Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    02/01/2025, 12:58 UTC

General

  • Target

    2025-01-02_4eee65406b2d09df1fa5f4acdfbcae3a_smoke-loader_wapomi.exe

  • Size

    820KB

  • MD5

    4eee65406b2d09df1fa5f4acdfbcae3a

  • SHA1

    3bff4caafeb79c311078b67e9a1703dd229b2a82

  • SHA256

    dbeb578c366bac54e21557e07d3af90c757e134e1cf90ebe8fd799650fd3838f

  • SHA512

    749cdba975ee6aa1039a08a77cbf54677f8bb93abbaa374b82d0f5372877d1c2fc8a09aad0ff0e8f01dc5e939c3a6b3598552a41fd8ab7f5b3e69108cc461667

  • SSDEEP

    12288:In78aejEi7Qec2MDFs88z1y55r4cP43NC+HvnPmygtMqU0LbE8bKFZQLPkNmGKG+:+gEiXc22uz1y5ffx1t

Malware Config

Extracted

Family

bdaejec

C2

ddos.dnsnb8.net

Signatures

  • Bdaejec

    Bdaejec is a backdoor written in C++.

  • Bdaejec family
  • Detects Bdaejec Backdoor. 1 IoCs

    Bdaejec is backdoor written in C++.

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-02_4eee65406b2d09df1fa5f4acdfbcae3a_smoke-loader_wapomi.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-02_4eee65406b2d09df1fa5f4acdfbcae3a_smoke-loader_wapomi.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2448
    • C:\Users\Admin\AppData\Local\Temp\gKaEFX.exe
      C:\Users\Admin\AppData\Local\Temp\gKaEFX.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1880
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\64a660f5.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1128

Network

  • flag-us
    DNS
    ddos.dnsnb8.net
    gKaEFX.exe
    Remote address:
    8.8.8.8:53
    Request
    ddos.dnsnb8.net
    IN A
    Response
    ddos.dnsnb8.net
    IN A
    44.221.84.105
  • 44.221.84.105:799
    ddos.dnsnb8.net
    gKaEFX.exe
    152 B
    3
  • 44.221.84.105:799
    ddos.dnsnb8.net
    gKaEFX.exe
    152 B
    3
  • 44.221.84.105:799
    ddos.dnsnb8.net
    gKaEFX.exe
    152 B
    3
  • 44.221.84.105:799
    ddos.dnsnb8.net
    gKaEFX.exe
    152 B
    3
  • 44.221.84.105:799
    ddos.dnsnb8.net
    gKaEFX.exe
    152 B
    3
  • 8.8.8.8:53
    ddos.dnsnb8.net
    dns
    gKaEFX.exe
    61 B
    77 B
    1
    1

    DNS Request

    ddos.dnsnb8.net

    DNS Response

    44.221.84.105

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\64a660f5.bat

    Filesize

    187B

    MD5

    99440eeae8de50125b0eb781f8e6942a

    SHA1

    7c7f7b7f170ca094c0a04535fc4a2f084fae67ed

    SHA256

    ef6cc0d0c72902e6367cff3d1c03a0254d3626ad8f1e171526eb42b04733115b

    SHA512

    5342c8ba76cef46f18c587ea4be6aa39a7588c028f2ce30116cb34d2525b6b2c183e0b3e537507bd822715635626a363cf0c4bff282ecb3a08104fa44c6cdf57

  • \Users\Admin\AppData\Local\Temp\gKaEFX.exe

    Filesize

    15KB

    MD5

    56b2c3810dba2e939a8bb9fa36d3cf96

    SHA1

    99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

    SHA256

    4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

    SHA512

    27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

  • memory/1880-10-0x0000000000070000-0x0000000000079000-memory.dmp

    Filesize

    36KB

  • memory/1880-17-0x0000000000070000-0x0000000000079000-memory.dmp

    Filesize

    36KB

  • memory/2448-0-0x0000000000400000-0x00000000004D1000-memory.dmp

    Filesize

    836KB

  • memory/2448-11-0x0000000000280000-0x0000000000289000-memory.dmp

    Filesize

    36KB

  • memory/2448-9-0x0000000000280000-0x0000000000289000-memory.dmp

    Filesize

    36KB

  • memory/2448-15-0x0000000000400000-0x00000000004D1000-memory.dmp

    Filesize

    836KB

  • memory/2448-16-0x0000000000400000-0x00000000004D1000-memory.dmp

    Filesize

    836KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.