >>>
Analysis date: February 20, 2025, 09:16:58
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autoit
lokibot
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

533E9A82E11E4D2D1CC7859BAA9BD565

SHA1:

7040DFB325E5177ADF012E1519F5CB3C7EA761E1

SHA256:

9BAA9EAE4AC972C6EC77DAA29929D86EA2462C9B2A8E4934B35CFAB2A331DE49

SSDEEP:

49152:M6WNkebmEFhOHGo4uh68QqyxBXSCXPGms1lw3F0YmKDSd0ujsE58Vq84wE8hnHkU:f4kEm2O0uh68QqoBXSCXPGms1lw3F0Yz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LOKIBOT has been detected (YARA)

      • Request for quotation -6001845515-XLSX.exe (PID: 6500)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • Request for quotation -6001845515-XLSX.exe (PID: 6500)

    • Executes application which crashes

      • Request for quotation -6001845515-XLSX.exe (PID: 6500)

  • INFO

    • Checks supported languages

      • Request for quotation -6001845515-XLSX.exe (PID: 6500)

    • The sample compiled with english language support

      • Request for quotation -6001845515-XLSX.exe (PID: 6500)

    • Reads mouse settings

      • Request for quotation -6001845515-XLSX.exe (PID: 6500)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6756)

    • Reads the software policy settings

      • WerFault.exe (PID: 6756)

    • Create files in a temporary directory

      • Request for quotation -6001845515-XLSX.exe (PID: 6500)

    • Checks proxy server information

      • WerFault.exe (PID: 6756)

    • The process uses AutoIt

      • Request for quotation -6001845515-XLSX.exe (PID: 6500)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:02:19 01:50:16+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 581632
InitializedDataSize: 420864
UninitializedDataSize: -
EntryPoint: 0x2800a
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #LOKIBOT request for quotation -6001845515-xlsx.exe svchost.exe no specs werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
6500"C:\Users\admin\AppData\Local\Temp\Request for quotation -6001845515-XLSX.exe" C:\Users\admin\AppData\Local\Temp\Request for quotation -6001845515-XLSX.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\request for quotation -6001845515-xlsx.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
6620"C:\Users\admin\AppData\Local\Temp\Request for quotation -6001845515-XLSX.exe" C:\Windows\SysWOW64\svchost.exe—Request for quotation -6001845515-XLSX.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
6756C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6500 -s 764C:\Windows\SysWOW64\WerFault.exe
Request for quotation -6001845515-XLSX.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
3 094
Read events
3 094
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
10
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6756WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Request for quot_bfb9ad7356415e1e612a9936f44b49fd411927_a1dad2bc_4bafb172-d7c7-431a-8709-6d51da4d7259\Report.wer —
MD5:—
SHA256:—
6756WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER51EC.tmp.dmpbinary
MD5:2F4FFB80C0E48B495D21EE97EC67AD0D
SHA256:BF1428334C0C9E193BECABFB300002798048634BE95476BFE053FCCC088BF420
6500Request for quotation -6001845515-XLSX.exeC:\Users\admin\AppData\Local\Temp\aut4D69.tmpbinary
MD5:F6F15D22D83F218B7B10BB23794FD7A0
SHA256:15F79F7E65495E1692BAA1B744B2C28A3D4FC79D254C77592FFD0A2367101017
6500Request for quotation -6001845515-XLSX.exeC:\Users\admin\AppData\Local\Temp\Milburttext
MD5:5D5BE089750DE968CEC0A6BCEFD154B9
SHA256:FF97336A5F0197FC22D60869596A08EAC9B92A1AF7C0617DF131BC10AE8806B4
6756WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEbinary
MD5:FA84E4BCC92AA5DB735AB50711040CDE
SHA256:6D7205E794FDE4219A62D9692ECDDF612663A5CF20399E79BE87B851FCA4CA33
6756WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER5346.tmp.xmlxml
MD5:3EBDBFA407EC9311BB61D7D04AB25B5A
SHA256:A623B9A1FA97EA4A35D4A2FEDDAF6BD468F6AD1FF6755D4BCEC2E2ED9579EF2F
6756WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER5316.tmp.WERInternalMetadata.xmlbinary
MD5:26EFC373FC9374BAC8B5CEECC18AA3B3
SHA256:1FB2A746250976473D409A3433F90257C84C9A332156D69A025EB6A253C2C3EF
6756WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:4AB714C6141A6AC203963A4D4D4CAB45
SHA256:1354277399CD638AE368D61BC112B4EF87F39E330CDC70D07600AFED335CB14D
6500Request for quotation -6001845515-XLSX.exeC:\Users\admin\AppData\Local\Temp\aut4D58.tmpbinary
MD5:2BDABCC5FEF604A66C38E34C6623ED5D
SHA256:1A23C29699956053BB33E699145C9DF724022B905D4E93EB0476DCA3ABAA1EB1
6500Request for quotation -6001845515-XLSX.exeC:\Users\admin\AppData\Local\Temp\donebinary
MD5:76262E0CA519C62DAADE12A59EE56809
SHA256:568E0566324C5F25F65E02BA00ACB850CD1B40B931F9CAA09625DC1D101DA029
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
35
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
104.124.11.17:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5564
svchost.exe
GET
200
104.124.11.17:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5564
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6756
WerFault.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6756
WerFault.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2928
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6892
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5564
svchost.exe
104.124.11.17:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
104.124.11.17:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5564
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5064
SearchApp.exe
184.86.251.11:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1544
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5564
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 104.124.11.17
  • 104.124.11.58
  • 2.19.11.120
  • 2.19.11.105
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.246.101
whitelisted
google.com
  • 142.250.185.238
whitelisted
www.bing.com
  • 184.86.251.11
  • 184.86.251.14
  • 184.86.251.13
  • 184.86.251.15
  • 184.86.251.10
  • 184.86.251.18
  • 184.86.251.20
  • 184.86.251.16
  • 184.86.251.19
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
login.live.com
  • 20.190.159.23
  • 40.126.31.130
  • 20.190.159.73
  • 20.190.159.4
  • 20.190.159.2
  • 20.190.159.130
  • 20.190.159.71
  • 20.190.159.75
whitelisted
go.microsoft.com
  • 104.115.89.132
whitelisted
watson.events.data.microsoft.com
  • 20.189.173.22
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
fd.api.iris.microsoft.com
  • 20.74.47.205
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Request for quotation -6001845515-XLSX.exe