Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
04/09/2023, 03:55 UTC
Static task
static1
Behavioral task
behavioral1
Sample
ABDETYBF.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
ABDETYBF.exe
Resource
win10v2004-20230831-en
General
-
Target
ABDETYBF.exe
-
Size
783KB
-
MD5
dd32fbe95047642376227127eaffe815
-
SHA1
8d2c3539b0307816c4e0d447cb5b577cb6e15c07
-
SHA256
e800a3ce2466445ee0414d5eeb436cbc23c580fd8eae4c61e6f092bf3f2992c8
-
SHA512
97645a91ca1219a221ef60083adbbc07f4706030f5bc0669965fa3e53881c3422ae2aac0eb14d0dce7470ff7f06e2987d33bc7f1ee03aae93b34fa3ff81cdd49
-
SSDEEP
24576:yNA3R5drXP0lV4LIqzSVq1r+w/URexTF2+:L5OZzAr+0UExB1
Malware Config
Extracted
lokibot
http://fiorentcamcycle.redirectme.net/jzdgfsh/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2624 AhmetOdem.exe 2748 Ahmetoiuv.exe 2128 Ahmetoiuv.exe -
Loads dropped DLL 8 IoCs
pid Process 2976 ABDETYBF.exe 2976 ABDETYBF.exe 2976 ABDETYBF.exe 2976 ABDETYBF.exe 2976 ABDETYBF.exe 2976 ABDETYBF.exe 2976 ABDETYBF.exe 2748 Ahmetoiuv.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook Ahmetoiuv.exe Key opened \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Ahmetoiuv.exe Key opened \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Ahmetoiuv.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2748 set thread context of 2128 2748 Ahmetoiuv.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2748 Ahmetoiuv.exe Token: SeDebugPrivilege 2128 Ahmetoiuv.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2784 DllHost.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2976 wrote to memory of 2624 2976 ABDETYBF.exe 28 PID 2976 wrote to memory of 2624 2976 ABDETYBF.exe 28 PID 2976 wrote to memory of 2624 2976 ABDETYBF.exe 28 PID 2976 wrote to memory of 2624 2976 ABDETYBF.exe 28 PID 2976 wrote to memory of 2748 2976 ABDETYBF.exe 29 PID 2976 wrote to memory of 2748 2976 ABDETYBF.exe 29 PID 2976 wrote to memory of 2748 2976 ABDETYBF.exe 29 PID 2976 wrote to memory of 2748 2976 ABDETYBF.exe 29 PID 2748 wrote to memory of 2128 2748 Ahmetoiuv.exe 31 PID 2748 wrote to memory of 2128 2748 Ahmetoiuv.exe 31 PID 2748 wrote to memory of 2128 2748 Ahmetoiuv.exe 31 PID 2748 wrote to memory of 2128 2748 Ahmetoiuv.exe 31 PID 2748 wrote to memory of 2128 2748 Ahmetoiuv.exe 31 PID 2748 wrote to memory of 2128 2748 Ahmetoiuv.exe 31 PID 2748 wrote to memory of 2128 2748 Ahmetoiuv.exe 31 PID 2748 wrote to memory of 2128 2748 Ahmetoiuv.exe 31 PID 2748 wrote to memory of 2128 2748 Ahmetoiuv.exe 31 PID 2748 wrote to memory of 2128 2748 Ahmetoiuv.exe 31 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Ahmetoiuv.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Ahmetoiuv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ABDETYBF.exe"C:\Users\Admin\AppData\Local\Temp\ABDETYBF.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\AhmetOdem.exe"C:\Users\Admin\AppData\Local\Temp\AhmetOdem.exe"2⤵
- Executes dropped EXE
PID:2624
-
-
C:\Users\Admin\AppData\Local\Temp\Ahmetoiuv.exe"C:\Users\Admin\AppData\Local\Temp\Ahmetoiuv.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\Ahmetoiuv.exeC:\Users\Admin\AppData\Local\Temp\Ahmetoiuv.exe3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2128
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
PID:2784
Network
-
Remote address:8.8.8.8:53Requestfiorentcamcycle.redirectme.netIN AResponsefiorentcamcycle.redirectme.netIN A193.42.32.242
-
Remote address:193.42.32.242:80RequestPOST /jzdgfsh/Panel/five/fre.php HTTP/1.0
User-Agent: Mozilla/4.08 (Charon; Inferno)
Host: fiorentcamcycle.redirectme.net
Accept: */*
Content-Type: application/octet-stream
Content-Encoding: binary
Content-Key: 75A7396A
Content-Length: 374
Connection: close
ResponseHTTP/1.1 502 Bad Gateway
Date: Mon, 04 Sep 2023 03:55:45 GMT
Content-Type: text/html
Content-Length: 3695
Connection: close
ETag: "5cd12124-e6f"
-
Remote address:193.42.32.242:80RequestPOST /jzdgfsh/Panel/five/fre.php HTTP/1.0
User-Agent: Mozilla/4.08 (Charon; Inferno)
Host: fiorentcamcycle.redirectme.net
Accept: */*
Content-Type: application/octet-stream
Content-Encoding: binary
Content-Key: 75A7396A
Content-Length: 180
Connection: close
ResponseHTTP/1.1 502 Bad Gateway
Date: Mon, 04 Sep 2023 03:55:45 GMT
Content-Type: text/html
Content-Length: 3695
Connection: close
ETag: "5cd12124-e6f"
-
Remote address:193.42.32.242:80RequestPOST /jzdgfsh/Panel/five/fre.php HTTP/1.0
User-Agent: Mozilla/4.08 (Charon; Inferno)
Host: fiorentcamcycle.redirectme.net
Accept: */*
Content-Type: application/octet-stream
Content-Encoding: binary
Content-Key: 75A7396A
Content-Length: 153
Connection: close
ResponseHTTP/1.1 502 Bad Gateway
Date: Mon, 04 Sep 2023 03:55:45 GMT
Content-Type: text/html
Content-Length: 3695
Connection: close
ETag: "5cd12124-e6f"
-
193.42.32.242:80http://fiorentcamcycle.redirectme.net/jzdgfsh/Panel/five/fre.phphttpAhmetoiuv.exe959 B 4.2kB 7 7
HTTP Request
POST http://fiorentcamcycle.redirectme.net/jzdgfsh/Panel/five/fre.phpHTTP Response
502 -
193.42.32.242:80http://fiorentcamcycle.redirectme.net/jzdgfsh/Panel/five/fre.phphttpAhmetoiuv.exe765 B 4.2kB 7 7
HTTP Request
POST http://fiorentcamcycle.redirectme.net/jzdgfsh/Panel/five/fre.phpHTTP Response
502 -
193.42.32.242:80http://fiorentcamcycle.redirectme.net/jzdgfsh/Panel/five/fre.phphttpAhmetoiuv.exe738 B 4.2kB 7 7
HTTP Request
POST http://fiorentcamcycle.redirectme.net/jzdgfsh/Panel/five/fre.phpHTTP Response
502
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
306KB
MD53ffae71fdf23a86018fdf1e1b846eb2d
SHA14d8aaffca026d3a0336d996c21ae392022fcb00c
SHA2565e97214323f0f0b4ca064cce70fcff18e77da7a332bbf78ae811e3a317433b15
SHA512676642223a51258665a981e043a31b929a0b0b39b6c0c7f5d0d109d1da01d7c84426b00f74ca919e5763e155c952018a3fbf10c888c19077b6eccbacec1b9a7b
-
Filesize
306KB
MD53ffae71fdf23a86018fdf1e1b846eb2d
SHA14d8aaffca026d3a0336d996c21ae392022fcb00c
SHA2565e97214323f0f0b4ca064cce70fcff18e77da7a332bbf78ae811e3a317433b15
SHA512676642223a51258665a981e043a31b929a0b0b39b6c0c7f5d0d109d1da01d7c84426b00f74ca919e5763e155c952018a3fbf10c888c19077b6eccbacec1b9a7b
-
Filesize
306KB
MD53ffae71fdf23a86018fdf1e1b846eb2d
SHA14d8aaffca026d3a0336d996c21ae392022fcb00c
SHA2565e97214323f0f0b4ca064cce70fcff18e77da7a332bbf78ae811e3a317433b15
SHA512676642223a51258665a981e043a31b929a0b0b39b6c0c7f5d0d109d1da01d7c84426b00f74ca919e5763e155c952018a3fbf10c888c19077b6eccbacec1b9a7b
-
Filesize
38KB
MD5d012e63ffee27b2f473ec4b0e89080b8
SHA17e7f3d5b27ef2382ff287465d84f81c1092ef046
SHA2566a5e42e58f2b883ca3a2055090649ed8e1af1e7b11bbde4d76d1bfaef3b7a625
SHA5125586baefc85b71170ee224f819854bdb75756e3b22eb4f74f408054dd015db84444d119efa06d8651a8cd6b726ec0d0a442ce503b4caf602645cdfdc6295a414
-
Filesize
293KB
MD539900a5f5037440f1380eb5efbdbd70d
SHA1c661153d06c90c848694819095de0e57bc1bef25
SHA256ddc83d9bbced158709a73d681d451da0d26e861986d1ecf1d53f65d9994bb4c0
SHA51219491d2cf7f7ff796c3b237d8952faa843c8c1016553df60593c853513d856ab12d1f4acb68d4d45b9889c945053c2337b2e04829a4577437c793bf5456a7376
-
Filesize
293KB
MD539900a5f5037440f1380eb5efbdbd70d
SHA1c661153d06c90c848694819095de0e57bc1bef25
SHA256ddc83d9bbced158709a73d681d451da0d26e861986d1ecf1d53f65d9994bb4c0
SHA51219491d2cf7f7ff796c3b237d8952faa843c8c1016553df60593c853513d856ab12d1f4acb68d4d45b9889c945053c2337b2e04829a4577437c793bf5456a7376
-
Filesize
293KB
MD539900a5f5037440f1380eb5efbdbd70d
SHA1c661153d06c90c848694819095de0e57bc1bef25
SHA256ddc83d9bbced158709a73d681d451da0d26e861986d1ecf1d53f65d9994bb4c0
SHA51219491d2cf7f7ff796c3b237d8952faa843c8c1016553df60593c853513d856ab12d1f4acb68d4d45b9889c945053c2337b2e04829a4577437c793bf5456a7376
-
Filesize
293KB
MD539900a5f5037440f1380eb5efbdbd70d
SHA1c661153d06c90c848694819095de0e57bc1bef25
SHA256ddc83d9bbced158709a73d681d451da0d26e861986d1ecf1d53f65d9994bb4c0
SHA51219491d2cf7f7ff796c3b237d8952faa843c8c1016553df60593c853513d856ab12d1f4acb68d4d45b9889c945053c2337b2e04829a4577437c793bf5456a7376
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-686452656-3203474025-4140627569-1000\0f5007522459c86e95ffcc62f32308f1_a38c7804-2682-486a-9c4a-7df759db8800
Filesize46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-686452656-3203474025-4140627569-1000\0f5007522459c86e95ffcc62f32308f1_a38c7804-2682-486a-9c4a-7df759db8800
Filesize46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
-
Filesize
306KB
MD53ffae71fdf23a86018fdf1e1b846eb2d
SHA14d8aaffca026d3a0336d996c21ae392022fcb00c
SHA2565e97214323f0f0b4ca064cce70fcff18e77da7a332bbf78ae811e3a317433b15
SHA512676642223a51258665a981e043a31b929a0b0b39b6c0c7f5d0d109d1da01d7c84426b00f74ca919e5763e155c952018a3fbf10c888c19077b6eccbacec1b9a7b
-
Filesize
306KB
MD53ffae71fdf23a86018fdf1e1b846eb2d
SHA14d8aaffca026d3a0336d996c21ae392022fcb00c
SHA2565e97214323f0f0b4ca064cce70fcff18e77da7a332bbf78ae811e3a317433b15
SHA512676642223a51258665a981e043a31b929a0b0b39b6c0c7f5d0d109d1da01d7c84426b00f74ca919e5763e155c952018a3fbf10c888c19077b6eccbacec1b9a7b
-
Filesize
306KB
MD53ffae71fdf23a86018fdf1e1b846eb2d
SHA14d8aaffca026d3a0336d996c21ae392022fcb00c
SHA2565e97214323f0f0b4ca064cce70fcff18e77da7a332bbf78ae811e3a317433b15
SHA512676642223a51258665a981e043a31b929a0b0b39b6c0c7f5d0d109d1da01d7c84426b00f74ca919e5763e155c952018a3fbf10c888c19077b6eccbacec1b9a7b
-
Filesize
293KB
MD539900a5f5037440f1380eb5efbdbd70d
SHA1c661153d06c90c848694819095de0e57bc1bef25
SHA256ddc83d9bbced158709a73d681d451da0d26e861986d1ecf1d53f65d9994bb4c0
SHA51219491d2cf7f7ff796c3b237d8952faa843c8c1016553df60593c853513d856ab12d1f4acb68d4d45b9889c945053c2337b2e04829a4577437c793bf5456a7376
-
Filesize
293KB
MD539900a5f5037440f1380eb5efbdbd70d
SHA1c661153d06c90c848694819095de0e57bc1bef25
SHA256ddc83d9bbced158709a73d681d451da0d26e861986d1ecf1d53f65d9994bb4c0
SHA51219491d2cf7f7ff796c3b237d8952faa843c8c1016553df60593c853513d856ab12d1f4acb68d4d45b9889c945053c2337b2e04829a4577437c793bf5456a7376
-
Filesize
293KB
MD539900a5f5037440f1380eb5efbdbd70d
SHA1c661153d06c90c848694819095de0e57bc1bef25
SHA256ddc83d9bbced158709a73d681d451da0d26e861986d1ecf1d53f65d9994bb4c0
SHA51219491d2cf7f7ff796c3b237d8952faa843c8c1016553df60593c853513d856ab12d1f4acb68d4d45b9889c945053c2337b2e04829a4577437c793bf5456a7376
-
Filesize
293KB
MD539900a5f5037440f1380eb5efbdbd70d
SHA1c661153d06c90c848694819095de0e57bc1bef25
SHA256ddc83d9bbced158709a73d681d451da0d26e861986d1ecf1d53f65d9994bb4c0
SHA51219491d2cf7f7ff796c3b237d8952faa843c8c1016553df60593c853513d856ab12d1f4acb68d4d45b9889c945053c2337b2e04829a4577437c793bf5456a7376
-
Filesize
293KB
MD539900a5f5037440f1380eb5efbdbd70d
SHA1c661153d06c90c848694819095de0e57bc1bef25
SHA256ddc83d9bbced158709a73d681d451da0d26e861986d1ecf1d53f65d9994bb4c0
SHA51219491d2cf7f7ff796c3b237d8952faa843c8c1016553df60593c853513d856ab12d1f4acb68d4d45b9889c945053c2337b2e04829a4577437c793bf5456a7376