Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    123s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    05/12/2024, 15:51 UTC

General

  • Target

    d59042fb9666d5a2fcb62371be2ab5c51b708f27db5711659d6b6d54e261741e.exe

  • Size

    297KB

  • MD5

    f2e32e33daa66e9cd593d80b9c40e82f

  • SHA1

    824c23212249c7fda010e3c5895252f62b1ffdd2

  • SHA256

    d59042fb9666d5a2fcb62371be2ab5c51b708f27db5711659d6b6d54e261741e

  • SHA512

    d6653a03cfba452a4441639e9c35d974675576d786bf19e7b3e96aeb01c61200e2c758fb5fb4ac637111b93fa5e1bfea199623c82333987a54bcfb00cd3cc218

  • SSDEEP

    3072:hhEhB7dX8JhdSFETqgcFKy3owG9ih0JNplQMXj8Orctx9oQvl4aWgV7PXr1S7XWP:EhHodSFUdSLuJ3KMX8tVvl57v

Malware Config

Extracted

Family

lokibot

C2

https://ddrtot.shop/MV3/PWS/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Lokibot family
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d59042fb9666d5a2fcb62371be2ab5c51b708f27db5711659d6b6d54e261741e.exe
    "C:\Users\Admin\AppData\Local\Temp\d59042fb9666d5a2fcb62371be2ab5c51b708f27db5711659d6b6d54e261741e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2264
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:2404

Network

  • flag-us
    DNS
    ddrtot.shop
    aspnet_compiler.exe
    Remote address:
    8.8.8.8:53
    Request
    ddrtot.shop
    IN A
    Response
    ddrtot.shop
    IN A
    172.67.192.176
    ddrtot.shop
    IN A
    104.21.73.230
  • flag-us
    POST
    http://ddrtot.shop/MV3/PWS/fre.php
    aspnet_compiler.exe
    Remote address:
    172.67.192.176:80
    Request
    POST /MV3/PWS/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: ddrtot.shop
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: E37FD2E8
    Content-Length: 374
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Date: Thu, 05 Dec 2024 15:51:37 GMT
    Content-Type: text/html; charset=UTF-8
    Connection: close
    Status: 404 Not Found
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mQu8pC8%2BJP6HyEZaNf3JHvFC%2FBQDAlqjc0E4vbNSoEeMRIPfIYuqUIco7wIuVAQ7oxhH%2B6ZuWSYDDe8AF%2BFPPihhJUxprlv3lsx4ftmDLGko3uF4Ga0SllSTv%2Bw0Zg%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8ed532d829e89466-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=26251&min_rtt=26251&rtt_var=13125&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=613&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
  • flag-us
    POST
    http://ddrtot.shop/MV3/PWS/fre.php
    aspnet_compiler.exe
    Remote address:
    172.67.192.176:80
    Request
    POST /MV3/PWS/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: ddrtot.shop
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: E37FD2E8
    Content-Length: 180
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Date: Thu, 05 Dec 2024 15:51:37 GMT
    Content-Type: text/html; charset=UTF-8
    Connection: close
    Status: 404 Not Found
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W0XnoslJ76YCFNyrxnBFOefsIAIxwtNz4iG%2B%2F3Gjvtv6CUjcbZdUB7St7JiZoTNePHrPVDtlakWmq1snSlP6mEfAjEXREOrBVg33Z%2FNq2ugp87jewxE8jFXZez0fPQ%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8ed532da5af37785-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=26273&min_rtt=26273&rtt_var=13136&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=419&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
  • flag-us
    POST
    http://ddrtot.shop/MV3/PWS/fre.php
    aspnet_compiler.exe
    Remote address:
    172.67.192.176:80
    Request
    POST /MV3/PWS/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: ddrtot.shop
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: E37FD2E8
    Content-Length: 153
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Date: Thu, 05 Dec 2024 15:51:37 GMT
    Content-Type: text/html; charset=UTF-8
    Connection: close
    Status: 404 Not Found
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RK4w6VpZPkUbLpgtmwQTVtDSi8uXs1gMod%2FI0q0ajjznVq6Zj8TEn73PPEr9QAOKtEX47wMUUVemLNR4s7Csm087zVmV9u7%2F4ocQOrTqxjSz2bQTzoafG2Ors9yU2Q%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8ed532dbbd1bede6-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=26925&min_rtt=26925&rtt_var=13462&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=392&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
  • flag-us
    POST
    http://ddrtot.shop/MV3/PWS/fre.php
    aspnet_compiler.exe
    Remote address:
    172.67.192.176:80
    Request
    POST /MV3/PWS/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: ddrtot.shop
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: E37FD2E8
    Content-Length: 153
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Date: Thu, 05 Dec 2024 15:52:37 GMT
    Content-Type: text/html; charset=UTF-8
    Connection: close
    Status: 404 Not Found
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F5Vf9vA4vptePS3UglhZX9w7cHGuAM7s9Zwhz3lTS%2Fe7oiwJjt1PnAaH3G4dHI8d3zR8f0NS6Z9hQk8eo0glyoina0uEu%2FU4EhIWVZ%2Fbs8l9T37BmxSlj%2BNMPB%2FifQ%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8ed534542f37ede4-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=26381&min_rtt=26381&rtt_var=13190&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=392&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
  • flag-us
    POST
    http://ddrtot.shop/MV3/PWS/fre.php
    aspnet_compiler.exe
    Remote address:
    172.67.192.176:80
    Request
    POST /MV3/PWS/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: ddrtot.shop
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: E37FD2E8
    Content-Length: 153
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Date: Thu, 05 Dec 2024 15:53:38 GMT
    Content-Type: text/html; charset=UTF-8
    Connection: close
    Status: 404 Not Found
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V8cW%2BtSPmM1dDEviMQS2n6EdoYv9zcSxo63Ssim82cG356wxBuYnAs6CnmAJO0byolxxsjN2yRHDkOPwhW4BJ1vzf%2FWeHiX%2FvMXFhl7vzCOxiifQp7mvFK9G5O%2Bi7Q%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8ed535ccacd73855-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=25987&min_rtt=25987&rtt_var=12993&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=392&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
  • 172.67.192.176:80
    http://ddrtot.shop/MV3/PWS/fre.php
    http
    aspnet_compiler.exe
    883 B
    1.1kB
    6
    6

    HTTP Request

    POST http://ddrtot.shop/MV3/PWS/fre.php

    HTTP Response

    404
  • 172.67.192.176:80
    http://ddrtot.shop/MV3/PWS/fre.php
    http
    aspnet_compiler.exe
    689 B
    1.0kB
    6
    6

    HTTP Request

    POST http://ddrtot.shop/MV3/PWS/fre.php

    HTTP Response

    404
  • 172.67.192.176:80
    http://ddrtot.shop/MV3/PWS/fre.php
    http
    aspnet_compiler.exe
    662 B
    1.1kB
    6
    6

    HTTP Request

    POST http://ddrtot.shop/MV3/PWS/fre.php

    HTTP Response

    404
  • 172.67.192.176:80
    http://ddrtot.shop/MV3/PWS/fre.php
    http
    aspnet_compiler.exe
    662 B
    1.1kB
    6
    6

    HTTP Request

    POST http://ddrtot.shop/MV3/PWS/fre.php

    HTTP Response

    404
  • 172.67.192.176:80
    http://ddrtot.shop/MV3/PWS/fre.php
    http
    aspnet_compiler.exe
    662 B
    1.1kB
    6
    6

    HTTP Request

    POST http://ddrtot.shop/MV3/PWS/fre.php

    HTTP Response

    404
  • 8.8.8.8:53
    ddrtot.shop
    dns
    aspnet_compiler.exe
    57 B
    89 B
    1
    1

    DNS Request

    ddrtot.shop

    DNS Response

    172.67.192.176
    104.21.73.230

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2703099537-420551529-3771253338-1000\0f5007522459c86e95ffcc62f32308f1_4b15cc6c-8bd6-4727-90f6-cf303c4bde6d

    Filesize

    46B

    MD5

    d898504a722bff1524134c6ab6a5eaa5

    SHA1

    e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

    SHA256

    878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

    SHA512

    26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2703099537-420551529-3771253338-1000\0f5007522459c86e95ffcc62f32308f1_4b15cc6c-8bd6-4727-90f6-cf303c4bde6d

    Filesize

    46B

    MD5

    c07225d4e7d01d31042965f048728a0a

    SHA1

    69d70b340fd9f44c89adb9a2278df84faa9906b7

    SHA256

    8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

    SHA512

    23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

  • memory/2264-0-0x0000000073F4E000-0x0000000073F4F000-memory.dmp

    Filesize

    4KB

  • memory/2264-1-0x00000000012F0000-0x0000000001340000-memory.dmp

    Filesize

    320KB

  • memory/2264-2-0x0000000000BA0000-0x0000000000BDC000-memory.dmp

    Filesize

    240KB

  • memory/2264-3-0x0000000073F40000-0x000000007462E000-memory.dmp

    Filesize

    6.9MB

  • memory/2264-4-0x0000000000480000-0x000000000048A000-memory.dmp

    Filesize

    40KB

  • memory/2264-19-0x0000000073F40000-0x000000007462E000-memory.dmp

    Filesize

    6.9MB

  • memory/2404-15-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2404-18-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2404-13-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2404-11-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2404-9-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2404-7-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2404-6-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2404-17-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2404-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2404-38-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2404-47-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.