Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

Comprobant...97.exe

windows7-x64

10

Comprobant...97.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    124s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/09/2024, 21:55 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Comprobante.PDF867564575869708776565434576897.exe

  • Size

    965KB

  • MD5

    ba1643a0a19e0bb74ec7a361cc52f282

  • SHA1

    257361a48666003b8f42ad79d67e69ad61ea5a45

  • SHA256

    418e0add4eb6fb3db62e0fdae4dfe7b738e8348babc29a09f5cf9a0cac0a29db

  • SHA512

    461d7776aa79409c5cc6aabaadcdd014ad3435cce235363a20fe94f0c482a195fdc349f7fb1f36df2ad21c86fdd86e6b09f28cd71f84cfeaf118baf25d9cc11c

  • SSDEEP

    12288:ktb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaZTAI5yEaRJItQ6A:ktb20pkaCqT5TBWgNQ7adAknIqtQ6A

Score
10/10
lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://touxzw.ir/sweetwhore/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Comprobante.PDF867564575869708776565434576897.exe
    "C:\Users\Admin\AppData\Local\Temp\Comprobante.PDF867564575869708776565434576897.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3324
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\Comprobante.PDF867564575869708776565434576897.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:3584

Network

  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    240.143.123.92.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.143.123.92.in-addr.arpa
    IN PTR
    Response
    240.143.123.92.in-addr.arpa
    IN PTR
    a92-123-143-240deploystaticakamaitechnologiescom
  • flag-us
    DNS
    touxzw.ir
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    touxzw.ir
    IN A
    Response
    touxzw.ir
    IN A
    104.21.25.154
    touxzw.ir
    IN A
    172.67.134.88
  • flag-us
    POST
    http://touxzw.ir/sweetwhore/five/fre.php
    svchost.exe
    Remote address:
    104.21.25.154:80
    Request
    POST /sweetwhore/five/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: touxzw.ir
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: EF80CC98
    Content-Length: 358
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Date: Wed, 11 Sep 2024 21:55:45 GMT
    Content-Type: text/html; charset=UTF-8
    Connection: close
    X-Powered-By: PHP/5.4.16
    Status: 404 Not Found
    cf-cache-status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MNn4EVJShd0rFHS9WZ9QinhAx0Zm0iVB%2FsUVfdUtPv1N3zBF3anL0bKGU7GNDrbPC7mMVNXTBOSPgjtI5WI%2FnuEJXsYbpfifmqSjXA%2Fo6LodjGA9psTkLqAru%2FY%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8c1ae75f8d4877b2-LHR
    alt-svc: h3=":443"; ma=86400
  • flag-us
    DNS
    136.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    136.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    POST
    http://touxzw.ir/sweetwhore/five/fre.php
    svchost.exe
    Remote address:
    104.21.25.154:80
    Request
    POST /sweetwhore/five/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: touxzw.ir
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: EF80CC98
    Content-Length: 180
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Date: Wed, 11 Sep 2024 21:55:45 GMT
    Content-Type: text/html; charset=UTF-8
    Connection: close
    X-Powered-By: PHP/5.4.16
    Status: 404 Not Found
    cf-cache-status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UEQXqXanKseqlrw7C%2FLWIqlZ%2Fr6pOXjNK%2F5am3I9DSEYOccdef4NiHwK6XVDAUfEzzwwpr1FRBQtsqWExyJ0tW9En%2F3aZxy%2FEgbdetrrpQp6r3qxbH%2BuE0XK6ro%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8c1ae761da7063ab-LHR
    alt-svc: h3=":443"; ma=86400
  • flag-us
    POST
    http://touxzw.ir/sweetwhore/five/fre.php
    svchost.exe
    Remote address:
    104.21.25.154:80
    Request
    POST /sweetwhore/five/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: touxzw.ir
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: EF80CC98
    Content-Length: 153
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Date: Wed, 11 Sep 2024 21:55:46 GMT
    Content-Type: text/html; charset=UTF-8
    Connection: close
    X-Powered-By: PHP/5.4.16
    Status: 404 Not Found
    cf-cache-status: DYNAMIC
    vary: accept-encoding
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KcaZDf6y0%2BQLeshfAX7NcOAL8xebnpEaD2j2mvThDG9cbVKU547JNQFhW9OJC1V8n%2BtZQ3Et7p%2FaJbwn1XXm4srcCH52WLpq5lEbSrAbjj%2Byax0ZNqECHMJpzCE%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8c1ae765ae338891-LHR
    alt-svc: h3=":443"; ma=86400
  • flag-us
    DNS
    154.25.21.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    154.25.21.104.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    103.169.127.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    103.169.127.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    107.12.20.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    107.12.20.2.in-addr.arpa
    IN PTR
    Response
    107.12.20.2.in-addr.arpa
    IN PTR
    a2-20-12-107deploystaticakamaitechnologiescom
  • flag-us
    POST
    http://touxzw.ir/sweetwhore/five/fre.php
    svchost.exe
    Remote address:
    104.21.25.154:80
    Request
    POST /sweetwhore/five/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: touxzw.ir
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: EF80CC98
    Content-Length: 153
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Date: Wed, 11 Sep 2024 21:56:46 GMT
    Content-Type: text/html; charset=UTF-8
    Connection: close
    X-Powered-By: PHP/5.4.16
    Status: 404 Not Found
    cf-cache-status: DYNAMIC
    vary: accept-encoding
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KEFyTjN0WNOQgRT1ydz9eyVsLROPKttd3TP9hySYlXr%2BzzVdQF0rFfh9vOtx1XyBJBfRl8R97JReTZz7DV%2FGWYUKEatL%2BfeaVb71WpsUdQ29fcKCEwq%2FsUNlqgo%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8c1ae8de9fd88862-LHR
    alt-svc: h3=":443"; ma=86400
  • flag-us
    DNS
    25.140.123.92.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    25.140.123.92.in-addr.arpa
    IN PTR
    Response
    25.140.123.92.in-addr.arpa
    IN PTR
    a92-123-140-25deploystaticakamaitechnologiescom
  • flag-us
    POST
    http://touxzw.ir/sweetwhore/five/fre.php
    svchost.exe
    Remote address:
    104.21.25.154:80
    Request
    POST /sweetwhore/five/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: touxzw.ir
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: EF80CC98
    Content-Length: 153
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Date: Wed, 11 Sep 2024 21:57:47 GMT
    Content-Type: text/html; charset=UTF-8
    Connection: close
    X-Powered-By: PHP/5.4.16
    Status: 404 Not Found
    cf-cache-status: DYNAMIC
    vary: accept-encoding
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lDMAvEzHqihnEb4ib9QU8%2BVGC4pv1CJrlvsobndQg%2B5PGm3uRID5FRqKGjQVB42hoYSXykW6gpAPZd1sehzQLi3lY%2FJIJ12sVA79DpyA5o6DxV0owDwZNPyLujc%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8c1aea584eec94c9-LHR
    alt-svc: h3=":443"; ma=86400
  • 104.21.25.154:80
    http://touxzw.ir/sweetwhore/five/fre.php
    http
    svchost.exe
    873 B
     863 B
     6
    6

    HTTP Request

    POST http://touxzw.ir/sweetwhore/five/fre.php

    HTTP Response

    404
  • 104.21.25.154:80
    http://touxzw.ir/sweetwhore/five/fre.php
    http
    svchost.exe
    695 B
     827 B
     6
    5

    HTTP Request

    POST http://touxzw.ir/sweetwhore/five/fre.php

    HTTP Response

    404
  • 104.21.25.154:80
    http://touxzw.ir/sweetwhore/five/fre.php
    http
    svchost.exe
    668 B
     894 B
     6
    6

    HTTP Request

    POST http://touxzw.ir/sweetwhore/five/fre.php

    HTTP Response

    404
  • 104.21.25.154:80
    http://touxzw.ir/sweetwhore/five/fre.php
    http
    svchost.exe
    668 B
     894 B
     6
    6

    HTTP Request

    POST http://touxzw.ir/sweetwhore/five/fre.php

    HTTP Response

    404
  • 104.21.25.154:80
    http://touxzw.ir/sweetwhore/five/fre.php
    http
    svchost.exe
    668 B
     892 B
     6
    6

    HTTP Request

    POST http://touxzw.ir/sweetwhore/five/fre.php

    HTTP Response

    404
  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    240.143.123.92.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    240.143.123.92.in-addr.arpa

  • 8.8.8.8:53
    touxzw.ir
    dns
    svchost.exe
    55 B
     87 B
     1
    1

    DNS Request

    touxzw.ir

    DNS Response

    104.21.25.154
    172.67.134.88

  • 8.8.8.8:53
    136.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    136.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    154.25.21.104.in-addr.arpa
    dns
    72 B
     134 B
     1
    1

    DNS Request

    154.25.21.104.in-addr.arpa

  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    103.169.127.40.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    103.169.127.40.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    107.12.20.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    107.12.20.2.in-addr.arpa

  • 8.8.8.8:53
    25.140.123.92.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    25.140.123.92.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-523280732-2327480845-3730041215-1000\0f5007522459c86e95ffcc62f32308f1_a5c5e2ae-85e3-447c-9e0b-c9a7b966d823
    Filesize

    46B

    MD5

    d898504a722bff1524134c6ab6a5eaa5

    SHA1

    e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

    SHA256

    878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

    SHA512

    26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-523280732-2327480845-3730041215-1000\0f5007522459c86e95ffcc62f32308f1_a5c5e2ae-85e3-447c-9e0b-c9a7b966d823
    Filesize

    46B

    MD5

    c07225d4e7d01d31042965f048728a0a

    SHA1

    69d70b340fd9f44c89adb9a2278df84faa9906b7

    SHA256

    8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

    SHA512

    23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

    Download Submit

  • memory/3324-5-0x0000000002790000-0x0000000002794000-memory.dmp

    Filesize

    16KB

    Download

  • memory/3584-6-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

    Download

  • memory/3584-8-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

    Download

  • memory/3584-29-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

    Download

  • memory/3584-37-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.