Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
04/09/2023, 03:55
Static task
static1
Behavioral task
behavioral1
Sample
ABDETYBF.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
ABDETYBF.exe
Resource
win10v2004-20230831-en
General
-
Target
ABDETYBF.exe
-
Size
783KB
-
MD5
dd32fbe95047642376227127eaffe815
-
SHA1
8d2c3539b0307816c4e0d447cb5b577cb6e15c07
-
SHA256
e800a3ce2466445ee0414d5eeb436cbc23c580fd8eae4c61e6f092bf3f2992c8
-
SHA512
97645a91ca1219a221ef60083adbbc07f4706030f5bc0669965fa3e53881c3422ae2aac0eb14d0dce7470ff7f06e2987d33bc7f1ee03aae93b34fa3ff81cdd49
-
SSDEEP
24576:yNA3R5drXP0lV4LIqzSVq1r+w/URexTF2+:L5OZzAr+0UExB1
Malware Config
Extracted
lokibot
http://fiorentcamcycle.redirectme.net/jzdgfsh/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000\Control Panel\International\Geo\Nation ABDETYBF.exe -
Executes dropped EXE 3 IoCs
pid Process 4592 AhmetOdem.exe 1836 Ahmetoiuv.exe 4044 Ahmetoiuv.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Ahmetoiuv.exe Key opened \REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook Ahmetoiuv.exe Key opened \REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Ahmetoiuv.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1836 set thread context of 4044 1836 Ahmetoiuv.exe 89 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1836 Ahmetoiuv.exe Token: SeDebugPrivilege 4044 Ahmetoiuv.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4064 wrote to memory of 4592 4064 ABDETYBF.exe 85 PID 4064 wrote to memory of 4592 4064 ABDETYBF.exe 85 PID 4064 wrote to memory of 4592 4064 ABDETYBF.exe 85 PID 4064 wrote to memory of 1836 4064 ABDETYBF.exe 87 PID 4064 wrote to memory of 1836 4064 ABDETYBF.exe 87 PID 4064 wrote to memory of 1836 4064 ABDETYBF.exe 87 PID 1836 wrote to memory of 4044 1836 Ahmetoiuv.exe 89 PID 1836 wrote to memory of 4044 1836 Ahmetoiuv.exe 89 PID 1836 wrote to memory of 4044 1836 Ahmetoiuv.exe 89 PID 1836 wrote to memory of 4044 1836 Ahmetoiuv.exe 89 PID 1836 wrote to memory of 4044 1836 Ahmetoiuv.exe 89 PID 1836 wrote to memory of 4044 1836 Ahmetoiuv.exe 89 PID 1836 wrote to memory of 4044 1836 Ahmetoiuv.exe 89 PID 1836 wrote to memory of 4044 1836 Ahmetoiuv.exe 89 PID 1836 wrote to memory of 4044 1836 Ahmetoiuv.exe 89 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Ahmetoiuv.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Ahmetoiuv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ABDETYBF.exe"C:\Users\Admin\AppData\Local\Temp\ABDETYBF.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\AhmetOdem.exe"C:\Users\Admin\AppData\Local\Temp\AhmetOdem.exe"2⤵
- Executes dropped EXE
PID:4592
-
-
C:\Users\Admin\AppData\Local\Temp\Ahmetoiuv.exe"C:\Users\Admin\AppData\Local\Temp\Ahmetoiuv.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\Ahmetoiuv.exeC:\Users\Admin\AppData\Local\Temp\Ahmetoiuv.exe3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4044
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
306KB
MD53ffae71fdf23a86018fdf1e1b846eb2d
SHA14d8aaffca026d3a0336d996c21ae392022fcb00c
SHA2565e97214323f0f0b4ca064cce70fcff18e77da7a332bbf78ae811e3a317433b15
SHA512676642223a51258665a981e043a31b929a0b0b39b6c0c7f5d0d109d1da01d7c84426b00f74ca919e5763e155c952018a3fbf10c888c19077b6eccbacec1b9a7b
-
Filesize
306KB
MD53ffae71fdf23a86018fdf1e1b846eb2d
SHA14d8aaffca026d3a0336d996c21ae392022fcb00c
SHA2565e97214323f0f0b4ca064cce70fcff18e77da7a332bbf78ae811e3a317433b15
SHA512676642223a51258665a981e043a31b929a0b0b39b6c0c7f5d0d109d1da01d7c84426b00f74ca919e5763e155c952018a3fbf10c888c19077b6eccbacec1b9a7b
-
Filesize
306KB
MD53ffae71fdf23a86018fdf1e1b846eb2d
SHA14d8aaffca026d3a0336d996c21ae392022fcb00c
SHA2565e97214323f0f0b4ca064cce70fcff18e77da7a332bbf78ae811e3a317433b15
SHA512676642223a51258665a981e043a31b929a0b0b39b6c0c7f5d0d109d1da01d7c84426b00f74ca919e5763e155c952018a3fbf10c888c19077b6eccbacec1b9a7b
-
Filesize
293KB
MD539900a5f5037440f1380eb5efbdbd70d
SHA1c661153d06c90c848694819095de0e57bc1bef25
SHA256ddc83d9bbced158709a73d681d451da0d26e861986d1ecf1d53f65d9994bb4c0
SHA51219491d2cf7f7ff796c3b237d8952faa843c8c1016553df60593c853513d856ab12d1f4acb68d4d45b9889c945053c2337b2e04829a4577437c793bf5456a7376
-
Filesize
293KB
MD539900a5f5037440f1380eb5efbdbd70d
SHA1c661153d06c90c848694819095de0e57bc1bef25
SHA256ddc83d9bbced158709a73d681d451da0d26e861986d1ecf1d53f65d9994bb4c0
SHA51219491d2cf7f7ff796c3b237d8952faa843c8c1016553df60593c853513d856ab12d1f4acb68d4d45b9889c945053c2337b2e04829a4577437c793bf5456a7376
-
Filesize
293KB
MD539900a5f5037440f1380eb5efbdbd70d
SHA1c661153d06c90c848694819095de0e57bc1bef25
SHA256ddc83d9bbced158709a73d681d451da0d26e861986d1ecf1d53f65d9994bb4c0
SHA51219491d2cf7f7ff796c3b237d8952faa843c8c1016553df60593c853513d856ab12d1f4acb68d4d45b9889c945053c2337b2e04829a4577437c793bf5456a7376
-
Filesize
293KB
MD539900a5f5037440f1380eb5efbdbd70d
SHA1c661153d06c90c848694819095de0e57bc1bef25
SHA256ddc83d9bbced158709a73d681d451da0d26e861986d1ecf1d53f65d9994bb4c0
SHA51219491d2cf7f7ff796c3b237d8952faa843c8c1016553df60593c853513d856ab12d1f4acb68d4d45b9889c945053c2337b2e04829a4577437c793bf5456a7376
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-528036852-1341495193-1175965888-1000\0f5007522459c86e95ffcc62f32308f1_f7900579-74de-4438-a379-aa8fc81156f9
Filesize46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-528036852-1341495193-1175965888-1000\0f5007522459c86e95ffcc62f32308f1_f7900579-74de-4438-a379-aa8fc81156f9
Filesize46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b