Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
130s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
10/07/2020, 07:20
Static task
static1
Behavioral task
behavioral1
Sample
A148_57890.exe
Resource
win7v200430
0 signatures
0 seconds
General
-
Target
A148_57890.exe
-
Size
692KB
-
MD5
4260854d5c242d69107f49bad604b5c5
-
SHA1
845a5587d32c587c474078ce000d79259f211cd8
-
SHA256
3a147652dab4166c5bb4c35bb3bb74c3688ea072bce481237dfac38d31116f7e
-
SHA512
86f41efbd221cd7ec0de86188eab058b3a5f79bc1f4e0e5e680675ce60103fcef17a7dc5ab33becb6a2797815efa8f48500581eb3d5bc4719b1f65ee226ff66f
Malware Config
Extracted
Family
lokibot
C2
http://amjaog.ml/sethr/logs/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 676 set thread context of 1576 676 A148_57890.exe 24 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1576 A148_57890.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1576 A148_57890.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 676 A148_57890.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 676 wrote to memory of 1576 676 A148_57890.exe 24 PID 676 wrote to memory of 1576 676 A148_57890.exe 24 PID 676 wrote to memory of 1576 676 A148_57890.exe 24 PID 676 wrote to memory of 1576 676 A148_57890.exe 24 -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 676 A148_57890.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\A148_57890.exe"C:\Users\Admin\AppData\Local\Temp\A148_57890.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:676 -
C:\Users\Admin\AppData\Local\Temp\A148_57890.exe"C:\Users\Admin\AppData\Local\Temp\A148_57890.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: RenamesItself
PID:1576
-