Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/11/2024, 18:48 UTC

General

  • Target

    d859b658417fc5c9aaf0d48deb3ff84420107c9419b4fe2b95a1079e711ac432.exe

  • Size

    699KB

  • MD5

    38207dadf8e4e4b1767fa92ac77be33a

  • SHA1

    77cc947be7e5acc239cf176d108ccca91555d5c6

  • SHA256

    d859b658417fc5c9aaf0d48deb3ff84420107c9419b4fe2b95a1079e711ac432

  • SHA512

    5f6dc5e247f7088b142c6eea2248f5c48f09f47336eaf98df05b0c164bbf387e084d2dfea41a8b2973cab166e2c937346e4e0e766223e6fed5b454ab6f806b4b

  • SSDEEP

    12288:uB2zj/+CrtawWTlTmLkHN6DSG8cFaVVfRYDEF/ct7oSFduBCTb6HIALUdXVfIy6:HaC0wIlTWkHoDfFabRYDEFk5oSX4CTWD

Malware Config

Extracted

Family

lokibot

C2

http://smartcamainpowerizman.sytes.net/ioknfbgj/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Lokibot family
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d859b658417fc5c9aaf0d48deb3ff84420107c9419b4fe2b95a1079e711ac432.exe
    "C:\Users\Admin\AppData\Local\Temp\d859b658417fc5c9aaf0d48deb3ff84420107c9419b4fe2b95a1079e711ac432.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1224
    • C:\Users\Admin\AppData\Local\Temp\d859b658417fc5c9aaf0d48deb3ff84420107c9419b4fe2b95a1079e711ac432.exe
      C:\Users\Admin\AppData\Local\Temp\d859b658417fc5c9aaf0d48deb3ff84420107c9419b4fe2b95a1079e711ac432.exe
      2⤵
        PID:4144
      • C:\Users\Admin\AppData\Local\Temp\d859b658417fc5c9aaf0d48deb3ff84420107c9419b4fe2b95a1079e711ac432.exe
        C:\Users\Admin\AppData\Local\Temp\d859b658417fc5c9aaf0d48deb3ff84420107c9419b4fe2b95a1079e711ac432.exe
        2⤵
        • Accesses Microsoft Outlook profiles
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: RenamesItself
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:5008

    Network

    • flag-us
      DNS
      28.118.140.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      28.118.140.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.214.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.214.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      0.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      0.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      104.219.191.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      104.219.191.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      217.106.137.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      217.106.137.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      212.20.149.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      212.20.149.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      171.39.242.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      171.39.242.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      smartcamainpowerizman.sytes.net
      d859b658417fc5c9aaf0d48deb3ff84420107c9419b4fe2b95a1079e711ac432.exe
      Remote address:
      8.8.8.8:53
      Request
      smartcamainpowerizman.sytes.net
      IN A
      Response
      smartcamainpowerizman.sytes.net
      IN A
      0.0.0.0
    • flag-us
      DNS
      24.125.209.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      24.125.209.23.in-addr.arpa
      IN PTR
      Response
      24.125.209.23.in-addr.arpa
      IN PTR
      a23-209-125-24deploystaticakamaitechnologiescom
    • flag-us
      DNS
      25.125.209.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      25.125.209.23.in-addr.arpa
      IN PTR
      Response
      25.125.209.23.in-addr.arpa
      IN PTR
      a23-209-125-25deploystaticakamaitechnologiescom
    • flag-us
      DNS
      13.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.227.111.52.in-addr.arpa
      IN PTR
      Response
    No results found
    • 8.8.8.8:53
      28.118.140.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      28.118.140.52.in-addr.arpa

    • 8.8.8.8:53
      172.214.232.199.in-addr.arpa
      dns
      74 B
      128 B
      1
      1

      DNS Request

      172.214.232.199.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
      144 B
      1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      0.159.190.20.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      0.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      104.219.191.52.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      104.219.191.52.in-addr.arpa

    • 8.8.8.8:53
      217.106.137.52.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      217.106.137.52.in-addr.arpa

    • 8.8.8.8:53
      212.20.149.52.in-addr.arpa
      dns
      72 B
      146 B
      1
      1

      DNS Request

      212.20.149.52.in-addr.arpa

    • 8.8.8.8:53
      171.39.242.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      171.39.242.20.in-addr.arpa

    • 8.8.8.8:53
      smartcamainpowerizman.sytes.net
      dns
      d859b658417fc5c9aaf0d48deb3ff84420107c9419b4fe2b95a1079e711ac432.exe
      77 B
      93 B
      1
      1

      DNS Request

      smartcamainpowerizman.sytes.net

      DNS Response

      0.0.0.0

    • 8.8.8.8:53
      24.125.209.23.in-addr.arpa
      dns
      72 B
      137 B
      1
      1

      DNS Request

      24.125.209.23.in-addr.arpa

    • 8.8.8.8:53
      25.125.209.23.in-addr.arpa
      dns
      72 B
      137 B
      1
      1

      DNS Request

      25.125.209.23.in-addr.arpa

    • 8.8.8.8:53
      13.227.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      13.227.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-940901362-3608833189-1915618603-1000\0f5007522459c86e95ffcc62f32308f1_f2cdb6fb-4ab8-4547-9f25-fad1f7a44351

      Filesize

      46B

      MD5

      d898504a722bff1524134c6ab6a5eaa5

      SHA1

      e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

      SHA256

      878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

      SHA512

      26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-940901362-3608833189-1915618603-1000\0f5007522459c86e95ffcc62f32308f1_f2cdb6fb-4ab8-4547-9f25-fad1f7a44351

      Filesize

      46B

      MD5

      c07225d4e7d01d31042965f048728a0a

      SHA1

      69d70b340fd9f44c89adb9a2278df84faa9906b7

      SHA256

      8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

      SHA512

      23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

    • memory/1224-6-0x0000000005E30000-0x00000000063D4000-memory.dmp

      Filesize

      5.6MB

    • memory/1224-3-0x0000000005380000-0x0000000005430000-memory.dmp

      Filesize

      704KB

    • memory/1224-4-0x0000000005770000-0x0000000005802000-memory.dmp

      Filesize

      584KB

    • memory/1224-5-0x0000000005810000-0x0000000005876000-memory.dmp

      Filesize

      408KB

    • memory/1224-0-0x00000000744DE000-0x00000000744DF000-memory.dmp

      Filesize

      4KB

    • memory/1224-7-0x00000000744D0000-0x0000000074C80000-memory.dmp

      Filesize

      7.7MB

    • memory/1224-8-0x0000000005D60000-0x0000000005D7E000-memory.dmp

      Filesize

      120KB

    • memory/1224-13-0x00000000744D0000-0x0000000074C80000-memory.dmp

      Filesize

      7.7MB

    • memory/1224-2-0x00000000744DE000-0x00000000744DF000-memory.dmp

      Filesize

      4KB

    • memory/1224-1-0x00000000006C0000-0x0000000000772000-memory.dmp

      Filesize

      712KB

    • memory/5008-9-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

    • memory/5008-11-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

    • memory/5008-55-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.