File name: | a24667cec05db52f217c49e5bd6deec1a4af14b9fefe3ff9d7a0310487a3fbca |
Full analysis: | https://app.any.run/tasks/335daa35-70cf-485a-bec3-52bd3a04d93f |
Verdict: | Malicious activity |
Threats: | LokiBot was developed in 2015 to steal information from a variety of applications. Despite the age, this malware is still rather popular among cybercriminals. |
Analysis date: | February 18, 2019, 11:25:40 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | text/rtf |
File info: | Rich Text Format data, version 1, unknown character set |
MD5: | D0BD2866BF356C95BE306D29A8A205C8 |
SHA1: | 4A1E9CAE27FAA8984011AEDE5D51F5B48603D537 |
SHA256: | A24667CEC05DB52F217C49E5BD6DEEC1A4AF14B9FEFE3FF9D7A0310487A3FBCA |
SSDEEP: | 12288:UBL4WshiSa3NUQ1uwTKFdg2ou9p0wBE7aWsX6+tH8Yjy2VHU8DVkYXgQjCQfg6:ohUQ1E/h7g7XZ4HlSo+2jR |
.rtf | | | Rich Text Format (100) |
---|
InternalVersionNumber: | 57435 |
---|---|
CharactersWithSpaces: | 27 |
Characters: | 24 |
Words: | 4 |
Pages: | 1 |
TotalEditTime: | 1 minute |
RevisionNumber: | 3 |
ModifyDate: | 2019:01:03 16:34:00 |
CreateDate: | 2019:01:03 16:14:00 |
LastModifiedBy: | wuyan |
Author: | wuyan |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2992 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\a24667cec05db52f217c49e5bd6deec1a4af14b9fefe3ff9d7a0310487a3fbca.rtf" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3976 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
2644 | CmD /c %tMp%\A.R | C:\Windows\system32\CmD.exe | — | EQNEDT32.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 3221225477 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3100 | C:\Users\admin\AppData\Local\Temp\A.R | C:\Users\admin\AppData\Local\Temp\A.R | CmD.exe | |
User: admin Company: Auslogics Integrity Level: MEDIUM Description: Diverted Frage Painter Nesting Dreams Exit code: 3221225477 | ||||
2728 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\A.R | C:\Windows\system32\rundll32.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3956 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\A.R | C:\Windows\system32\rundll32.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3368 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
3940 | CmD /c %tMp%\A.R | C:\Windows\system32\CmD.exe | — | EQNEDT32.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2972 | C:\Users\admin\AppData\Local\Temp\A.R | C:\Users\admin\AppData\Local\Temp\A.R | CmD.exe | |
User: admin Company: Auslogics Integrity Level: MEDIUM Description: Diverted Frage Painter Nesting Dreams | ||||
3884 | "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe" -Embedding | C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe | svchost.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Setup Bootstrapper Exit code: 0 Version: 14.0.6010.1000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2992 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVREAC2.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2972 | A.R | C:\Users\admin\AppData\Roaming\F63AAA\A71D80.lck | — | |
MD5:— | SHA256:— | |||
2992 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D8CA9154.emf | emf | |
MD5:F7961E44FE51CEEE06391905162E18E0 | SHA256:DCD5C765BCCFAC9339A8985357B391A3FAC1AE571AC0E5A971938573742F306D | |||
2992 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\A.R | executable | |
MD5:B710F21B3EE733853F5EA63C453A33AD | SHA256:623498BFC03116503F0F2CE063DB0D0E1D0681E774CBCE8FE498B85A134A80C3 | |||
2992 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$4667cec05db52f217c49e5bd6deec1a4af14b9fefe3ff9d7a0310487a3fbca.rtf | pgc | |
MD5:161C804D236EA89EFA9102FAD4E59821 | SHA256:9AEF583FBE4D63BD128FCCA2727B42182B56D6A8E8075029CF01BE384DB88608 | |||
2992 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:DCAA67B0E70660D81D617FA974400603 | SHA256:9FABD5C9F34C29E3100E05A15E1B4542A4BAF8849FC0CED4847B6465D692BCF4 | |||
2992 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E964D945.wmf | wmf | |
MD5:40EB7FFD7884B0CFAD496FCE5D2FD6D0 | SHA256:3B9F7E335975FB3F506B74C49E376A3468BD0AEC1ABD1768674F2C3CE14E6D34 | |||
2972 | A.R | C:\Users\admin\AppData\Roaming\F63AAA\A71D80.exe | executable | |
MD5:B710F21B3EE733853F5EA63C453A33AD | SHA256:623498BFC03116503F0F2CE063DB0D0E1D0681E774CBCE8FE498B85A134A80C3 | |||
3884 | Setup.exe | C:\Users\admin\AppData\Local\Temp\SetupExe(20190218112621F2C).log | text | |
MD5:D25AFA450E66DB1249CC8145A396A751 | SHA256:1600CC21513135169E065F231CDA36F7C5F1BD2F1AF91C886B418FA297C47F29 | |||
3884 | Setup.exe | C:\Users\admin\AppData\Local\Temp\Setup00000f2c\OSETUPUI.DLL | executable | |
MD5:196A884E700B7EB09B2CD0A48ECCBC3A | SHA256:12BABD301AB2F5A0CD35226D4939E1E200D5FCF90694A25690DF7AD0EA28B55A |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2972 | A.R | POST | 404 | 185.62.103.150:80 | http://plikerss.hk/tins/memz2/fre.php | RU | text | 15 b | malicious |
2972 | A.R | POST | 404 | 185.62.103.150:80 | http://plikerss.hk/tins/memz2/fre.php | RU | text | 15 b | malicious |
2972 | A.R | POST | 404 | 185.62.103.150:80 | http://plikerss.hk/tins/memz2/fre.php | RU | binary | 23 b | malicious |
2972 | A.R | POST | 404 | 185.62.103.150:80 | http://plikerss.hk/tins/memz2/fre.php | RU | binary | 23 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2972 | A.R | 185.62.103.150:80 | plikerss.hk | Start LLC | RU | malicious |
Domain | IP | Reputation |
---|---|---|
plikerss.hk |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
2972 | A.R | A Network Trojan was detected | ET TROJAN LokiBot User-Agent (Charon/Inferno) |
2972 | A.R | A Network Trojan was detected | ET TROJAN LokiBot Checkin |
2972 | A.R | A Network Trojan was detected | ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 |
2972 | A.R | A Network Trojan was detected | ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 |
2972 | A.R | A Network Trojan was detected | MALWARE [PTsecurity] Loki Bot Check-in M2 |
2972 | A.R | A Network Trojan was detected | ET TROJAN LokiBot User-Agent (Charon/Inferno) |
2972 | A.R | A Network Trojan was detected | ET TROJAN LokiBot Checkin |
2972 | A.R | A Network Trojan was detected | ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 |
2972 | A.R | A Network Trojan was detected | ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 |
2972 | A.R | A Network Trojan was detected | MALWARE [PTsecurity] Loki Bot Check-in M2 |