Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/11/2022, 10:36 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d07bb62ddd5c8c89186aad59a61b4fa2ee2568a09f2e3c5c87e032b6d02b7ffc.exe

  • Size

    163KB

  • MD5

    412d8a4986191920cee05f0c55cf1fed

  • SHA1

    da6806c0adb874042df0baa6c8829bd17df059b3

  • SHA256

    d07bb62ddd5c8c89186aad59a61b4fa2ee2568a09f2e3c5c87e032b6d02b7ffc

  • SHA512

    501df9e82369e92391ad6d3a52f4846260ce30c966ff70c5a6d676720627f324afcb7287da5f37e1854ad6ee757e723d81fcc2fa11b0880f15ed734f12882350

  • SSDEEP

    3072:i1hIYZK7PXKbH8H5npBYrHSKNDhxhTN9Qics7cjuhOU:ijZKb6bHuYryKN1vT8icMvhOU

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Signatures

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d07bb62ddd5c8c89186aad59a61b4fa2ee2568a09f2e3c5c87e032b6d02b7ffc.exe
    "C:\Users\Admin\AppData\Local\Temp\d07bb62ddd5c8c89186aad59a61b4fa2ee2568a09f2e3c5c87e032b6d02b7ffc.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:3020

Network

  • flag-unknown
    DNS
    host-file-host6.com
    Remote address:
    8.8.8.8:53
    Request
    host-file-host6.com
    IN A
    Response
    host-file-host6.com
    IN A
    84.21.172.159
  • flag-unknown
    POST
    http://host-file-host6.com/
    Remote address:
    84.21.172.159:80
    Request
    POST / HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-www-form-urlencoded
    Accept: */*
    Referer: http://bphwyabyko.com/
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
    Content-Length: 173
    Host: host-file-host6.com
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.20.2
    Date: Mon, 21 Nov 2022 10:37:22 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: close
  • flag-unknown
    DNS
    host-host-file8.com
    Remote address:
    8.8.8.8:53
    Request
    host-host-file8.com
    IN A
    Response
  • flag-unknown
    DNS
    host-host-file8.com
    Remote address:
    8.8.8.8:53
    Request
    host-host-file8.com
    IN A
    Response
  • flag-unknown
    DNS
    host-host-file8.com
    Remote address:
    8.8.8.8:53
    Request
    host-host-file8.com
    IN A
    Response
  • flag-unknown
    DNS
    host-host-file8.com
    Remote address:
    8.8.8.8:53
    Request
    host-host-file8.com
    IN A
    Response
  • 20.190.159.71:443
    260 B
     5
  • 84.21.172.159:80
    http://host-file-host6.com/
    http
    717 B
     402 B
     6
    5

    HTTP Request

    POST http://host-file-host6.com/

    HTTP Response

    200
  • 40.79.197.34:443
    322 B
     7
  • 104.80.225.205:443
    322 B
     7
  • 93.184.221.240:80
    322 B
     7
  • 8.8.8.8:53
    host-file-host6.com
    dns
    65 B
     81 B
     1
    1

    DNS Request

    host-file-host6.com

    DNS Response

    84.21.172.159

  • 8.8.8.8:53
    host-host-file8.com
    dns
    260 B
     260 B
     4
    4

    DNS Request

    host-host-file8.com

    DNS Request

    host-host-file8.com

    DNS Request

    host-host-file8.com

    DNS Request

    host-host-file8.com

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3020-132-0x0000000000848000-0x0000000000858000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3020-133-0x00000000007E0000-0x00000000007E9000-memory.dmp

    Filesize

    36KB

    Download

  • memory/3020-134-0x0000000000400000-0x000000000058E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3020-135-0x0000000000400000-0x000000000058E000-memory.dmp

    Filesize

    1.6MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.