Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

dridex

windows10-1703-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    130s
  • platform
    windows10-1703_x64
  • resource
    win10-20230915-en
  • resource tags

    arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
  • submitted
    10/10/2023, 04:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    efd2a3ddbf2b7e68a8f3359865dfcd6fd1403fb7d1dc945aa7aa4ccb50284ee7.exe

  • Size

    206KB

  • MD5

    a9f00edf2f2bda2e9c5c3df403cbc2a7

  • SHA1

    6f06fee048575ed11ef0c7f4bc55462131a1695d

  • SHA256

    efd2a3ddbf2b7e68a8f3359865dfcd6fd1403fb7d1dc945aa7aa4ccb50284ee7

  • SHA512

    e03c7a3fd073bb4e6afd614d83c62483a9e17500c76a92b2bf91ffcc0ac54983723a1fb83f0e9ea28f46c5c822a106d7224415a915000a0c30e31d8d90bbedca

  • SSDEEP

    3072:ZHXDogD65oyY99krdEVnSUptI2u66I0G1QGDS2Ko3Bjy51RT9:FDnD+YLkC/C2DRQGDS2Ko3Bj0T

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://dublebomber.ru/

http://yavasponimayu.ru/

http://nomnetozhedenyuzhkanuzhna.ru/

http://prostosmeritesya.ru/

http://ipoluchayteudovolstvie.ru/

http://super777bomba.ru/

http://specnaznachenie.ru/

http://zakrylki809.ru/

http://propertyminsk.by/

http://iloveua.ir/

http://moyabelorussiya.by/

http://tvoyaradostetoya.ru/

http://zasadacafe.by/

http://restmantra.by/

http://kozachok777.ru/

http://propertyiran.ir/

http://sakentoshi.ru/

http://popuasyfromua.ru/

http://diplombar.by/
rc4.i32
rc4.i32

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Deletes itself 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\efd2a3ddbf2b7e68a8f3359865dfcd6fd1403fb7d1dc945aa7aa4ccb50284ee7.exe
    "C:\Users\Admin\AppData\Local\Temp\efd2a3ddbf2b7e68a8f3359865dfcd6fd1403fb7d1dc945aa7aa4ccb50284ee7.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2332

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2332-1-0x0000000002DC0000-0x0000000002EC0000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2332-2-0x0000000000400000-0x0000000002BD0000-memory.dmp

    Filesize

    39.8MB

    Download

  • memory/2332-3-0x0000000002BF0000-0x0000000002BFB000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2332-5-0x0000000000400000-0x0000000002BD0000-memory.dmp

    Filesize

    39.8MB

    Download

  • memory/3248-4-0x0000000001290000-0x00000000012A6000-memory.dmp

    Filesize

    88KB

    Download