analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

TT Payment.xlsx

Full analysis: https://app.any.run/tasks/416e5fc7-34ec-4b6a-9127-aa6feadb3b50
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: January 24, 2022, 23:57:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
encrypted
opendir
exploit
CVE-2017-11882
loader
trojan
lokibot
stealer
Indicators:
MIME: application/encrypted
File info: CDFV2 Encrypted
MD5:

0B8481F300A85B9FADEBF6CE6ECB1C3A

SHA1:

8BAD7A7370D788FA7923BAAF3C666E75DCA63B77

SHA256:

9EF2BEE56B1011413A973D0E616B4AD0C75614B3EFAC1D566CC879EBF70CCCB6

SSDEEP:

3072:jNEuh8gLgF5k/OLwmlufXrItchB9D6z9vo0TfNkSdB0SwLCUEZj4NiUTnpkLs:hxhN8FtOTItIy9o0TiSpJaMUVk4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 3684)
    • Steals credentials from Web Browsers

      • vbc.exe (PID: 836)
    • Application was dropped or rewritten from another process

      • vbc.exe (PID: 836)
      • vbc.exe (PID: 3852)
    • Drops executable file immediately after starts

      • vbc.exe (PID: 3852)
    • Connects to CnC server

      • vbc.exe (PID: 836)
    • Loads dropped or rewritten executable

      • vbc.exe (PID: 3852)
    • Actions looks like stealing of personal data

      • vbc.exe (PID: 836)
    • LOKIBOT was detected

      • vbc.exe (PID: 836)
  • SUSPICIOUS

    • Checks supported languages

      • EQNEDT32.EXE (PID: 3684)
      • vbc.exe (PID: 3852)
      • vbc.exe (PID: 836)
    • Reads the computer name

      • EQNEDT32.EXE (PID: 3684)
      • vbc.exe (PID: 3852)
      • vbc.exe (PID: 836)
    • Executable content was dropped or overwritten

      • vbc.exe (PID: 3852)
      • EQNEDT32.EXE (PID: 3684)
      • vbc.exe (PID: 836)
    • Executed via COM

      • EQNEDT32.EXE (PID: 3684)
    • Drops a file with too old compile date

      • EQNEDT32.EXE (PID: 3684)
      • vbc.exe (PID: 836)
    • Drops a file with a compile date too recent

      • vbc.exe (PID: 3852)
    • Application launched itself

      • vbc.exe (PID: 3852)
    • Loads DLL from Mozilla Firefox

      • vbc.exe (PID: 836)
    • Creates files in the user directory

      • vbc.exe (PID: 836)
  • INFO

    • Checks supported languages

      • EXCEL.EXE (PID: 1988)
    • Reads the computer name

      • EXCEL.EXE (PID: 1988)
    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 1988)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start excel.exe no specs eqnedt32.exe vbc.exe #LOKIBOT vbc.exe

Process information

PID
CMD
Path
Indicators
Parent process
1988"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXEExplorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\excel.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\lpk.dll
3684"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
Modules
Images
c:\program files\common files\microsoft shared\equation\eqnedt32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
3852"C:\Users\Public\vbc.exe" C:\Users\Public\vbc.exe
EQNEDT32.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\public\vbc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
836"C:\Users\Public\vbc.exe" C:\Users\Public\vbc.exe
vbc.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\public\vbc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ole32.dll
Total events
2 602
Read events
2 526
Write events
65
Delete events
11

Modification events

(PID) Process:(1988) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:writeName:&4<
Value:
26343C00C4070000010000000000000000000000
(PID) Process:(1988) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(1988) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(1988) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(1988) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(1988) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(1988) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(1988) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(1988) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(1988) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
Off
Executable files
4
Suspicious files
3
Text files
2
Unknown types
3

Dropped files

PID
Process
Filename
Type
1988EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRE4A6.tmp.cvr
MD5:
SHA256:
3852vbc.exeC:\Users\admin\AppData\Local\Temp\nstECF4.tmpini
MD5:64E2005116E45F6F16D7490EEB4AE8AF
SHA256:099B0766BE5FBC703B035CDD8B070B22080293746298D398E620C8984D3C3E60
3852vbc.exeC:\Users\admin\AppData\Local\Temp\cmipzbinary
MD5:AE105F6978D5C283D740105FCD70C514
SHA256:5781C4751F1377C823340D994122358C3F0042C0A96B02CCAEECBD033DFF2670
3852vbc.exeC:\Users\admin\AppData\Local\Temp\nsjED05.tmp\ejvbwrjv.dllexecutable
MD5:4F6479C76F8AA58ACA79D07A21D3BE9D
SHA256:D64FE23651544B66625B9FE876F677633CC1A346A37275CF7E44242F07CED107
836vbc.exeC:\Users\admin\AppData\Roaming\F63AAA\A71D80.exeexecutable
MD5:548FCEB4959384ED0351F1FCD4EF54E1
SHA256:EDDDAB090284F2BD22D4A30B9BBE352AF5C0C357F72AB3D27154FDABF9FEE51C
3684EQNEDT32.EXEC:\Users\Public\vbc.exeexecutable
MD5:548FCEB4959384ED0351F1FCD4EF54E1
SHA256:EDDDAB090284F2BD22D4A30B9BBE352AF5C0C357F72AB3D27154FDABF9FEE51C
3852vbc.exeC:\Users\admin\AppData\Local\Temp\2zu83zst0k0pokntfpbinary
MD5:0DB1BE4AF6CC0C4B768289643312CE28
SHA256:B0B4DA4098AB02217694149FA302F650ADC686FB4BC0195E65FB3537F4F55670
1988EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\20F0431F.emfemf
MD5:3DFE32437CDB1D14E4F4C65790FDF92D
SHA256:9550D227CF45B70A89C5929FC00E03D60F5DA933CEF44EF778CC4EAC2F91AC55
3684EQNEDT32.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\vbc[1].exeexecutable
MD5:548FCEB4959384ED0351F1FCD4EF54E1
SHA256:EDDDAB090284F2BD22D4A30B9BBE352AF5C0C357F72AB3D27154FDABF9FEE51C
836vbc.exeC:\Users\admin\AppData\Roaming\F63AAA\A71D80.lckbinary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
6
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3684
EQNEDT32.EXE
GET
200
198.12.81.91:80
http://198.12.81.91/4321/vbc.exe
US
executable
242 Kb
suspicious
836
vbc.exe
POST
404
188.114.97.7:80
http://hfjv9g950bag53fcbcdnbcbnmhy35zch.tk/BN1/fre.php
US
malicious
836
vbc.exe
POST
404
188.114.97.7:80
http://hfjv9g950bag53fcbcdnbcbnmhy35zch.tk/BN1/fre.php
US
malicious
836
vbc.exe
POST
404
188.114.97.7:80
http://hfjv9g950bag53fcbcdnbcbnmhy35zch.tk/BN1/fre.php
US
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3684
EQNEDT32.EXE
198.12.81.91:80
ColoCrossing
US
suspicious
836
vbc.exe
188.114.97.7:80
hfjv9g950bag53fcbcdnbcbnmhy35zch.tk
Cloudflare Inc
US
malicious

DNS requests

Domain
IP
Reputation
hfjv9g950bag53fcbcdnbcbnmhy35zch.tk
  • 188.114.97.7
  • 188.114.96.7
malicious

Threats

PID
Process
Class
Message
3684
EQNEDT32.EXE
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
3684
EQNEDT32.EXE
Potentially Bad Traffic
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
3684
EQNEDT32.EXE
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
3684
EQNEDT32.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3684
EQNEDT32.EXE
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
3684
EQNEDT32.EXE
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
Potentially Bad Traffic
ET DNS Query to a .tk domain - Likely Hostile
836
vbc.exe
A Network Trojan was detected
ET TROJAN LokiBot User-Agent (Charon/Inferno)
836
vbc.exe
A Network Trojan was detected
ET TROJAN LokiBot Checkin
836
vbc.exe
Potentially Bad Traffic
ET POLICY HTTP Request to a *.tk domain
3 ETPRO signatures available at the full report
No debug info