Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
143s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
11/10/2022, 23:05
Static task
static1
Behavioral task
behavioral1
Sample
efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe
Resource
win10-20220812-en
General
-
Target
efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe
-
Size
816KB
-
MD5
689e44f9bba2a5552e0514a61da99951
-
SHA1
9c0216858b4f5285922ec95588e9257f513c21a3
-
SHA256
efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765
-
SHA512
d925f6ea483a67bd56f7ab8a19be181398e3cb29b570e5d98d19718e5cf207e680e858e4957a16571d08e609d7a3f9a6ad4d64e2937ba9577c3e09caaba569dd
-
SSDEEP
12288:l7KkNXmXQ1akD5HALwMLZb1OLXTGC8o5C3ZbvatYYwN:pFe3k27OLSC8QC3xvatY
Malware Config
Extracted
lokibot
http://208.67.105.162/smart/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3068 set thread context of 1068 3068 efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe 69 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3068 efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe 3068 efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe 3068 efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe 3068 efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1068 efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3068 efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe Token: SeDebugPrivilege 1068 efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3068 wrote to memory of 3628 3068 efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe 67 PID 3068 wrote to memory of 3628 3068 efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe 67 PID 3068 wrote to memory of 3628 3068 efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe 67 PID 3068 wrote to memory of 1148 3068 efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe 68 PID 3068 wrote to memory of 1148 3068 efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe 68 PID 3068 wrote to memory of 1148 3068 efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe 68 PID 3068 wrote to memory of 1068 3068 efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe 69 PID 3068 wrote to memory of 1068 3068 efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe 69 PID 3068 wrote to memory of 1068 3068 efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe 69 PID 3068 wrote to memory of 1068 3068 efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe 69 PID 3068 wrote to memory of 1068 3068 efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe 69 PID 3068 wrote to memory of 1068 3068 efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe 69 PID 3068 wrote to memory of 1068 3068 efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe 69 PID 3068 wrote to memory of 1068 3068 efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe 69 PID 3068 wrote to memory of 1068 3068 efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe 69 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe"C:\Users\Admin\AppData\Local\Temp\efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe"C:\Users\Admin\AppData\Local\Temp\efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe"2⤵PID:3628
-
-
C:\Users\Admin\AppData\Local\Temp\efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe"C:\Users\Admin\AppData\Local\Temp\efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe"2⤵PID:1148
-
-
C:\Users\Admin\AppData\Local\Temp\efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe"C:\Users\Admin\AppData\Local\Temp\efa016eb601e61ae4b8df2cedcca68be7019d2b6e6a37b3a69b8f92d7c798765.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1068
-