Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

FedEx Rece...43.exe

windows7-x64

10

FedEx Rece...43.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    135s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/05/2023, 05:09 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    FedEx Receipt_AWB#530532320463143.exe

  • Size

    480KB

  • MD5

    383763d02b0bfdbfd9e26d2416b3aa13

  • SHA1

    813be123bd83f8ce5ec43c1777b5a08d237c417a

  • SHA256

    c8e8f7f75e522acef9134c34a0d74ad0f3e7c52d28aeb890823e506f7bd71597

  • SHA512

    8b2d7664776723ee53cee3ae31c96418c00ffe10e11cd30cdf3ef9a2267a3353b25206eef8a76893bfe5912d9e518ec5e6a346f5a548b0326419788290f6d41a

  • SSDEEP

    12288:hU4JJTDLDlY6XR+P9zEBOrBq92O6YrcY/t:hLrTX/kBEB8O6YrN/

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://104.156.227.195/~blog/?p=8487516010

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FedEx Receipt_AWB#530532320463143.exe
    "C:\Users\Admin\AppData\Local\Temp\FedEx Receipt_AWB#530532320463143.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1836
    • C:\Users\Admin\AppData\Local\Temp\FedEx Receipt_AWB#530532320463143.exe
      "C:\Users\Admin\AppData\Local\Temp\FedEx Receipt_AWB#530532320463143.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:3600

Network

  • flag-us
    DNS
    42.220.44.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    42.220.44.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    14.103.197.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.103.197.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    41.110.16.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    41.110.16.96.in-addr.arpa
    IN PTR
    Response
    41.110.16.96.in-addr.arpa
    IN PTR
    a96-16-110-41deploystaticakamaitechnologiescom
  • flag-us
    POST
    http://104.156.227.195/~blog/?p=8487516010
    FedEx Receipt_AWB#530532320463143.exe
    Remote address:
    104.156.227.195:80
    Request
    POST /~blog/?p=8487516010 HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: 104.156.227.195
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: 757CCB9E
    Content-Length: 358
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Date: Wed, 10 May 2023 05:10:45 GMT
    Server: Apache
    Expires: Wed, 11 Jan 1984 05:00:00 GMT
    Cache-Control: no-cache, must-revalidate, max-age=0
    Link: <https://blog.io/index.php?rest_route=/>; rel="https://api.w.org/"
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • flag-us
    DNS
    195.227.156.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    195.227.156.104.in-addr.arpa
    IN PTR
    Response
    195.227.156.104.in-addr.arpa
    IN PTR
    104156227195vultrusercontentcom
  • flag-us
    POST
    http://104.156.227.195/~blog/?p=8487516010
    FedEx Receipt_AWB#530532320463143.exe
    Remote address:
    104.156.227.195:80
    Request
    POST /~blog/?p=8487516010 HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: 104.156.227.195
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: 757CCB9E
    Content-Length: 180
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Date: Wed, 10 May 2023 05:10:46 GMT
    Server: Apache
    Expires: Wed, 11 Jan 1984 05:00:00 GMT
    Cache-Control: no-cache, must-revalidate, max-age=0
    Link: <https://blog.io/index.php?rest_route=/>; rel="https://api.w.org/"
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • flag-us
    POST
    http://104.156.227.195/~blog/?p=8487516010
    FedEx Receipt_AWB#530532320463143.exe
    Remote address:
    104.156.227.195:80
    Request
    POST /~blog/?p=8487516010 HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: 104.156.227.195
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: 757CCB9E
    Content-Length: 153
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Date: Wed, 10 May 2023 05:10:48 GMT
    Server: Apache
    Expires: Wed, 11 Jan 1984 05:00:00 GMT
    Cache-Control: no-cache, must-revalidate, max-age=0
    Link: <https://blog.io/index.php?rest_route=/>; rel="https://api.w.org/"
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • flag-us
    DNS
    64.13.109.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    64.13.109.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    POST
    http://104.156.227.195/~blog/?p=8487516010
    FedEx Receipt_AWB#530532320463143.exe
    Remote address:
    104.156.227.195:80
    Request
    POST /~blog/?p=8487516010 HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: 104.156.227.195
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: 757CCB9E
    Content-Length: 153
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Date: Wed, 10 May 2023 05:11:49 GMT
    Server: Apache
    Expires: Wed, 11 Jan 1984 05:00:00 GMT
    Cache-Control: no-cache, must-revalidate, max-age=0
    Link: <https://blog.io/index.php?rest_route=/>; rel="https://api.w.org/"
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • 40.125.122.176:443
    260 B
     5
  • 40.125.122.176:443
    260 B
     5
  • 40.125.122.176:443
    260 B
     5
  • 104.156.227.195:80
    http://104.156.227.195/~blog/?p=8487516010
    http
    FedEx Receipt_AWB#530532320463143.exe
    1.4kB
     15.9kB
     17
    16

    HTTP Request

    POST http://104.156.227.195/~blog/?p=8487516010

    HTTP Response

    404
  • 104.156.227.195:80
    http://104.156.227.195/~blog/?p=8487516010
    http
    FedEx Receipt_AWB#530532320463143.exe
    1.2kB
     15.9kB
     17
    16

    HTTP Request

    POST http://104.156.227.195/~blog/?p=8487516010

    HTTP Response

    404
  • 104.156.227.195:80
    http://104.156.227.195/~blog/?p=8487516010
    http
    FedEx Receipt_AWB#530532320463143.exe
    1.2kB
     15.9kB
     17
    16

    HTTP Request

    POST http://104.156.227.195/~blog/?p=8487516010

    HTTP Response

    404
  • 40.125.122.176:443
    260 B
     5
  • 40.125.122.176:443
    260 B
     5
  • 40.125.122.176:443
    260 B
     5
  • 40.125.122.176:443
    260 B
     5
  • 209.197.3.8:80
    322 B
     7
  • 209.197.3.8:80
    322 B
     7
  • 40.125.122.176:443
    260 B
     5
  • 40.125.122.176:443
    260 B
     5
  • 104.156.227.195:80
    http://104.156.227.195/~blog/?p=8487516010
    http
    FedEx Receipt_AWB#530532320463143.exe
    1.2kB
     15.9kB
     17
    16

    HTTP Request

    POST http://104.156.227.195/~blog/?p=8487516010

    HTTP Response

    404
  • 40.125.122.176:443
    260 B
     5
  • 40.125.122.176:443
    260 B
     5
  • 40.125.122.176:443
    260 B
     5
  • 40.125.122.176:443
    208 B
     4
  • 8.8.8.8:53
    42.220.44.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    42.220.44.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    14.103.197.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    14.103.197.20.in-addr.arpa

  • 8.8.8.8:53
    41.110.16.96.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    41.110.16.96.in-addr.arpa

  • 8.8.8.8:53
    195.227.156.104.in-addr.arpa
    dns
    74 B
     124 B
     1
    1

    DNS Request

    195.227.156.104.in-addr.arpa

  • 8.8.8.8:53
    64.13.109.52.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    64.13.109.52.in-addr.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1529757233-3489015626-3409890339-1000\0f5007522459c86e95ffcc62f32308f1_2007c659-eb65-4631-bf41-16f7650120a3
    Filesize

    46B

    MD5

    d898504a722bff1524134c6ab6a5eaa5

    SHA1

    e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

    SHA256

    878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

    SHA512

    26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1529757233-3489015626-3409890339-1000\0f5007522459c86e95ffcc62f32308f1_2007c659-eb65-4631-bf41-16f7650120a3
    Filesize

    46B

    MD5

    c07225d4e7d01d31042965f048728a0a

    SHA1

    69d70b340fd9f44c89adb9a2278df84faa9906b7

    SHA256

    8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

    SHA512

    23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

    Download Submit

  • memory/1836-139-0x0000000004DF0000-0x0000000004E00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1836-136-0x0000000004E00000-0x0000000004FA6000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/1836-137-0x00000000026F0000-0x00000000026FA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/1836-138-0x0000000004DF0000-0x0000000004E00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1836-133-0x0000000000240000-0x00000000002BE000-memory.dmp

    Filesize

    504KB

    Download

  • memory/1836-140-0x0000000007B90000-0x0000000007C2C000-memory.dmp

    Filesize

    624KB

    Download

  • memory/1836-135-0x0000000004B80000-0x0000000004C12000-memory.dmp

    Filesize

    584KB

    Download

  • memory/1836-134-0x0000000005130000-0x00000000056D4000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/3600-141-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

    Download

  • memory/3600-144-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

    Download

  • memory/3600-145-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

    Download

  • memory/3600-164-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

    Download

  • memory/3600-172-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.