Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

3aa10c4235...6c.exe

windows7-x64

10

3aa10c4235...6c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05/04/2024, 01:45 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3aa10c423534ff2d40c7dea7eec430677de9f09a05e8176094325d52b63ffd6c.exe

  • Size

    289KB

  • MD5

    72ff63bdf42abfedc8f625b46d6f61c9

  • SHA1

    803bb0b47e83a9b40bd127f4987e7c4d7161e81d

  • SHA256

    3aa10c423534ff2d40c7dea7eec430677de9f09a05e8176094325d52b63ffd6c

  • SHA512

    756c04247e83bad1ba7544ee07da4acb883294a92065a8d1cac087858f056d71400a1229e4e1709d3a71cbd65faa9702d1153ab5f47e29ca0d25471c04f7b9f1

  • SSDEEP

    3072:m7tOMmPJYu491s1wTrPpiZADE9h+WGWld5c0xEVKZ6OKKs6vg33qN:m0dRYu4915pBMQWGACyEcNPg33q

Score
10/10
smokeloaderpub3backdoortrojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://nidoe.org/tmp/index.php

http://sodez.ru/tmp/index.php

http://uama.com.ua/tmp/index.php

http://talesofpirates.net/tmp/index.php
rc4.i32
1
0x3b22e540
rc4.i32
1
0xa6b397e0

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Deletes itself 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3aa10c423534ff2d40c7dea7eec430677de9f09a05e8176094325d52b63ffd6c.exe
    "C:\Users\Admin\AppData\Local\Temp\3aa10c423534ff2d40c7dea7eec430677de9f09a05e8176094325d52b63ffd6c.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1908

Network

  • flag-us
    DNS
    nidoe.org
    Remote address:
    8.8.8.8:53
    Request
    nidoe.org
    IN A
    Response
    nidoe.org
    IN A
    222.127.60.34
    nidoe.org
    IN A
    186.182.55.44
    nidoe.org
    IN A
    183.100.39.16
    nidoe.org
    IN A
    181.129.118.140
    nidoe.org
    IN A
    187.209.156.187
    nidoe.org
    IN A
    186.13.17.220
    nidoe.org
    IN A
    116.58.10.59
    nidoe.org
    IN A
    211.181.24.132
    nidoe.org
    IN A
    93.136.126.222
    nidoe.org
    IN A
    2.180.10.7
  • flag-us
    DNS
    nidoe.org
    Remote address:
    8.8.8.8:53
    Request
    nidoe.org
    IN A
    Response
    nidoe.org
    IN A
    93.136.126.222
    nidoe.org
    IN A
    2.180.10.7
    nidoe.org
    IN A
    222.127.60.34
    nidoe.org
    IN A
    186.182.55.44
    nidoe.org
    IN A
    183.100.39.16
    nidoe.org
    IN A
    181.129.118.140
    nidoe.org
    IN A
    187.209.156.187
    nidoe.org
    IN A
    186.13.17.220
    nidoe.org
    IN A
    116.58.10.59
    nidoe.org
    IN A
    211.181.24.132
  • flag-us
    DNS
    nidoe.org
    Remote address:
    8.8.8.8:53
    Request
    nidoe.org
    IN A
    Response
    nidoe.org
    IN A
    186.182.55.44
    nidoe.org
    IN A
    183.100.39.16
    nidoe.org
    IN A
    181.129.118.140
    nidoe.org
    IN A
    187.209.156.187
    nidoe.org
    IN A
    186.13.17.220
    nidoe.org
    IN A
    116.58.10.59
    nidoe.org
    IN A
    211.181.24.132
    nidoe.org
    IN A
    93.136.126.222
    nidoe.org
    IN A
    2.180.10.7
    nidoe.org
    IN A
    222.127.60.34
  • flag-us
    DNS
    nidoe.org
    Remote address:
    8.8.8.8:53
    Request
    nidoe.org
    IN A
  • flag-ph
    POST
    http://nidoe.org/tmp/index.php
    Remote address:
    222.127.60.34:80
    Request
    POST /tmp/index.php HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-www-form-urlencoded
    Accept: */*
    Referer: http://plhkuqtsscrkhs.com/
    User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
    Content-Length: 251
    Host: nidoe.org
    Response
    HTTP/1.0 404 Not Found
    Date: Fri, 05 Apr 2024 01:46:11 GMT
    Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15
    X-Powered-By: PHP/7.4.15
    Content-Length: 8
    Connection: close
    Content-Type: text/html; charset=utf-8
  • flag-ph
    POST
    http://nidoe.org/tmp/index.php
    Remote address:
    222.127.60.34:80
    Request
    POST /tmp/index.php HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-www-form-urlencoded
    Accept: */*
    Referer: http://lagwyrncivsso.com/
    User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
    Content-Length: 360
    Host: nidoe.org
    Response
    HTTP/1.0 404 Not Found
    Date: Fri, 05 Apr 2024 01:46:16 GMT
    Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15
    X-Powered-By: PHP/7.4.15
    Content-Length: 340
    Connection: close
    Content-Type: text/html; charset=utf-8
  • flag-ph
    POST
    http://nidoe.org/tmp/index.php
    Remote address:
    222.127.60.34:80
    Request
    POST /tmp/index.php HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-www-form-urlencoded
    Accept: */*
    Referer: http://wkbnmvmnojg.org/
    User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
    Content-Length: 307
    Host: nidoe.org
    Response
    HTTP/1.0 404 Not Found
    Date: Fri, 05 Apr 2024 01:46:18 GMT
    Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15
    X-Powered-By: PHP/7.4.15
    Content-Length: 340
    Connection: close
    Content-Type: text/html; charset=utf-8
  • flag-ph
    POST
    http://nidoe.org/tmp/index.php
    Remote address:
    222.127.60.34:80
    Request
    POST /tmp/index.php HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-www-form-urlencoded
    Accept: */*
    Referer: http://sggerdexacdxkn.org/
    User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
    Content-Length: 224
    Host: nidoe.org
    Response
    HTTP/1.0 404 Not Found
    Date: Fri, 05 Apr 2024 01:46:20 GMT
    Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15
    X-Powered-By: PHP/7.4.15
    Content-Length: 340
    Connection: close
    Content-Type: text/html; charset=utf-8
  • flag-ph
    POST
    http://nidoe.org/tmp/index.php
    Remote address:
    222.127.60.34:80
    Request
    POST /tmp/index.php HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-www-form-urlencoded
    Accept: */*
    Referer: http://ahttqfligyq.com/
    User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
    Content-Length: 295
    Host: nidoe.org
    Response
    HTTP/1.0 404 Not Found
    Date: Fri, 05 Apr 2024 01:46:21 GMT
    Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15
    X-Powered-By: PHP/7.4.15
    Content-Length: 340
    Connection: close
    Content-Type: text/html; charset=utf-8
  • flag-ph
    POST
    http://nidoe.org/tmp/index.php
    Remote address:
    222.127.60.34:80
    Request
    POST /tmp/index.php HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-www-form-urlencoded
    Accept: */*
    Referer: http://nnyqjhllifmnn.org/
    User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
    Content-Length: 204
    Host: nidoe.org
    Response
    HTTP/1.0 404 Not Found
    Date: Fri, 05 Apr 2024 01:46:23 GMT
    Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15
    X-Powered-By: PHP/7.4.15
    Content-Length: 340
    Connection: close
    Content-Type: text/html; charset=utf-8
  • flag-ph
    POST
    http://nidoe.org/tmp/index.php
    Remote address:
    222.127.60.34:80
    Request
    POST /tmp/index.php HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-www-form-urlencoded
    Accept: */*
    Referer: http://wajkkugyomqk.org/
    User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
    Content-Length: 233
    Host: nidoe.org
    Response
    HTTP/1.0 404 Not Found
    Date: Fri, 05 Apr 2024 01:46:25 GMT
    Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15
    X-Powered-By: PHP/7.4.15
    Content-Length: 340
    Connection: close
    Content-Type: text/html; charset=utf-8
  • flag-ph
    POST
    http://nidoe.org/tmp/index.php
    Remote address:
    222.127.60.34:80
    Request
    POST /tmp/index.php HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-www-form-urlencoded
    Accept: */*
    Referer: http://wvdguqmsnsocehrj.net/
    User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
    Content-Length: 125
    Host: nidoe.org
    Response
    HTTP/1.0 404 Not Found
    Date: Fri, 05 Apr 2024 01:46:26 GMT
    Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15
    X-Powered-By: PHP/7.4.15
    Content-Length: 340
    Connection: close
    Content-Type: text/html; charset=utf-8
  • flag-ph
    POST
    http://nidoe.org/tmp/index.php
    Remote address:
    222.127.60.34:80
    Request
    POST /tmp/index.php HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-www-form-urlencoded
    Accept: */*
    Referer: http://dlnifftynpjbv.net/
    User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
    Content-Length: 356
    Host: nidoe.org
    Response
    HTTP/1.0 404 Not Found
    Date: Fri, 05 Apr 2024 01:46:29 GMT
    Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15
    X-Powered-By: PHP/7.4.15
    Content-Length: 340
    Connection: close
    Content-Type: text/html; charset=utf-8
  • flag-ph
    POST
    http://nidoe.org/tmp/index.php
    Remote address:
    222.127.60.34:80
    Request
    POST /tmp/index.php HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-www-form-urlencoded
    Accept: */*
    Referer: http://svlsjhtgmvjpassh.com/
    User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
    Content-Length: 272
    Host: nidoe.org
    Response
    HTTP/1.0 404 Not Found
    Date: Fri, 05 Apr 2024 01:46:30 GMT
    Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15
    X-Powered-By: PHP/7.4.15
    Content-Length: 340
    Connection: close
    Content-Type: text/html; charset=utf-8
  • flag-ph
    POST
    http://nidoe.org/tmp/index.php
    Remote address:
    222.127.60.34:80
    Request
    POST /tmp/index.php HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-www-form-urlencoded
    Accept: */*
    Referer: http://nlrejhdakwxi.net/
    User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
    Content-Length: 328
    Host: nidoe.org
    Response
    HTTP/1.0 404 Not Found
    Date: Fri, 05 Apr 2024 01:46:32 GMT
    Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15
    X-Powered-By: PHP/7.4.15
    Content-Length: 340
    Connection: close
    Content-Type: text/html; charset=utf-8
  • flag-ph
    POST
    http://nidoe.org/tmp/index.php
    Remote address:
    222.127.60.34:80
    Request
    POST /tmp/index.php HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-www-form-urlencoded
    Accept: */*
    Referer: http://yhvtpvcnlyghlrl.com/
    User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
    Content-Length: 350
    Host: nidoe.org
    Response
    HTTP/1.0 404 Not Found
    Date: Fri, 05 Apr 2024 01:46:33 GMT
    Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15
    X-Powered-By: PHP/7.4.15
    Content-Length: 340
    Connection: close
    Content-Type: text/html; charset=utf-8
  • flag-ph
    POST
    http://nidoe.org/tmp/index.php
    Remote address:
    222.127.60.34:80
    Request
    POST /tmp/index.php HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-www-form-urlencoded
    Accept: */*
    Referer: http://gbheuwynyyred.net/
    User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
    Content-Length: 286
    Host: nidoe.org
    Response
    HTTP/1.0 404 Not Found
    Date: Fri, 05 Apr 2024 01:46:35 GMT
    Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15
    X-Powered-By: PHP/7.4.15
    Content-Length: 340
    Connection: close
    Content-Type: text/html; charset=utf-8
  • 222.127.60.34:80
    http://nidoe.org/tmp/index.php
    http
    853 B
     465 B
     7
    5

    HTTP Request

    POST http://nidoe.org/tmp/index.php

    HTTP Response

    404
  • 222.127.60.34:80
    http://nidoe.org/tmp/index.php
    http
    961 B
     799 B
     7
    5

    HTTP Request

    POST http://nidoe.org/tmp/index.php

    HTTP Response

    404
  • 222.127.60.34:80
    http://nidoe.org/tmp/index.php
    http
    854 B
     799 B
     6
    5

    HTTP Request

    POST http://nidoe.org/tmp/index.php

    HTTP Response

    404
  • 222.127.60.34:80
    http://nidoe.org/tmp/index.php
    http
    774 B
     799 B
     6
    5

    HTTP Request

    POST http://nidoe.org/tmp/index.php

    HTTP Response

    404
  • 222.127.60.34:80
    http://nidoe.org/tmp/index.php
    http
    842 B
     799 B
     6
    5

    HTTP Request

    POST http://nidoe.org/tmp/index.php

    HTTP Response

    404
  • 222.127.60.34:80
    http://nidoe.org/tmp/index.php
    http
    753 B
     799 B
     6
    5

    HTTP Request

    POST http://nidoe.org/tmp/index.php

    HTTP Response

    404
  • 222.127.60.34:80
    http://nidoe.org/tmp/index.php
    http
    781 B
     799 B
     6
    5

    HTTP Request

    POST http://nidoe.org/tmp/index.php

    HTTP Response

    404
  • 222.127.60.34:80
    http://nidoe.org/tmp/index.php
    http
    677 B
     799 B
     6
    5

    HTTP Request

    POST http://nidoe.org/tmp/index.php

    HTTP Response

    404
  • 222.127.60.34:80
    http://nidoe.org/tmp/index.php
    http
    1.6kB
     851 B
     8
    6

    HTTP Request

    POST http://nidoe.org/tmp/index.php

    HTTP Response

    404
  • 222.127.60.34:80
    http://nidoe.org/tmp/index.php
    http
    824 B
     799 B
     6
    5

    HTTP Request

    POST http://nidoe.org/tmp/index.php

    HTTP Response

    404
  • 222.127.60.34:80
    http://nidoe.org/tmp/index.php
    http
    876 B
     799 B
     6
    5

    HTTP Request

    POST http://nidoe.org/tmp/index.php

    HTTP Response

    404
  • 222.127.60.34:80
    http://nidoe.org/tmp/index.php
    http
    901 B
     799 B
     6
    5

    HTTP Request

    POST http://nidoe.org/tmp/index.php

    HTTP Response

    404
  • 222.127.60.34:80
    http://nidoe.org/tmp/index.php
    http
    835 B
     799 B
     6
    5

    HTTP Request

    POST http://nidoe.org/tmp/index.php

    HTTP Response

    404
  • 8.8.8.8:53
    nidoe.org
    dns
    220 B
     645 B
     4
    3

    DNS Request

    nidoe.org

    DNS Request

    nidoe.org

    DNS Request

    nidoe.org

    DNS Request

    nidoe.org

    DNS Response

    222.127.60.34
    186.182.55.44
    183.100.39.16
    181.129.118.140
    187.209.156.187
    186.13.17.220
    116.58.10.59
    211.181.24.132
    93.136.126.222
    2.180.10.7

    DNS Response

    93.136.126.222
    2.180.10.7
    222.127.60.34
    186.182.55.44
    183.100.39.16
    181.129.118.140
    187.209.156.187
    186.13.17.220
    116.58.10.59
    211.181.24.132

    DNS Response

    186.182.55.44
    183.100.39.16
    181.129.118.140
    187.209.156.187
    186.13.17.220
    116.58.10.59
    211.181.24.132
    93.136.126.222
    2.180.10.7
    222.127.60.34

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1288-4-0x0000000002C40000-0x0000000002C56000-memory.dmp

    Filesize

    88KB

    Download

  • memory/1908-1-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1908-2-0x00000000001B0000-0x00000000001BB000-memory.dmp

    Filesize

    44KB

    Download

  • memory/1908-3-0x0000000000400000-0x0000000002B72000-memory.dmp

    Filesize

    39.4MB

    Download

  • memory/1908-5-0x0000000000400000-0x0000000002B72000-memory.dmp

    Filesize

    39.4MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.