analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

ffbbe9516cfa3bf9da3363453638646e.zip

Full analysis: https://app.any.run/tasks/21d2dad0-4861-42e5-8013-fd0cb7d8d643
Verdict: Malicious activity
Threats:

LokiBot was developed in 2015 to steal information from a variety of applications. Despite the age, this malware is still rather popular among cybercriminals.

Malware Trends Tracker     >>>
Analysis date: May 20, 2019, 04:40:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
lokibot
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

20D89AE3D7216A3848651912E070A9D7

SHA1:

35668F3452BF07AE92A6E233D53ADE3C618708A4

SHA256:

A7B32876AB95D83CD4FB95BEC34B184D1C45088BFE24B5C5443DBC5B869FDF65

SSDEEP:

768:ThOLb2ds1f0j3lE6hmZ/TsQdljbT4yY/D/qnxY:NTufi3lAZ/TZrb5MD/qi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • LOXCWM.exe (PID: 900)
      • LOXCWM.exe (PID: 1160)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2984)

    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 2984)

    • Detected artifacts of LokiBot

      • LOXCWM.exe (PID: 1160)

    • Connects to CnC server

      • LOXCWM.exe (PID: 1160)

    • Actions looks like stealing of personal data

      • LOXCWM.exe (PID: 1160)

  • SUSPICIOUS

    • Application launched itself

      • LOXCWM.exe (PID: 900)

    • Loads DLL from Mozilla Firefox

      • LOXCWM.exe (PID: 1160)

    • Executable content was dropped or overwritten

      • LOXCWM.exe (PID: 1160)

    • Creates files in the user directory

      • LOXCWM.exe (PID: 1160)

  • INFO

    • Modifies the open verb of a shell class

      • rundll32.exe (PID: 2916)

    • Manual execution by user

      • rundll32.exe (PID: 2916)
      • WINWORD.EXE (PID: 2984)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2984)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Deflated
ZipModifyDate: 2019:05:20 05:55:16
ZipCRC: 0x2987f2d9
ZipCompressedSize: 33390
ZipUncompressedSize: 60928
ZipFileName: ffbbe9516cfa3bf9da3363453638646e
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs rundll32.exe no specs winrar.exe no specs winword.exe loxcwm.exe no specs #LOKIBOT loxcwm.exe

Process information

PID
CMD
Path
Indicators
Parent process
3376"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\ffbbe9516cfa3bf9da3363453638646e.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2916"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\ffbbe9516cfa3bf9da3363453638646eC:\Windows\system32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2352"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\ffbbe9516cfa3bf9da3363453638646e"C:\Program Files\WinRAR\WinRAR.exe—rundll32.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2984"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\ffbbe9516cfa3bf9da3363453638646e.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
900"C:\Users\admin\AppData\Local\Temp\LOXCWM.exe" C:\Users\admin\AppData\Local\Temp\LOXCWM.exe—WINWORD.EXE
User:
admin
Integrity Level:
MEDIUM
Version:
3.09.0001
1160C:\Users\admin\AppData\Local\Temp\LOXCWM.exe" C:\Users\admin\AppData\Local\Temp\LOXCWM.exe
LOXCWM.exe
User:
admin
Integrity Level:
MEDIUM
Version:
3.09.0001
Total events
3 066
Read events
2 439
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
1
Text files
5
Unknown types
6

Dropped files

PID
Process
Filename
Type
2984WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRF16D.tmp.cvr —
MD5:—
SHA256:—
1160LOXCWM.exeC:\Users\admin\AppData\Roaming\F63AAA\A71D80.lck —
MD5:—
SHA256:—
2984WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\ffbbe9516cfa3bf9da3363453638646e.doc.LNKlnk
MD5:CE0CC5D58A0AB86973A738950B5AFE18
SHA256:A157A58E69BCDFB3CEDBF5C1428F5A92EAB3DF835242B3EAAC21079477CB721E
2984WINWORD.EXEC:\Users\admin\AppData\Local\Temp\LOXCWM.exeexecutable
MD5:5B81A517C610F13742CA0CC525E5864C
SHA256:20FF409D0DCCAF493BE59068DB4F2EF22B112EA9D372BD5FC82C83A81A6CCFD3
2984WINWORD.EXEC:\Users\admin\Desktop\~$bbe9516cfa3bf9da3363453638646e.docpgc
MD5:D63A20EEA18F49FF9841E75CC2512446
SHA256:B03F355FA09D5DC9413A7F74F9036DC540717A050DE2C481A2AD95E907CF1386
1160LOXCWM.exeC:\Users\admin\AppData\Roaming\F63AAA\A71D80.exeexecutable
MD5:5B81A517C610F13742CA0CC525E5864C
SHA256:20FF409D0DCCAF493BE59068DB4F2EF22B112EA9D372BD5FC82C83A81A6CCFD3
3376WinRAR.exeC:\Users\admin\Desktop\ffbbe9516cfa3bf9da3363453638646edocument
MD5:FFBBE9516CFA3BF9DA3363453638646E
SHA256:A7534CC30B085D7F01872319145055E5F67AFE707FD19DC2B139589F1A38FB98
2984WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:FC835F5AADC6629D148D49C9AE74027D
SHA256:6EE003912B9DD541AC3C5B45FA18C116878BE15E663CDF29B44CB8760F4E9D17
2984WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:684E98A734CE6F2CBDCAEC53C43241DA
SHA256:125EDB2D6C7175925AACDF2B4C906AF0DC9AE7F3F9C4CF14502345C599311063
2984WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lextext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
6
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1160
LOXCWM.exe
POST
—
107.175.111.216:80
http://www.timerscreensvaerbuilders.online/seed/Panel/five/fre.php
US
—
—
malicious
1160
LOXCWM.exe
POST
—
107.175.111.216:80
http://www.timerscreensvaerbuilders.online/seed/Panel/five/fre.php
US
—
—
malicious
1160
LOXCWM.exe
POST
—
107.175.111.216:80
http://www.timerscreensvaerbuilders.online/seed/Panel/five/fre.php
US
—
—
malicious
1160
LOXCWM.exe
POST
—
107.175.111.216:80
http://www.timerscreensvaerbuilders.online/seed/Panel/five/fre.php
US
—
—
malicious
1160
LOXCWM.exe
POST
—
107.175.111.216:80
http://www.timerscreensvaerbuilders.online/seed/Panel/five/fre.php
US
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
107.175.111.216:80
www.timerscreensvaerbuilders.online
ColoCrossing
US
malicious
1160
LOXCWM.exe
107.175.111.216:80
www.timerscreensvaerbuilders.online
ColoCrossing
US
malicious
2984
WINWORD.EXE
185.103.97.212:443
www.nilemixitupd.biz.pl
UK Dedicated Servers Limited
GB
suspicious

DNS requests

Domain
IP
Reputation
www.nilemixitupd.biz.pl
  • 185.103.97.212
suspicious
www.timerscreensvaerbuilders.online
  • 107.175.111.216
malicious

Threats

PID
Process
Class
Message
1160
LOXCWM.exe
A Network Trojan was detected
ET TROJAN LokiBot User-Agent (Charon/Inferno)
1160
LOXCWM.exe
A Network Trojan was detected
ET TROJAN LokiBot Checkin
1160
LOXCWM.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1
1160
LOXCWM.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2
1160
LOXCWM.exe
A Network Trojan was detected
MALWARE [PTsecurity] Loki Bot Check-in M2
1160
LOXCWM.exe
A Network Trojan was detected
ET TROJAN LokiBot User-Agent (Charon/Inferno)
1160
LOXCWM.exe
A Network Trojan was detected
ET TROJAN LokiBot Checkin
1160
LOXCWM.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1
1160
LOXCWM.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2
1160
LOXCWM.exe
A Network Trojan was detected
MALWARE [PTsecurity] Loki Bot Check-in M2
5 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
ffbbe9516cfa3bf9da3363453638646e.zip