Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    123s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26/10/2024, 01:30 UTC

General

  • Target

    ac3f8b19b1d29525dddb1d48e4fcf7aec60ea5d93bcf9b874f9a61adde4ca13c.exe

  • Size

    562KB

  • MD5

    8d03a09d0f5d5f2c196be0657d169636

  • SHA1

    fb44ba8de7862e644239d29343550eb879b25dd8

  • SHA256

    ac3f8b19b1d29525dddb1d48e4fcf7aec60ea5d93bcf9b874f9a61adde4ca13c

  • SHA512

    9b18397a013f6913eff43631b295fd3d0a58c06798d8e163f0a0dd8fc96522eec21305247b9e97d74e4aa666421694ef04a4d420cefe6dfbc2d978d460c535cb

  • SSDEEP

    12288:V9BvctM85t35JPNJj2WzoRLQYRYzmYxU6sDuo88OQQkpG:VD0tM85tbNJjldeYiYxmuo8PWG

Malware Config

Extracted

Family

lokibot

C2

http://94.156.177.220/skipo/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Lokibot family
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac3f8b19b1d29525dddb1d48e4fcf7aec60ea5d93bcf9b874f9a61adde4ca13c.exe
    "C:\Users\Admin\AppData\Local\Temp\ac3f8b19b1d29525dddb1d48e4fcf7aec60ea5d93bcf9b874f9a61adde4ca13c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2996
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\ac3f8b19b1d29525dddb1d48e4fcf7aec60ea5d93bcf9b874f9a61adde4ca13c.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:2740

Network

  • flag-de
    POST
    http://94.156.177.220/skipo/five/fre.php
    svchost.exe
    Remote address:
    94.156.177.220:80
    Request
    POST /skipo/five/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: 94.156.177.220
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: E1DD60CA
    Content-Length: 374
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Server: nginx/1.26.1
    Date: Sat, 26 Oct 2024 01:30:55 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 15
    Connection: close
    X-Powered-By: PHP/5.4.16
    Status: 404 Not Found
  • flag-de
    POST
    http://94.156.177.220/skipo/five/fre.php
    svchost.exe
    Remote address:
    94.156.177.220:80
    Request
    POST /skipo/five/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: 94.156.177.220
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: E1DD60CA
    Content-Length: 180
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Server: nginx/1.26.1
    Date: Sat, 26 Oct 2024 01:30:55 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 15
    Connection: close
    X-Powered-By: PHP/5.4.16
    Status: 404 Not Found
  • flag-de
    POST
    http://94.156.177.220/skipo/five/fre.php
    svchost.exe
    Remote address:
    94.156.177.220:80
    Request
    POST /skipo/five/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: 94.156.177.220
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: E1DD60CA
    Content-Length: 153
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Server: nginx/1.26.1
    Date: Sat, 26 Oct 2024 01:30:56 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 23
    Connection: close
    X-Powered-By: PHP/5.4.16
    Status: 404 Not Found
  • flag-de
    POST
    http://94.156.177.220/skipo/five/fre.php
    svchost.exe
    Remote address:
    94.156.177.220:80
    Request
    POST /skipo/five/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: 94.156.177.220
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: E1DD60CA
    Content-Length: 153
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Server: nginx/1.26.1
    Date: Sat, 26 Oct 2024 01:31:56 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 23
    Connection: close
    X-Powered-By: PHP/5.4.16
    Status: 404 Not Found
  • flag-de
    POST
    http://94.156.177.220/skipo/five/fre.php
    svchost.exe
    Remote address:
    94.156.177.220:80
    Request
    POST /skipo/five/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: 94.156.177.220
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: E1DD60CA
    Content-Length: 153
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Server: nginx/1.26.1
    Date: Sat, 26 Oct 2024 01:32:56 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 23
    Connection: close
    X-Powered-By: PHP/5.4.16
    Status: 404 Not Found
  • 94.156.177.220:80
    http://94.156.177.220/skipo/five/fre.php
    http
    svchost.exe
    889 B
    480 B
    6
    6

    HTTP Request

    POST http://94.156.177.220/skipo/five/fre.php

    HTTP Response

    404
  • 94.156.177.220:80
    http://94.156.177.220/skipo/five/fre.php
    http
    svchost.exe
    695 B
    480 B
    6
    6

    HTTP Request

    POST http://94.156.177.220/skipo/five/fre.php

    HTTP Response

    404
  • 94.156.177.220:80
    http://94.156.177.220/skipo/five/fre.php
    http
    svchost.exe
    760 B
    488 B
    8
    6

    HTTP Request

    POST http://94.156.177.220/skipo/five/fre.php

    HTTP Response

    404
  • 94.156.177.220:80
    http://94.156.177.220/skipo/five/fre.php
    http
    svchost.exe
    714 B
    488 B
    7
    6

    HTTP Request

    POST http://94.156.177.220/skipo/five/fre.php

    HTTP Response

    404
  • 94.156.177.220:80
    http://94.156.177.220/skipo/five/fre.php
    http
    svchost.exe
    668 B
    488 B
    6
    6

    HTTP Request

    POST http://94.156.177.220/skipo/five/fre.php

    HTTP Response

    404
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3063565911-2056067323-3330884624-1000\0f5007522459c86e95ffcc62f32308f1_de87a6d6-9d44-4942-9ec6-2be31b435411

    Filesize

    46B

    MD5

    d898504a722bff1524134c6ab6a5eaa5

    SHA1

    e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

    SHA256

    878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

    SHA512

    26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3063565911-2056067323-3330884624-1000\0f5007522459c86e95ffcc62f32308f1_de87a6d6-9d44-4942-9ec6-2be31b435411

    Filesize

    46B

    MD5

    c07225d4e7d01d31042965f048728a0a

    SHA1

    69d70b340fd9f44c89adb9a2278df84faa9906b7

    SHA256

    8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

    SHA512

    23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

  • memory/2740-4-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2740-9-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2740-6-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2740-30-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2740-39-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2996-0-0x0000000000400000-0x00000000004C1000-memory.dmp

    Filesize

    772KB

  • memory/2996-3-0x0000000002EE0000-0x00000000030E0000-memory.dmp

    Filesize

    2.0MB

  • memory/2996-8-0x0000000000400000-0x00000000004C1000-memory.dmp

    Filesize

    772KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.