Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/09/2024, 09:49

General

  • Target

    5a289141e67254662e3de8153a65fba0N.exe

  • Size

    510KB

  • MD5

    5a289141e67254662e3de8153a65fba0

  • SHA1

    4b7b5d2fd67df990bde1006f359d8f630cd97781

  • SHA256

    74f7256023d3638272f7eb34e10eb16aa08da56c818f2c296eb37b49dc8d7641

  • SHA512

    99ca558b34f1702c9addba9057dd4cd86258f26e3716812cbfe4e25217e3df5e9fcf98674d61a34cd9d6903489d41a34b0375d2fabb64bff2d340fbbddbb5b9a

  • SSDEEP

    6144:t01IhC1ZueHrCqZFCoM7q47sdy1f6NJDQzbTOjHm7Af7OMgpx11H4/5dofKx/8GP:t0bfHLC9f56mym7ZZjPHKo+esTCmW+8

Malware Config

Extracted

Family

lokibot

C2

http://sbrglobal.net/looms/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Drops startup file 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a289141e67254662e3de8153a65fba0N.exe
    "C:\Users\Admin\AppData\Local\Temp\5a289141e67254662e3de8153a65fba0N.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Enumerates connected drives
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1340
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:4104

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-523280732-2327480845-3730041215-1000\0f5007522459c86e95ffcc62f32308f1_a5c5e2ae-85e3-447c-9e0b-c9a7b966d823

    Filesize

    46B

    MD5

    d898504a722bff1524134c6ab6a5eaa5

    SHA1

    e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

    SHA256

    878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

    SHA512

    26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

  • memory/1340-0-0x0000000000400000-0x0000000000520000-memory.dmp

    Filesize

    1.1MB

  • memory/1340-1-0x00000000022C0000-0x0000000002302000-memory.dmp

    Filesize

    264KB

  • memory/1340-2-0x00000000023B0000-0x00000000023B1000-memory.dmp

    Filesize

    4KB

  • memory/1340-47-0x00000000029F0000-0x00000000029F1000-memory.dmp

    Filesize

    4KB

  • memory/1340-46-0x00000000029C0000-0x00000000029C1000-memory.dmp

    Filesize

    4KB

  • memory/1340-45-0x00000000029E0000-0x00000000029E1000-memory.dmp

    Filesize

    4KB

  • memory/1340-44-0x00000000029B0000-0x00000000029B1000-memory.dmp

    Filesize

    4KB

  • memory/1340-42-0x0000000002870000-0x0000000002871000-memory.dmp

    Filesize

    4KB

  • memory/1340-43-0x0000000002860000-0x0000000002861000-memory.dmp

    Filesize

    4KB

  • memory/1340-41-0x0000000002840000-0x0000000002841000-memory.dmp

    Filesize

    4KB

  • memory/1340-40-0x0000000002850000-0x0000000002851000-memory.dmp

    Filesize

    4KB

  • memory/1340-39-0x0000000002820000-0x0000000002821000-memory.dmp

    Filesize

    4KB

  • memory/1340-38-0x0000000002830000-0x0000000002831000-memory.dmp

    Filesize

    4KB

  • memory/1340-37-0x00000000027F0000-0x00000000027F1000-memory.dmp

    Filesize

    4KB

  • memory/1340-36-0x0000000002800000-0x0000000002801000-memory.dmp

    Filesize

    4KB

  • memory/1340-35-0x00000000027D0000-0x00000000027D1000-memory.dmp

    Filesize

    4KB

  • memory/1340-34-0x00000000027E0000-0x00000000027E1000-memory.dmp

    Filesize

    4KB

  • memory/1340-33-0x00000000027B0000-0x00000000027B1000-memory.dmp

    Filesize

    4KB

  • memory/1340-32-0x00000000027C0000-0x00000000027C1000-memory.dmp

    Filesize

    4KB

  • memory/1340-31-0x0000000002790000-0x0000000002791000-memory.dmp

    Filesize

    4KB

  • memory/1340-30-0x00000000027A0000-0x00000000027A1000-memory.dmp

    Filesize

    4KB

  • memory/1340-29-0x0000000002670000-0x0000000002671000-memory.dmp

    Filesize

    4KB

  • memory/1340-28-0x0000000002680000-0x0000000002681000-memory.dmp

    Filesize

    4KB

  • memory/1340-27-0x0000000002650000-0x0000000002651000-memory.dmp

    Filesize

    4KB

  • memory/1340-26-0x0000000002660000-0x0000000002661000-memory.dmp

    Filesize

    4KB

  • memory/1340-25-0x0000000002630000-0x0000000002631000-memory.dmp

    Filesize

    4KB

  • memory/1340-24-0x0000000002640000-0x0000000002641000-memory.dmp

    Filesize

    4KB

  • memory/1340-23-0x0000000002610000-0x0000000002611000-memory.dmp

    Filesize

    4KB

  • memory/1340-22-0x0000000002620000-0x0000000002621000-memory.dmp

    Filesize

    4KB

  • memory/1340-48-0x00000000029D0000-0x00000000029D1000-memory.dmp

    Filesize

    4KB

  • memory/1340-21-0x00000000025F0000-0x00000000025F1000-memory.dmp

    Filesize

    4KB

  • memory/1340-20-0x0000000002600000-0x0000000002601000-memory.dmp

    Filesize

    4KB

  • memory/1340-19-0x00000000025D0000-0x00000000025D1000-memory.dmp

    Filesize

    4KB

  • memory/1340-18-0x00000000025E0000-0x00000000025E1000-memory.dmp

    Filesize

    4KB

  • memory/1340-17-0x00000000025B0000-0x00000000025B1000-memory.dmp

    Filesize

    4KB

  • memory/1340-16-0x00000000025C0000-0x00000000025C1000-memory.dmp

    Filesize

    4KB

  • memory/1340-15-0x0000000002590000-0x0000000002591000-memory.dmp

    Filesize

    4KB

  • memory/1340-14-0x00000000025A0000-0x00000000025A1000-memory.dmp

    Filesize

    4KB

  • memory/1340-13-0x0000000002570000-0x0000000002571000-memory.dmp

    Filesize

    4KB

  • memory/1340-12-0x0000000002580000-0x0000000002581000-memory.dmp

    Filesize

    4KB

  • memory/1340-11-0x0000000002540000-0x0000000002541000-memory.dmp

    Filesize

    4KB

  • memory/1340-10-0x0000000002500000-0x0000000002501000-memory.dmp

    Filesize

    4KB

  • memory/1340-9-0x00000000024F0000-0x00000000024F1000-memory.dmp

    Filesize

    4KB

  • memory/1340-8-0x0000000002530000-0x0000000002531000-memory.dmp

    Filesize

    4KB

  • memory/1340-7-0x0000000002510000-0x0000000002511000-memory.dmp

    Filesize

    4KB

  • memory/1340-6-0x0000000002520000-0x0000000002522000-memory.dmp

    Filesize

    8KB

  • memory/1340-5-0x00000000024E0000-0x00000000024E1000-memory.dmp

    Filesize

    4KB

  • memory/1340-4-0x0000000002250000-0x0000000002251000-memory.dmp

    Filesize

    4KB

  • memory/1340-3-0x0000000002270000-0x0000000002271000-memory.dmp

    Filesize

    4KB

  • memory/1340-50-0x0000000004400000-0x0000000004401000-memory.dmp

    Filesize

    4KB

  • memory/1340-49-0x0000000004410000-0x0000000004411000-memory.dmp

    Filesize

    4KB

  • memory/1340-51-0x0000000004430000-0x0000000004431000-memory.dmp

    Filesize

    4KB

  • memory/1340-52-0x0000000004420000-0x0000000004421000-memory.dmp

    Filesize

    4KB

  • memory/1340-56-0x0000000004460000-0x0000000004461000-memory.dmp

    Filesize

    4KB

  • memory/1340-55-0x0000000004470000-0x0000000004471000-memory.dmp

    Filesize

    4KB

  • memory/1340-54-0x0000000004440000-0x0000000004441000-memory.dmp

    Filesize

    4KB

  • memory/1340-53-0x0000000004450000-0x0000000004451000-memory.dmp

    Filesize

    4KB

  • memory/1340-59-0x0000000004490000-0x0000000004491000-memory.dmp

    Filesize

    4KB

  • memory/1340-58-0x0000000004480000-0x0000000004481000-memory.dmp

    Filesize

    4KB

  • memory/1340-57-0x0000000000400000-0x0000000000520000-memory.dmp

    Filesize

    1.1MB

  • memory/1340-60-0x00000000022C0000-0x0000000002302000-memory.dmp

    Filesize

    264KB

  • memory/1340-61-0x00000000029D0000-0x00000000029D1000-memory.dmp

    Filesize

    4KB

  • memory/1340-62-0x0000000000400000-0x0000000000520000-memory.dmp

    Filesize

    1.1MB

  • memory/1340-67-0x0000000003150000-0x0000000003151000-memory.dmp

    Filesize

    4KB

  • memory/1340-66-0x0000000003120000-0x0000000003121000-memory.dmp

    Filesize

    4KB

  • memory/1340-65-0x0000000003100000-0x0000000003101000-memory.dmp

    Filesize

    4KB

  • memory/1340-64-0x0000000003110000-0x0000000003111000-memory.dmp

    Filesize

    4KB

  • memory/1340-69-0x0000000003130000-0x0000000003131000-memory.dmp

    Filesize

    4KB

  • memory/1340-68-0x0000000003140000-0x0000000003141000-memory.dmp

    Filesize

    4KB

  • memory/1340-72-0x0000000003160000-0x0000000003161000-memory.dmp

    Filesize

    4KB

  • memory/1340-71-0x0000000004550000-0x0000000004551000-memory.dmp

    Filesize

    4KB

  • memory/1340-77-0x0000000000400000-0x0000000000520000-memory.dmp

    Filesize

    1.1MB

  • memory/1340-76-0x0000000000400000-0x0000000000520000-memory.dmp

    Filesize

    1.1MB

  • memory/1340-79-0x0000000000400000-0x0000000000520000-memory.dmp

    Filesize

    1.1MB

  • memory/1340-81-0x00000000022C0000-0x0000000002302000-memory.dmp

    Filesize

    264KB

  • memory/4104-70-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/4104-74-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/4104-102-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB