Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

2249c62ed3...81.exe

windows7-x64

10

2249c62ed3...81.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    89s
  • max time network
    111s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2023, 00:52 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2249c62ed3af7eb83b5c760625fef481.exe

  • Size

    335KB

  • MD5

    2249c62ed3af7eb83b5c760625fef481

  • SHA1

    7ec60c334fa78c53b5d725148f0301774d12a110

  • SHA256

    3c8a8b7ee38ca80b90a4156e4f42341fc004f87219cea1e94dc947b441ba0d05

  • SHA512

    c50529e065bbb0147009f1d66c81637acdcc87bb70dcb2e2a21168554b55f7c62db6533522d987e24ad00a80606d3f8f9a33ee8cb723a13f0c3872832eff07b0

  • SSDEEP

    6144:e3nDoE2LR5OAEbk/9Gn6+32SD/vtSecwB:+0E4bOAEbMGnT32sNkwB

Score
10/10
smokeloaderpub6backdoortrojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub6

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/
rc4.i32
1
0x3b22e540
rc4.i32
1
0xa6b397e0

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Deletes itself 1 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2249c62ed3af7eb83b5c760625fef481.exe
    "C:\Users\Admin\AppData\Local\Temp\2249c62ed3af7eb83b5c760625fef481.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4240
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 372
      2⤵
      • Program crash
      PID:4708
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4240 -ip 4240
    1⤵
      PID:452

    Network

    • flag-us
      DNS
      82.177.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      82.177.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      175.178.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      175.178.17.96.in-addr.arpa
      IN PTR
      Response
      175.178.17.96.in-addr.arpa
      IN PTR
      a96-17-178-175deploystaticakamaitechnologiescom
    • flag-us
      DNS
      2.136.104.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      2.136.104.51.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      9.228.82.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      9.228.82.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      9.228.82.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      9.228.82.20.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      26.35.223.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      26.35.223.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      178.178.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      178.178.17.96.in-addr.arpa
      IN PTR
      Response
      178.178.17.96.in-addr.arpa
      IN PTR
      a96-17-178-178deploystaticakamaitechnologiescom
    • flag-us
      DNS
      18.31.95.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      18.31.95.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      18.31.95.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      18.31.95.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      100.5.17.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      100.5.17.2.in-addr.arpa
      IN PTR
      Response
      100.5.17.2.in-addr.arpa
      IN PTR
      a2-17-5-100deploystaticakamaitechnologiescom
    • flag-us
      DNS
      100.5.17.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      100.5.17.2.in-addr.arpa
      IN PTR
      Response
      100.5.17.2.in-addr.arpa
      IN PTR
      a2-17-5-100deploystaticakamaitechnologiescom
    • flag-us
      DNS
      119.110.54.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      119.110.54.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      119.110.54.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      119.110.54.20.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      11.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      11.227.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      11.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      11.227.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      217.135.221.88.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      217.135.221.88.in-addr.arpa
      IN PTR
      Response
      217.135.221.88.in-addr.arpa
      IN PTR
      a88-221-135-217deploystaticakamaitechnologiescom
    • flag-us
      DNS
      217.135.221.88.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      217.135.221.88.in-addr.arpa
      IN PTR
      Response
      217.135.221.88.in-addr.arpa
      IN PTR
      a88-221-135-217deploystaticakamaitechnologiescom
    • flag-us
      DNS
      174.178.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      174.178.17.96.in-addr.arpa
      IN PTR
      Response
      174.178.17.96.in-addr.arpa
      IN PTR
      a96-17-178-174deploystaticakamaitechnologiescom
    • flag-us
      DNS
      174.178.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      174.178.17.96.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      50.134.221.88.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      50.134.221.88.in-addr.arpa
      IN PTR
      Response
      50.134.221.88.in-addr.arpa
      IN PTR
      a88-221-134-50deploystaticakamaitechnologiescom
    • flag-us
      DNS
      50.134.221.88.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      50.134.221.88.in-addr.arpa
      IN PTR
      Response
      50.134.221.88.in-addr.arpa
      IN PTR
      a88-221-134-50deploystaticakamaitechnologiescom
    • 51.124.78.146:443
    • 96.16.110.41:443
    • 192.229.221.95:80
    • 20.12.23.50:443
    • 51.124.78.146:443
    • 51.124.78.146:443
    • 51.124.78.146:443
    • 138.91.171.81:80
      52 B
       1
    • 20.82.154.241:443
    • 20.12.23.50:443
    • 20.12.23.50:443
    • 96.16.110.114:80
    • 138.91.171.81:80
    • 20.3.187.198:443
    • 20.12.23.50:443
    • 96.16.110.114:80
    • 138.91.171.81:80
    • 20.12.23.50:443
    • 88.221.135.217:80
      46 B
       40 B
       1
      1
    • 52.111.227.11:443
      tls
      104 B
       2.8kB
       2
      2
    • 88.221.134.18:80
    • 20.12.23.50:443
    • 96.16.110.114:80
    • 88.221.135.217:80
    • 88.221.135.217:80
    • 88.221.135.217:80
    • 8.8.8.8:53
      82.177.190.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      82.177.190.20.in-addr.arpa

    • 8.8.8.8:53
      175.178.17.96.in-addr.arpa
      dns
      72 B
       137 B
       1
      1

      DNS Request

      175.178.17.96.in-addr.arpa

    • 8.8.8.8:53
      2.136.104.51.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      2.136.104.51.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      9.228.82.20.in-addr.arpa
      dns
      140 B
       156 B
       2
      1

      DNS Request

      9.228.82.20.in-addr.arpa

      DNS Request

      9.228.82.20.in-addr.arpa

    • 8.8.8.8:53
      26.35.223.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      26.35.223.20.in-addr.arpa

    • 8.8.8.8:53
    • 8.8.8.8:53
    • 8.8.8.8:53
    • 8.8.8.8:53
    • 8.8.8.8:53
    • 8.8.8.8:53
    • 8.8.8.8:53
    • 8.8.8.8:53
      178.178.17.96.in-addr.arpa
      dns
      72 B
       137 B
       1
      1

      DNS Request

      178.178.17.96.in-addr.arpa

    • 8.8.8.8:53
    • 8.8.8.8:53
    • 8.8.8.8:53
    • 8.8.8.8:53
    • 8.8.8.8:53
    • 8.8.8.8:53
    • 8.8.8.8:53
    • 8.8.8.8:53
    • 8.8.8.8:53
      18.31.95.13.in-addr.arpa
      dns
      140 B
       288 B
       2
      2

      DNS Request

      18.31.95.13.in-addr.arpa

      DNS Request

      18.31.95.13.in-addr.arpa

    • 8.8.8.8:53
    • 8.8.8.8:53
    • 8.8.8.8:53
    • 8.8.8.8:53
    • 8.8.8.8:53
    • 8.8.8.8:53
    • 8.8.8.8:53
    • 8.8.8.8:53
      100.5.17.2.in-addr.arpa
      dns
      138 B
       262 B
       2
      2

      DNS Request

      100.5.17.2.in-addr.arpa

      DNS Request

      100.5.17.2.in-addr.arpa

    • 8.8.8.8:53
      119.110.54.20.in-addr.arpa
      dns
      144 B
       158 B
       2
      1

      DNS Request

      119.110.54.20.in-addr.arpa

      DNS Request

      119.110.54.20.in-addr.arpa

    • 8.8.8.8:53
      11.227.111.52.in-addr.arpa
      dns
      144 B
       316 B
       2
      2

      DNS Request

      11.227.111.52.in-addr.arpa

      DNS Request

      11.227.111.52.in-addr.arpa

    • 8.8.8.8:53
      217.135.221.88.in-addr.arpa
      dns
      146 B
       278 B
       2
      2

      DNS Request

      217.135.221.88.in-addr.arpa

      DNS Request

      217.135.221.88.in-addr.arpa

    • 8.8.8.8:53
      174.178.17.96.in-addr.arpa
      dns
      144 B
       137 B
       2
      1

      DNS Request

      174.178.17.96.in-addr.arpa

      DNS Request

      174.178.17.96.in-addr.arpa

    • 8.8.8.8:53
    • 8.8.8.8:53
    • 8.8.8.8:53
      50.134.221.88.in-addr.arpa
      dns
      144 B
       274 B
       2
      2

      DNS Request

      50.134.221.88.in-addr.arpa

      DNS Request

      50.134.221.88.in-addr.arpa

    • 8.8.8.8:53
    • 8.8.8.8:53
    • 8.8.8.8:53

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3572-4-0x0000000002B50000-0x0000000002B66000-memory.dmp

      Filesize

      88KB

      Download

    • memory/4240-2-0x0000000004F90000-0x0000000004F99000-memory.dmp

      Filesize

      36KB

      Download

    • memory/4240-1-0x00000000032E0000-0x00000000033E0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/4240-3-0x0000000000400000-0x000000000324F000-memory.dmp

      Filesize

      46.3MB

      Download

    • memory/4240-7-0x0000000000400000-0x000000000324F000-memory.dmp

      Filesize

      46.3MB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.