analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://onedrive.live.com/download?cid=15782FC1157D6AC7&resid=15782FC1157D6AC7%21109&authkey=ADbokiH_3KbVNLI

Full analysis: https://app.any.run/tasks/047dbfb2-189e-488c-999b-5c4ca1813097
Verdict: Malicious activity
Threats:

LokiBot was developed in 2015 to steal information from a variety of applications. Despite the age, this malware is still rather popular among cybercriminals.

Malware Trends Tracker     >>>
Analysis date: June 12, 2019, 07:47:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
lokibot
Indicators:
MD5:

F17146E83131C615E1CFD39E75373E3F

SHA1:

70DBCCD9EC1B1F53E660698E6CE1BF89582DB814

SHA256:

C180566593118C3EA814F091D41DEE3760F6328B0969C53E0E226DCB6DDD750D

SSDEEP:

3:N8Ck3CTwKbl9oCSTPB5QJCST7Apoqjt6WuT9s:2CkST/ZJST04SApoqj6T9s

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Update PO# 3900003328.exe (PID: 3520)
      • Update PO# 3900003328.exe (PID: 2632)
      • Update PO# 3900003328.exe (PID: 2852)

    • Detected artifacts of LokiBot

      • Update PO# 3900003328.exe (PID: 2852)

    • Actions looks like stealing of personal data

      • Update PO# 3900003328.exe (PID: 2852)

  • SUSPICIOUS

    • Creates files in the program directory

      • firefox.exe (PID: 3316)

    • Application launched itself

      • Update PO# 3900003328.exe (PID: 2632)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 912)
      • firefox.exe (PID: 3316)
      • Update PO# 3900003328.exe (PID: 2852)

    • Creates files in the user directory

      • Update PO# 3900003328.exe (PID: 2852)

    • Loads DLL from Mozilla Firefox

      • Update PO# 3900003328.exe (PID: 2852)

  • INFO

    • Reads CPU info

      • firefox.exe (PID: 3316)

    • Application launched itself

      • firefox.exe (PID: 3316)

    • Creates files in the user directory

      • firefox.exe (PID: 3316)

    • Dropped object may contain Bitcoin addresses

      • firefox.exe (PID: 3316)

    • Reads settings of System Certificates

      • firefox.exe (PID: 3316)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
9
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe winrar.exe update po# 3900003328.exe no specs update po# 3900003328.exe #LOKIBOT update po# 3900003328.exe

Process information

PID
CMD
Path
Indicators
Parent process
3316"C:\Program Files\Mozilla Firefox\firefox.exe" https://onedrive.live.com/download?cid=15782FC1157D6AC7&resid=15782FC1157D6AC7%21109&authkey=ADbokiH_3KbVNLIC:\Program Files\Mozilla Firefox\firefox.exe
explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
65.0.2
2956"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3316.0.1491389032\1622747598" -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - "C:\Users\admin\AppData\LocalLow\Mozilla\Temp-{ce348e4c-7d33-445e-89f9-60108c51bcaf}" 3316 "\\.\pipe\gecko-crash-server-pipe.3316" 1112 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
65.0.2
1808"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3316.6.1995306759\233697120" -childID 1 -isForBrowser -prefsHandle 1704 -prefMapHandle 1572 -prefsLen 1 -prefMapSize 180950 -schedulerPrefs 0001,2 -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3316 "\\.\pipe\gecko-crash-server-pipe.3316" 1708 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
65.0.2
2096"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3316.13.2065260777\1516410196" -childID 2 -isForBrowser -prefsHandle 2644 -prefMapHandle 2648 -prefsLen 216 -prefMapSize 180950 -schedulerPrefs 0001,2 -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3316 "\\.\pipe\gecko-crash-server-pipe.3316" 2660 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
65.0.2
3588"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3316.20.11603874\292002168" -childID 3 -isForBrowser -prefsHandle 3224 -prefMapHandle 3384 -prefsLen 5824 -prefMapSize 180950 -schedulerPrefs 0001,2 -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3316 "\\.\pipe\gecko-crash-server-pipe.3316" 3396 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
65.0.2
912"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Update PO# 3900003328.gz"C:\Program Files\WinRAR\WinRAR.exe
firefox.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3520"C:\Users\admin\AppData\Local\Temp\Rar$EXa912.18204\Update PO# 3900003328.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa912.18204\Update PO# 3900003328.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
2632"C:\Users\admin\AppData\Local\Temp\Rar$EXa912.18204\Update PO# 3900003328.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa912.18204\Update PO# 3900003328.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
2852"C:\Users\admin\AppData\Local\Temp\Rar$EXa912.18204\Update PO# 3900003328.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa912.18204\Update PO# 3900003328.exe
Update PO# 3900003328.exe
User:
admin
Integrity Level:
HIGH
Total events
1 719
Read events
1 690
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
73
Text files
32
Unknown types
57

Dropped files

PID
Process
Filename
Type
3316firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
3316firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\cache2\trash8319 —
MD5:—
SHA256:—
3316firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js —
MD5:—
SHA256:—
3316firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.db-journal —
MD5:—
SHA256:—
3316firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp —
MD5:—
SHA256:—
3316firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\cache2\entries\2A7FB49184C162E8391F613817174350B251685Dder
MD5:BCF7F470C56EEF6A6C2A3003874E1A4B
SHA256:E183A00E51333589850FEB3A1FCA956AA2480317429B795B2B2FB4E0681A4747
3316firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.binbinary
MD5:6C32CB3FD01869207E7AAE8B28598F29
SHA256:4F8ECF8007F6CC603991256AACF38224ADBA7D0A16685706072D1AADC0604303
3316firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.dbsqlite
MD5:EEFB951E9354D961F0F77AE3559A7FDB
SHA256:2EB0BD48EE24D1FF7626CD0F35D8E37BCBD89B82FEFDDD22B47DCADB6DB37FEE
3316firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\cache2\entries\EECD53ADA09C1DD3DBE3DDD249D1813D1978DDF3der
MD5:5517CB9E12EB79A7D43DEFD80B99A1BF
SHA256:3628D15B8EC2FFB1B32FEE1C53E43BC73C3A178B48E5E2C2D2FF7C80D8AC561F
3316firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\block-flashsubdoc-digest256.sbstorebinary
MD5:04824A1F92353F43EBB9E7F74B7476FD
SHA256:B48E58EBAB82E4C376F16150A3FFF850C1111FF1F5985D68819CFD6F0DB159D2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
27
DNS requests
119
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3316
firefox.exe
POST
200
172.217.21.195:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3316
firefox.exe
POST
200
172.217.21.195:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3316
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3316
firefox.exe
POST
200
172.217.21.195:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3316
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3316
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3316
firefox.exe
GET
200
2.16.186.50:80
http://detectportal.firefox.com/success.txt
unknown
text
8 b
whitelisted
3316
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3316
firefox.exe
GET
200
2.16.186.50:80
http://detectportal.firefox.com/success.txt
unknown
text
8 b
whitelisted
3316
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3316
firefox.exe
2.16.186.50:80
detectportal.firefox.com
Akamai International B.V.
—
whitelisted
3316
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3316
firefox.exe
35.164.130.113:443
tiles.services.mozilla.com
Amazon.com, Inc.
US
unknown
3316
firefox.exe
54.213.5.202:443
aus5.mozilla.org
Amazon.com, Inc.
US
unknown
3316
firefox.exe
13.107.42.13:443
onedrive.live.com
Microsoft Corporation
US
malicious
3316
firefox.exe
54.190.222.97:443
search.services.mozilla.com
Amazon.com, Inc.
US
malicious
3316
firefox.exe
172.217.22.110:443
sb-ssl.google.com
Google Inc.
US
whitelisted
3316
firefox.exe
172.217.21.195:80
ocsp.pki.goog
Google Inc.
US
whitelisted
3316
firefox.exe
54.186.120.41:443
shavar.services.mozilla.com
Amazon.com, Inc.
US
unknown
3316
firefox.exe
172.217.22.10:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 2.16.186.50
  • 2.16.186.112
whitelisted
onedrive.live.com
  • 13.107.42.13
shared
aus5.mozilla.org
  • 54.213.5.202
  • 52.35.34.27
  • 35.165.116.96
  • 52.34.120.127
  • 52.43.79.30
  • 52.40.226.98
  • 35.161.58.143
  • 34.218.159.169
  • 52.34.127.169
whitelisted
balrog-aus5.r53-2.services.mozilla.com
  • 34.218.159.169
  • 35.161.58.143
  • 52.40.226.98
  • 52.43.79.30
  • 52.34.120.127
  • 35.165.116.96
  • 52.35.34.27
  • 54.213.5.202
  • 52.34.127.169
whitelisted
a1089.dscd.akamai.net
  • 2.16.186.112
  • 2.16.186.50
whitelisted
l-0004.l-msedge.net
  • 13.107.42.13
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
cs9.wac.phicdn.net
  • 93.184.220.29
whitelisted
search.services.mozilla.com
  • 54.190.222.97
  • 52.11.30.237
  • 34.215.70.240
whitelisted
search.r53-2.services.mozilla.com
  • 34.215.70.240
  • 52.11.30.237
  • 54.190.222.97
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://onedrive.live.com/download?cid=15782FC1157D6AC7&resid=15782FC1157D6AC7%21109&authkey=ADbokiH_3KbVNLI