Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/05/2024, 02:05

General

  • Target

    ed444e4abc5aa906302b3e79ca09c94b8320e23af176384799a2020344de4700.exe

  • Size

    521KB

  • MD5

    1b275f5b53b912b6f9f4944b426471a9

  • SHA1

    e8fd9fec2eec13035730944c892ade741a663b84

  • SHA256

    ed444e4abc5aa906302b3e79ca09c94b8320e23af176384799a2020344de4700

  • SHA512

    09c35ad2425ca3abdf06b81aadd0bda5048c3f8ea117c1fb1184a9eee7fdd77391af018a8a79bcf7d8c9937dc97e17e8ce54a8d5e6ace6699460a420b510ef12

  • SSDEEP

    12288:jKclV/xG9Ud3ckOitZmw0gaGhZnzdU4r0:+M0rkhZnzdU4r

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/d1/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 6 IoCs
  • Detects executables containing common artifacts observed in infostealers 6 IoCs
  • Detects executables referencing many file transfer clients. Observed in information stealers 6 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed444e4abc5aa906302b3e79ca09c94b8320e23af176384799a2020344de4700.exe
    "C:\Users\Admin\AppData\Local\Temp\ed444e4abc5aa906302b3e79ca09c94b8320e23af176384799a2020344de4700.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2532
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ed444e4abc5aa906302b3e79ca09c94b8320e23af176384799a2020344de4700.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3912
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\LJHZOp.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1208
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LJHZOp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6491.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:628
    • C:\Users\Admin\AppData\Local\Temp\ed444e4abc5aa906302b3e79ca09c94b8320e23af176384799a2020344de4700.exe
      "C:\Users\Admin\AppData\Local\Temp\ed444e4abc5aa906302b3e79ca09c94b8320e23af176384799a2020344de4700.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:544
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1288,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:8
    1⤵
      PID:4976

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      3d086a433708053f9bf9523e1d87a4e8

      SHA1

      b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

      SHA256

      6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

      SHA512

      931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rsxaxgww.xas.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\tmp6491.tmp

      Filesize

      1KB

      MD5

      ddeb1c553fac0d6c89696a73bb48f25b

      SHA1

      34f50e4e9fd90f678ef21186f8d0b01ad4c0e804

      SHA256

      d0c947b195dafc31846ff8e9363fb64f0888eda4cc1b82319c609ec79ae128fb

      SHA512

      bfc66b3d95de88a0e9cf5af5b4c1324d3ccfa923886b71d85a9036a38ebd91bf64d77e509f7cd4eeaf623d6465a29683dd0eabf23201a77bcde3da488de20823

    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1181767204-2009306918-3718769404-1000\0f5007522459c86e95ffcc62f32308f1_d2547453-e731-4fdf-8f92-95f955a44aca

      Filesize

      46B

      MD5

      d898504a722bff1524134c6ab6a5eaa5

      SHA1

      e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

      SHA256

      878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

      SHA512

      26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1181767204-2009306918-3718769404-1000\0f5007522459c86e95ffcc62f32308f1_d2547453-e731-4fdf-8f92-95f955a44aca

      Filesize

      46B

      MD5

      c07225d4e7d01d31042965f048728a0a

      SHA1

      69d70b340fd9f44c89adb9a2278df84faa9906b7

      SHA256

      8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

      SHA512

      23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

    • memory/544-113-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

    • memory/544-114-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

    • memory/544-106-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

    • memory/544-26-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

    • memory/544-28-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

    • memory/544-44-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

    • memory/1208-86-0x0000000007800000-0x0000000007811000-memory.dmp

      Filesize

      68KB

    • memory/1208-29-0x0000000074580000-0x0000000074D30000-memory.dmp

      Filesize

      7.7MB

    • memory/1208-71-0x0000000074E10000-0x0000000074E5C000-memory.dmp

      Filesize

      304KB

    • memory/1208-85-0x0000000007880000-0x0000000007916000-memory.dmp

      Filesize

      600KB

    • memory/1208-24-0x0000000074580000-0x0000000074D30000-memory.dmp

      Filesize

      7.7MB

    • memory/1208-88-0x0000000007830000-0x000000000783E000-memory.dmp

      Filesize

      56KB

    • memory/1208-91-0x0000000007920000-0x0000000007928000-memory.dmp

      Filesize

      32KB

    • memory/1208-43-0x0000000074580000-0x0000000074D30000-memory.dmp

      Filesize

      7.7MB

    • memory/1208-95-0x0000000074580000-0x0000000074D30000-memory.dmp

      Filesize

      7.7MB

    • memory/2532-10-0x0000000006C60000-0x0000000006CFC000-memory.dmp

      Filesize

      624KB

    • memory/2532-8-0x00000000069C0000-0x00000000069D0000-memory.dmp

      Filesize

      64KB

    • memory/2532-17-0x0000000074580000-0x0000000074D30000-memory.dmp

      Filesize

      7.7MB

    • memory/2532-38-0x0000000074580000-0x0000000074D30000-memory.dmp

      Filesize

      7.7MB

    • memory/2532-5-0x0000000074580000-0x0000000074D30000-memory.dmp

      Filesize

      7.7MB

    • memory/2532-9-0x00000000069F0000-0x0000000006A52000-memory.dmp

      Filesize

      392KB

    • memory/2532-13-0x000000007458E000-0x000000007458F000-memory.dmp

      Filesize

      4KB

    • memory/2532-6-0x0000000005DD0000-0x0000000005DE6000-memory.dmp

      Filesize

      88KB

    • memory/2532-7-0x00000000069B0000-0x00000000069BC000-memory.dmp

      Filesize

      48KB

    • memory/2532-4-0x00000000057B0000-0x00000000057BA000-memory.dmp

      Filesize

      40KB

    • memory/2532-3-0x0000000005840000-0x00000000058D2000-memory.dmp

      Filesize

      584KB

    • memory/2532-0-0x000000007458E000-0x000000007458F000-memory.dmp

      Filesize

      4KB

    • memory/2532-2-0x0000000005DF0000-0x0000000006394000-memory.dmp

      Filesize

      5.6MB

    • memory/2532-1-0x0000000000D20000-0x0000000000DA8000-memory.dmp

      Filesize

      544KB

    • memory/3912-70-0x0000000006560000-0x000000000657E000-memory.dmp

      Filesize

      120KB

    • memory/3912-60-0x0000000074E10000-0x0000000074E5C000-memory.dmp

      Filesize

      304KB

    • memory/3912-59-0x0000000006520000-0x0000000006552000-memory.dmp

      Filesize

      200KB

    • memory/3912-81-0x0000000006F90000-0x0000000007033000-memory.dmp

      Filesize

      652KB

    • memory/3912-82-0x00000000078E0000-0x0000000007F5A000-memory.dmp

      Filesize

      6.5MB

    • memory/3912-83-0x0000000007290000-0x00000000072AA000-memory.dmp

      Filesize

      104KB

    • memory/3912-84-0x0000000007300000-0x000000000730A000-memory.dmp

      Filesize

      40KB

    • memory/3912-55-0x0000000006020000-0x000000000606C000-memory.dmp

      Filesize

      304KB

    • memory/3912-87-0x0000000007490000-0x00000000074A1000-memory.dmp

      Filesize

      68KB

    • memory/3912-54-0x0000000005F50000-0x0000000005F6E000-memory.dmp

      Filesize

      120KB

    • memory/3912-22-0x00000000057E0000-0x0000000005802000-memory.dmp

      Filesize

      136KB

    • memory/3912-89-0x00000000074D0000-0x00000000074E4000-memory.dmp

      Filesize

      80KB

    • memory/3912-90-0x00000000075D0000-0x00000000075EA000-memory.dmp

      Filesize

      104KB

    • memory/3912-31-0x0000000005960000-0x0000000005CB4000-memory.dmp

      Filesize

      3.3MB

    • memory/3912-32-0x0000000074580000-0x0000000074D30000-memory.dmp

      Filesize

      7.7MB

    • memory/3912-23-0x0000000005880000-0x00000000058E6000-memory.dmp

      Filesize

      408KB

    • memory/3912-96-0x0000000074580000-0x0000000074D30000-memory.dmp

      Filesize

      7.7MB

    • memory/3912-25-0x00000000058F0000-0x0000000005956000-memory.dmp

      Filesize

      408KB

    • memory/3912-21-0x0000000074580000-0x0000000074D30000-memory.dmp

      Filesize

      7.7MB

    • memory/3912-19-0x0000000074580000-0x0000000074D30000-memory.dmp

      Filesize

      7.7MB

    • memory/3912-18-0x0000000005040000-0x0000000005668000-memory.dmp

      Filesize

      6.2MB

    • memory/3912-16-0x0000000002660000-0x0000000002696000-memory.dmp

      Filesize

      216KB