Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
114s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
07/07/2020, 12:10
Static task
static1
Behavioral task
behavioral1
Sample
83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe
Resource
win7v200430
General
-
Target
83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe
-
Size
348KB
-
MD5
4ab98a275e83315ab25f376c2500fc00
-
SHA1
bb3e84826ed9dade2311bdb0be60b0f639041ebb
-
SHA256
83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e
-
SHA512
970be824cdb2c76c80f63a23efc056cb13d252d98088a986fbd870909c2cae25d5488c82e3ca5c162a30f3f33256d7f0264414a37bf54052bf4c3a74be712010
Malware Config
Extracted
lokibot
http://bayercornpany.com/php/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1244 83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 784 wrote to memory of 1244 784 83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe 26 PID 784 wrote to memory of 1244 784 83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe 26 PID 784 wrote to memory of 1244 784 83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe 26 PID 784 wrote to memory of 1244 784 83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe 26 PID 784 wrote to memory of 1244 784 83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe 26 PID 784 wrote to memory of 1244 784 83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe 26 PID 784 wrote to memory of 1244 784 83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe 26 PID 784 wrote to memory of 1244 784 83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe 26 PID 784 wrote to memory of 1244 784 83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe 26 PID 784 wrote to memory of 1244 784 83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe 26 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 784 set thread context of 1244 784 83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe 26 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1244 83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe"C:\Users\Admin\AppData\Local\Temp\83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:784 -
C:\Users\Admin\AppData\Local\Temp\83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe"{path}"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1244
-