Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    30/05/2023, 07:46

General

  • Target

    DHL doc.exe

  • Size

    1.4MB

  • MD5

    6d4b2188167e36105b407dac8185bf10

  • SHA1

    9777d98556ef004559dc67cd4a600e5b16ceb9be

  • SHA256

    8926f2c51db03fda181f7b020c07b72627f8348c1d9b73d22eefd05ac4a0983f

  • SHA512

    c96d8a1280c268d7fbeec8ae58451e271033c5e4676269ed5bc9ba9a5a84c759a64fb0310d80a8dbc6abd6bb33a2aca37d895472cfa0d4bbfd5de1832afa945a

  • SSDEEP

    24576:pPLaVUH999wnomY9hpGlpO3FvAcZ7CXCXBEfgP2xRyfmSOKC7R4EAzFSC4E/Yzwf:xBH9qomY9hglpcqCXBEfgZfmSOKC7R45

Malware Config

Extracted

Family

lokibot

C2

http://161.35.102.56/~nikol/?p=4479137330

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DHL doc.exe
    "C:\Users\Admin\AppData\Local\Temp\DHL doc.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1232
    • C:\Users\Admin\AppData\Local\Temp\DHL doc.exe
      "C:\Users\Admin\AppData\Local\Temp\DHL doc.exe"
      2⤵
        PID:1280
      • C:\Users\Admin\AppData\Local\Temp\DHL doc.exe
        "C:\Users\Admin\AppData\Local\Temp\DHL doc.exe"
        2⤵
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:696
        • C:\Users\Admin\AppData\Local\Temp\._cache_DHL doc.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_DHL doc.exe"
          3⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious use of AdjustPrivilegeToken
          • outlook_office_path
          • outlook_win_path
          PID:844
        • C:\ProgramData\Synaptics\Synaptics.exe
          "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1008
          • C:\ProgramData\Synaptics\Synaptics.exe
            "C:\ProgramData\Synaptics\Synaptics.exe"
            4⤵
            • Executes dropped EXE
            PID:1288
          • C:\ProgramData\Synaptics\Synaptics.exe
            "C:\ProgramData\Synaptics\Synaptics.exe"
            4⤵
            • Executes dropped EXE
            PID:396
          • C:\ProgramData\Synaptics\Synaptics.exe
            "C:\ProgramData\Synaptics\Synaptics.exe"
            4⤵
            • Executes dropped EXE
            PID:316
          • C:\ProgramData\Synaptics\Synaptics.exe
            "C:\ProgramData\Synaptics\Synaptics.exe"
            4⤵
            • Executes dropped EXE
            PID:1680
          • C:\ProgramData\Synaptics\Synaptics.exe
            "C:\ProgramData\Synaptics\Synaptics.exe"
            4⤵
            • Executes dropped EXE
            PID:1728

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Synaptics\Synaptics.exe

      Filesize

      1.4MB

      MD5

      6d4b2188167e36105b407dac8185bf10

      SHA1

      9777d98556ef004559dc67cd4a600e5b16ceb9be

      SHA256

      8926f2c51db03fda181f7b020c07b72627f8348c1d9b73d22eefd05ac4a0983f

      SHA512

      c96d8a1280c268d7fbeec8ae58451e271033c5e4676269ed5bc9ba9a5a84c759a64fb0310d80a8dbc6abd6bb33a2aca37d895472cfa0d4bbfd5de1832afa945a

    • C:\ProgramData\Synaptics\Synaptics.exe

      Filesize

      1.4MB

      MD5

      6d4b2188167e36105b407dac8185bf10

      SHA1

      9777d98556ef004559dc67cd4a600e5b16ceb9be

      SHA256

      8926f2c51db03fda181f7b020c07b72627f8348c1d9b73d22eefd05ac4a0983f

      SHA512

      c96d8a1280c268d7fbeec8ae58451e271033c5e4676269ed5bc9ba9a5a84c759a64fb0310d80a8dbc6abd6bb33a2aca37d895472cfa0d4bbfd5de1832afa945a

    • C:\ProgramData\Synaptics\Synaptics.exe

      Filesize

      1.4MB

      MD5

      6d4b2188167e36105b407dac8185bf10

      SHA1

      9777d98556ef004559dc67cd4a600e5b16ceb9be

      SHA256

      8926f2c51db03fda181f7b020c07b72627f8348c1d9b73d22eefd05ac4a0983f

      SHA512

      c96d8a1280c268d7fbeec8ae58451e271033c5e4676269ed5bc9ba9a5a84c759a64fb0310d80a8dbc6abd6bb33a2aca37d895472cfa0d4bbfd5de1832afa945a

    • C:\ProgramData\Synaptics\Synaptics.exe

      Filesize

      1.4MB

      MD5

      6d4b2188167e36105b407dac8185bf10

      SHA1

      9777d98556ef004559dc67cd4a600e5b16ceb9be

      SHA256

      8926f2c51db03fda181f7b020c07b72627f8348c1d9b73d22eefd05ac4a0983f

      SHA512

      c96d8a1280c268d7fbeec8ae58451e271033c5e4676269ed5bc9ba9a5a84c759a64fb0310d80a8dbc6abd6bb33a2aca37d895472cfa0d4bbfd5de1832afa945a

    • C:\ProgramData\Synaptics\Synaptics.exe

      Filesize

      1.4MB

      MD5

      6d4b2188167e36105b407dac8185bf10

      SHA1

      9777d98556ef004559dc67cd4a600e5b16ceb9be

      SHA256

      8926f2c51db03fda181f7b020c07b72627f8348c1d9b73d22eefd05ac4a0983f

      SHA512

      c96d8a1280c268d7fbeec8ae58451e271033c5e4676269ed5bc9ba9a5a84c759a64fb0310d80a8dbc6abd6bb33a2aca37d895472cfa0d4bbfd5de1832afa945a

    • C:\ProgramData\Synaptics\Synaptics.exe

      Filesize

      1.4MB

      MD5

      6d4b2188167e36105b407dac8185bf10

      SHA1

      9777d98556ef004559dc67cd4a600e5b16ceb9be

      SHA256

      8926f2c51db03fda181f7b020c07b72627f8348c1d9b73d22eefd05ac4a0983f

      SHA512

      c96d8a1280c268d7fbeec8ae58451e271033c5e4676269ed5bc9ba9a5a84c759a64fb0310d80a8dbc6abd6bb33a2aca37d895472cfa0d4bbfd5de1832afa945a

    • C:\ProgramData\Synaptics\Synaptics.exe

      Filesize

      1.4MB

      MD5

      6d4b2188167e36105b407dac8185bf10

      SHA1

      9777d98556ef004559dc67cd4a600e5b16ceb9be

      SHA256

      8926f2c51db03fda181f7b020c07b72627f8348c1d9b73d22eefd05ac4a0983f

      SHA512

      c96d8a1280c268d7fbeec8ae58451e271033c5e4676269ed5bc9ba9a5a84c759a64fb0310d80a8dbc6abd6bb33a2aca37d895472cfa0d4bbfd5de1832afa945a

    • C:\ProgramData\Synaptics\Synaptics.exe

      Filesize

      1.4MB

      MD5

      6d4b2188167e36105b407dac8185bf10

      SHA1

      9777d98556ef004559dc67cd4a600e5b16ceb9be

      SHA256

      8926f2c51db03fda181f7b020c07b72627f8348c1d9b73d22eefd05ac4a0983f

      SHA512

      c96d8a1280c268d7fbeec8ae58451e271033c5e4676269ed5bc9ba9a5a84c759a64fb0310d80a8dbc6abd6bb33a2aca37d895472cfa0d4bbfd5de1832afa945a

    • C:\Users\Admin\AppData\Local\Temp\._cache_DHL doc.exe

      Filesize

      104KB

      MD5

      3d81dc8162f2c97463d9b4487c2a1308

      SHA1

      98ba9509e131f36742200cd116733c338b4b1971

      SHA256

      e17c72d80c47b69de339dabcea2cb93ebb9a7a98f7f8f78c233d4cec02471aee

      SHA512

      4c806f39bbc55a8cb492be82ce2698059b4ff2c3f5a2bd96293e2123d0fd40fa09fc1f3b01b7b4fa1f3facb60e35add959e9da1ed0a7b1bee2b38b592bb2d892

    • C:\Users\Admin\AppData\Local\Temp\._cache_DHL doc.exe

      Filesize

      104KB

      MD5

      3d81dc8162f2c97463d9b4487c2a1308

      SHA1

      98ba9509e131f36742200cd116733c338b4b1971

      SHA256

      e17c72d80c47b69de339dabcea2cb93ebb9a7a98f7f8f78c233d4cec02471aee

      SHA512

      4c806f39bbc55a8cb492be82ce2698059b4ff2c3f5a2bd96293e2123d0fd40fa09fc1f3b01b7b4fa1f3facb60e35add959e9da1ed0a7b1bee2b38b592bb2d892

    • C:\Users\Admin\AppData\Local\Temp\._cache_dhl doc.exe

      Filesize

      104KB

      MD5

      3d81dc8162f2c97463d9b4487c2a1308

      SHA1

      98ba9509e131f36742200cd116733c338b4b1971

      SHA256

      e17c72d80c47b69de339dabcea2cb93ebb9a7a98f7f8f78c233d4cec02471aee

      SHA512

      4c806f39bbc55a8cb492be82ce2698059b4ff2c3f5a2bd96293e2123d0fd40fa09fc1f3b01b7b4fa1f3facb60e35add959e9da1ed0a7b1bee2b38b592bb2d892

    • \ProgramData\Synaptics\Synaptics.exe

      Filesize

      1.4MB

      MD5

      6d4b2188167e36105b407dac8185bf10

      SHA1

      9777d98556ef004559dc67cd4a600e5b16ceb9be

      SHA256

      8926f2c51db03fda181f7b020c07b72627f8348c1d9b73d22eefd05ac4a0983f

      SHA512

      c96d8a1280c268d7fbeec8ae58451e271033c5e4676269ed5bc9ba9a5a84c759a64fb0310d80a8dbc6abd6bb33a2aca37d895472cfa0d4bbfd5de1832afa945a

    • \ProgramData\Synaptics\Synaptics.exe

      Filesize

      1.4MB

      MD5

      6d4b2188167e36105b407dac8185bf10

      SHA1

      9777d98556ef004559dc67cd4a600e5b16ceb9be

      SHA256

      8926f2c51db03fda181f7b020c07b72627f8348c1d9b73d22eefd05ac4a0983f

      SHA512

      c96d8a1280c268d7fbeec8ae58451e271033c5e4676269ed5bc9ba9a5a84c759a64fb0310d80a8dbc6abd6bb33a2aca37d895472cfa0d4bbfd5de1832afa945a

    • \Users\Admin\AppData\Local\Temp\._cache_DHL doc.exe

      Filesize

      104KB

      MD5

      3d81dc8162f2c97463d9b4487c2a1308

      SHA1

      98ba9509e131f36742200cd116733c338b4b1971

      SHA256

      e17c72d80c47b69de339dabcea2cb93ebb9a7a98f7f8f78c233d4cec02471aee

      SHA512

      4c806f39bbc55a8cb492be82ce2698059b4ff2c3f5a2bd96293e2123d0fd40fa09fc1f3b01b7b4fa1f3facb60e35add959e9da1ed0a7b1bee2b38b592bb2d892

    • \Users\Admin\AppData\Local\Temp\._cache_DHL doc.exe

      Filesize

      104KB

      MD5

      3d81dc8162f2c97463d9b4487c2a1308

      SHA1

      98ba9509e131f36742200cd116733c338b4b1971

      SHA256

      e17c72d80c47b69de339dabcea2cb93ebb9a7a98f7f8f78c233d4cec02471aee

      SHA512

      4c806f39bbc55a8cb492be82ce2698059b4ff2c3f5a2bd96293e2123d0fd40fa09fc1f3b01b7b4fa1f3facb60e35add959e9da1ed0a7b1bee2b38b592bb2d892

    • memory/696-68-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/696-69-0x0000000000400000-0x00000000004DC000-memory.dmp

      Filesize

      880KB

    • memory/696-71-0x0000000000400000-0x00000000004DC000-memory.dmp

      Filesize

      880KB

    • memory/696-74-0x0000000000400000-0x00000000004DC000-memory.dmp

      Filesize

      880KB

    • memory/696-75-0x00000000000E0000-0x00000000000E1000-memory.dmp

      Filesize

      4KB

    • memory/696-61-0x0000000000400000-0x00000000004DC000-memory.dmp

      Filesize

      880KB

    • memory/696-64-0x0000000000400000-0x00000000004DC000-memory.dmp

      Filesize

      880KB

    • memory/696-99-0x0000000000400000-0x00000000004DC000-memory.dmp

      Filesize

      880KB

    • memory/696-70-0x0000000000400000-0x00000000004DC000-memory.dmp

      Filesize

      880KB

    • memory/696-66-0x0000000000400000-0x00000000004DC000-memory.dmp

      Filesize

      880KB

    • memory/696-65-0x0000000000400000-0x00000000004DC000-memory.dmp

      Filesize

      880KB

    • memory/696-63-0x0000000000400000-0x00000000004DC000-memory.dmp

      Filesize

      880KB

    • memory/696-67-0x0000000000400000-0x00000000004DC000-memory.dmp

      Filesize

      880KB

    • memory/696-62-0x0000000000400000-0x00000000004DC000-memory.dmp

      Filesize

      880KB

    • memory/1008-98-0x00000000003D0000-0x0000000000530000-memory.dmp

      Filesize

      1.4MB

    • memory/1008-100-0x0000000004E20000-0x0000000004E60000-memory.dmp

      Filesize

      256KB

    • memory/1008-101-0x0000000000320000-0x0000000000334000-memory.dmp

      Filesize

      80KB

    • memory/1008-105-0x0000000004E20000-0x0000000004E60000-memory.dmp

      Filesize

      256KB

    • memory/1232-54-0x0000000000250000-0x00000000003B0000-memory.dmp

      Filesize

      1.4MB

    • memory/1232-60-0x0000000005B10000-0x0000000005BF0000-memory.dmp

      Filesize

      896KB

    • memory/1232-59-0x0000000005C20000-0x0000000005D2E000-memory.dmp

      Filesize

      1.1MB

    • memory/1232-58-0x0000000000620000-0x000000000062A000-memory.dmp

      Filesize

      40KB

    • memory/1232-57-0x0000000004AB0000-0x0000000004AF0000-memory.dmp

      Filesize

      256KB

    • memory/1232-56-0x0000000000410000-0x0000000000424000-memory.dmp

      Filesize

      80KB

    • memory/1232-55-0x0000000004AB0000-0x0000000004AF0000-memory.dmp

      Filesize

      256KB