analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

purchase Invoice.doc

Full analysis: https://app.any.run/tasks/7668ceb9-dce2-48e6-940e-b96ea97ab5f7
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 06, 2018, 05:33:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
opendir
exploit
CVE-2017-11882
loader
trojan
lokibot
Indicators:
MIME: text/rtf
File info: Rich Text Format data, unknown version
MD5:

389AF187AF6664D49040864A0F991EE3

SHA1:

E0D22EAEC4A4FB2EC73B30D19C8741C9C8AE2442

SHA256:

E74F6C5FB9E5F2AF4DD993A1001C4E661E9520E6F4DC0EAED0713CA96764D78E

SSDEEP:

96:JzBRzvXTjoJDic1dsNumo49K3s7X3tX7hOE:JVpDcJGc1dsNuOKEnhME

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • icq_s.exe (PID: 2332)
      • RegAsm.exe (PID: 2960)

    • Detected artifacts of LokiBot

      • RegAsm.exe (PID: 2960)

    • Suspicious connection from the Equation Editor

      • EQNEDT32.EXE (PID: 1716)

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 1716)

    • Downloads executable files from the Internet

      • EQNEDT32.EXE (PID: 1716)

    • Connects to CnC server

      • RegAsm.exe (PID: 2960)

    • LOKIBOT was detected

      • RegAsm.exe (PID: 2960)

    • Actions looks like stealing of personal data

      • RegAsm.exe (PID: 2960)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 1716)
      • RegAsm.exe (PID: 2960)

    • Creates files in the user directory

      • RegAsm.exe (PID: 2960)
      • EQNEDT32.EXE (PID: 1716)

  • INFO

    • Reads the machine GUID from the registry

      • WINWORD.EXE (PID: 2204)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2204)

    • Dropped object may contain Bitcoin addresses

      • EQNEDT32.EXE (PID: 1716)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2204)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winword.exe no specs eqnedt32.exe icq_s.exe #LOKIBOT regasm.exe

Process information

PID
CMD
Path
Indicators
Parent process
2204"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\purchase Invoice.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.5123.5000
1716"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
2332C:\Users\admin\AppData\Roaming\icq_s.exeC:\Users\admin\AppData\Roaming\icq_s.exe
EQNEDT32.EXE
User:
admin
Company:
Limited Inc.
Integrity Level:
MEDIUM
Description:
Reduce backup recovery time
Exit code:
0
Version:
9.13.2.4
2960"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
icq_s.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
4.6.1055.0 built by: NETFXREL2
Total events
1 045
Read events
685
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
0
Text files
3
Unknown types
5

Dropped files

PID
Process
Filename
Type
2204WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRB7A5.tmp.cvr —
MD5:—
SHA256:—
2960RegAsm.exeC:\Users\admin\AppData\Roaming\03B51E\EE03AE.lck —
MD5:—
SHA256:—
2204WINWORD.EXEC:\Users\admin\Desktop\~$rchase Invoice.docpgc
MD5:0BE834B8189CB4C97F0C74E8A3A1829E
SHA256:60C5AB5E7D05630B276F387AA28CF6C76D15B97932B95147AE57C30CE916CB3F
1716EQNEDT32.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\dhl[1].exeexecutable
MD5:113FD12ACE24005A215D82A3CA94AE75
SHA256:59B8452CBFB749A13BDAE459431E6B54B5ECD76291CBD2D54F013FF6A33E4E9A
2204WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\purchase Invoice.LNKlnk
MD5:899631ACFD80B502F48FC1CFD60E6945
SHA256:20A349530D2B8CF21095D160A99B1FF3C5DE8CC9D4A3B24A51018FC520F9D67B
2204WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:91645511A973F39D24CD19121A7F7FF0
SHA256:B62FE2757FC11D0B7DE7B4CE1018C59FB0B6C08F7CCE57C9CCC97593C3733BFF
1716EQNEDT32.EXEC:\Users\admin\AppData\Roaming\icq_s.exeexecutable
MD5:113FD12ACE24005A215D82A3CA94AE75
SHA256:59B8452CBFB749A13BDAE459431E6B54B5ECD76291CBD2D54F013FF6A33E4E9A
2960RegAsm.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3896776584-4254864009-862391680-1000\0f5007522459c86e95ffcc62f32308f1_eeeb5d54-7880-42a7-b542-739bbc26cf4bdbf
MD5:18B8CFC0185C50383AAC0A4F30A9DAC8
SHA256:913E8CED6A447FE791954D382ABA52D490513C5D2F689B391866C7E561F89A03
2960RegAsm.exeC:\Users\admin\AppData\Roaming\03B51E\EE03AE.hdbtext
MD5:220587F98330ADC8265A38DEF5AE6698
SHA256:06EADF590BA1AC74617FA0D4F21733155826DD72D0F0EFFD068F308182B78E8F
2960RegAsm.exeC:\Users\admin\AppData\Roaming\03B51E\EE03AE.exeexecutable
MD5:911BDF77EB94E48CA524252A3FD47019
SHA256:A07564A8771DAFA3EBE9ACEAA20C327EFA2D0AC2EDC06B2BBC3EEBDC66600641
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
5
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2960
RegAsm.exe
POST
—
148.66.138.140:80
http://hriata.com/wp-content/languages/Panel/five/fre.php
SG
—
—
malicious
2960
RegAsm.exe
POST
—
148.66.138.140:80
http://hriata.com/wp-content/languages/Panel/five/fre.php
SG
—
—
malicious
1716
EQNEDT32.EXE
GET
200
198.54.114.227:80
http://interraniternational.com/docfle/dhl.exe
US
executable
476 Kb
malicious
2960
RegAsm.exe
POST
—
148.66.138.140:80
http://hriata.com/wp-content/languages/Panel/five/fre.php
SG
—
—
malicious
2960
RegAsm.exe
POST
—
148.66.138.140:80
http://hriata.com/wp-content/languages/Panel/five/fre.php
SG
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1716
EQNEDT32.EXE
198.54.114.227:80
interraniternational.com
Namecheap, Inc.
US
malicious
2960
RegAsm.exe
148.66.138.140:80
hriata.com
GoDaddy.com, LLC
SG
malicious

DNS requests

Domain
IP
Reputation
interraniternational.com
  • 198.54.114.227
malicious
hriata.com
  • 148.66.138.140
malicious

Threats

PID
Process
Class
Message
1716
EQNEDT32.EXE
Potentially Bad Traffic
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
1716
EQNEDT32.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2960
RegAsm.exe
A Network Trojan was detected
ET TROJAN LokiBot User-Agent (Charon/Inferno)
2960
RegAsm.exe
A Network Trojan was detected
ET TROJAN LokiBot Checkin
2960
RegAsm.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1
2960
RegAsm.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2
2960
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] Loki Bot Check-in M2
2960
RegAsm.exe
A Network Trojan was detected
ET TROJAN LokiBot User-Agent (Charon/Inferno)
2960
RegAsm.exe
A Network Trojan was detected
ET TROJAN LokiBot Checkin
2960
RegAsm.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1
4 ETPRO signatures available at the full report
Process
Message
icq_s.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1391
icq_s.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\identityauthority.cpp, line 278
icq_s.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1391
icq_s.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\identityauthority.cpp, line 278
icq_s.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1391
icq_s.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\identityauthority.cpp, line 278
icq_s.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1391
icq_s.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\identityauthority.cpp, line 278
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
purchase Invoice.doc