analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

5bd8e544a1db75509055b11b9751931f42ea207b.xls

Full analysis: https://app.any.run/tasks/122035be-24c1-4c7f-82b3-45b8c8b39297
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: September 30, 2020, 10:49:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
loader
trojan
lokibot
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: DELL, Last Saved By: DELL, Create Time/Date: Wed Sep 30 09:38:18 2020, Last Saved Time/Date: Wed Sep 30 09:38:18 2020, Security: 0
MD5:

6069606D459D41B23C3158CF3E8FC10C

SHA1:

5BD8E544A1DB75509055B11B9751931F42EA207B

SHA256:

CED1AF6AAE3C0CEF124B060ABD5FF6EAB7669D6FC32CF65601B23136D741BC49

SSDEEP:

6144:Pk3hOdsylKlgryzc4bNhZF+E+W2kn/8u0keNXFL318Aeu3bjbAOiOEc8ICtLtBDI:Hu03NXB31lf7jnEnIgLt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executable content was dropped or overwritten

      • EXCEL.EXE (PID: 2572)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 2572)

    • Loads dropped or rewritten executable

      • svchost32.exe (PID: 2444)
      • osign.exe (PID: 3268)

    • Downloads executable files from IP

      • EXCEL.EXE (PID: 2572)

    • Requests a remote executable file from MS Office

      • EXCEL.EXE (PID: 2572)

    • Application was dropped or rewritten from another process

      • svchost32.exe (PID: 2444)
      • osign.exe (PID: 3268)
      • AddInProcess32.exe (PID: 3700)

    • Changes the autorun value in the registry

      • reg.exe (PID: 780)

    • LOKIBOT was detected

      • AddInProcess32.exe (PID: 3700)

    • Connects to CnC server

      • AddInProcess32.exe (PID: 3700)

    • Actions looks like stealing of personal data

      • AddInProcess32.exe (PID: 3700)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • svchost32.exe (PID: 2444)

    • Executable content was dropped or overwritten

      • svchost32.exe (PID: 2444)
      • AddInProcess32.exe (PID: 3700)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 3780)

    • Starts itself from another location

      • svchost32.exe (PID: 2444)

    • Loads DLL from Mozilla Firefox

      • AddInProcess32.exe (PID: 3700)

    • Creates files in the user directory

      • AddInProcess32.exe (PID: 3700)

    • Connects to server without host name

      • AddInProcess32.exe (PID: 3700)

  • INFO

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 2572)

    • Creates files in the user directory

      • EXCEL.EXE (PID: 2572)

    • Reads Internet Cache Settings

      • EXCEL.EXE (PID: 2572)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (48)
.xls | Microsoft Excel sheet (alternate) (39.2)

EXIF

FlashPix

Author: DELL
LastModifiedBy: DELL
CreateDate: 2020:09:30 08:38:18
ModifyDate: 2020:09:30 08:38:18
Security: None
CodePage: Windows Latin 1 (Western European)
AppVersion: 15
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: Sheet 1
HeadingPairs:
  • Worksheets
  • 1
CompObjUserTypeLen: 31
CompObjUserType: Microsoft Excel 2003 Worksheet
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start excel.exe svchost32.exe cmd.exe no specs reg.exe osign.exe no specs #LOKIBOT addinprocess32.exe

Process information

PID
CMD
Path
Indicators
Parent process
2572"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
2444"C:\Users\Public\svchost32.exe" C:\Users\Public\svchost32.exe
EXCEL.EXE
User:
admin
Company:
r;24a,#0f5s]u
Integrity Level:
MEDIUM
Description:
u,78r&]5zx(1*6do_0)4t
Exit code:
0
Version:
1.1.2.2
3780"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v sobm /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\admin\osign.exe"C:\Windows\system32\cmd.exe—svchost32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
780REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v sobm /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\admin\osign.exe"C:\Windows\system32\reg.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3268"C:\Users\admin\osign.exe" C:\Users\admin\osign.exe—svchost32.exe
User:
admin
Company:
r;24a,#0f5s]u
Integrity Level:
MEDIUM
Description:
u,78r&]5zx(1*6do_0)4t
Exit code:
0
Version:
1.1.2.2
3700"C:\Users\admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\admin\AppData\Local\Temp\AddInProcess32.exe
osign.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
AddInProcess.exe
Version:
4.7.3062.0 built by: NET472REL1
Total events
903
Read events
836
Write events
0
Delete events
0

Modification events

No data
Executable files
6
Suspicious files
0
Text files
3
Unknown types
3

Dropped files

PID
Process
Filename
Type
2572EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRAB45.tmp.cvr —
MD5:—
SHA256:—
3700AddInProcess32.exeC:\Users\admin\AppData\Roaming\F63AAA\A71D80.lck —
MD5:—
SHA256:—
2572EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\5bd8e544a1db75509055b11b9751931f42ea207b.xls.LNKlnk
MD5:8BD349594F73C3BEBC9D3CAAAC47481D
SHA256:1FE4CA57ACCDA4FC4BDAA774C2F6DBA1857DC28E72E6DD3C8F9E18F3789B34BE
3700AddInProcess32.exeC:\Users\admin\AppData\Roaming\F63AAA\A71D80.hdbtext
MD5:5302B1B5EC232D44E2D9507FB847FC49
SHA256:20B58A25872B1E3F7D47DAE0C090ACF229C49B6E33939934513499CC37BB2684
2444svchost32.exeC:\Users\admin\osign.exeexecutable
MD5:4CB5E600C0A4CF0452737E2F476B9848
SHA256:CAB9A80193D8DE8880695FF176379CC4E3378A3F0BC901A973C8D2CF419ED920
2572EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\DFI-6339[1].jpgexecutable
MD5:4CB5E600C0A4CF0452737E2F476B9848
SHA256:CAB9A80193D8DE8880695FF176379CC4E3378A3F0BC901A973C8D2CF419ED920
2572EXCEL.EXEC:\Users\Public\svchost32.exeexecutable
MD5:4CB5E600C0A4CF0452737E2F476B9848
SHA256:CAB9A80193D8DE8880695FF176379CC4E3378A3F0BC901A973C8D2CF419ED920
2444svchost32.exeC:\Users\admin\AppData\Local\Temp\a6a0b8a6-4761-4357-9a31-0eca6ad70093\f.dllexecutable
MD5:14FF402962AD21B78AE0B4C43CD1F194
SHA256:FB9646CB956945BDC503E69645F6B5316D3826B780D3C36738D6B944E884D15B
2572EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:3EDB387E212EBE9D107C7089B5427116
SHA256:10FF7C35009470B08A5D783DE1D78F95E41DAF583B4928EB8FFCAE917E169EF3
3700AddInProcess32.exeC:\Users\admin\AppData\Roaming\F63AAA\A71D80.exeexecutable
MD5:6A673BFC3B67AE9782CB31AF2F234C68
SHA256:978A4093058AA2EBF05DC353897D90D950324389879B57741B64160825B5EC0E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2572
EXCEL.EXE
GET
200
185.33.85.52:80
http://185.33.85.52/FR/DFI-6339.jpg
GB
executable
280 Kb
malicious
3700
AddInProcess32.exe
POST
404
192.236.199.171:80
http://192.236.199.171/7/m3/cgi.php
US
text
15 b
malicious
3700
AddInProcess32.exe
POST
404
192.236.199.171:80
http://192.236.199.171/7/m3/cgi.php
US
text
15 b
malicious
3700
AddInProcess32.exe
POST
404
192.236.199.171:80
http://192.236.199.171/7/m3/cgi.php
US
binary
23 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3700
AddInProcess32.exe
192.236.199.171:80
—
Hostwinds LLC.
US
malicious
2572
EXCEL.EXE
185.33.85.52:80
—
—
GB
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
2572
EXCEL.EXE
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
3700
AddInProcess32.exe
A Network Trojan was detected
ET TROJAN LokiBot User-Agent (Charon/Inferno)
3700
AddInProcess32.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1
3700
AddInProcess32.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2
3700
AddInProcess32.exe
A Network Trojan was detected
ET TROJAN LokiBot Checkin
3700
AddInProcess32.exe
A Network Trojan was detected
MALWARE [PTsecurity] Loki Bot Check-in M2
3700
AddInProcess32.exe
A Network Trojan was detected
ET TROJAN LokiBot User-Agent (Charon/Inferno)
3700
AddInProcess32.exe
A Network Trojan was detected
ET TROJAN LokiBot Checkin
3700
AddInProcess32.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1
3700
AddInProcess32.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
5bd8e544a1db75509055b11b9751931f42ea207b.xls