Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/01/2025, 02:33
Static task
static1
Behavioral task
behavioral1
Sample
2025-01-21_276ac3b2560fe493b71e1bdccbcf7778_icedid_smoke-loader_wapomi.exe
Resource
win7-20240903-en
General
-
Target
2025-01-21_276ac3b2560fe493b71e1bdccbcf7778_icedid_smoke-loader_wapomi.exe
-
Size
640KB
-
MD5
276ac3b2560fe493b71e1bdccbcf7778
-
SHA1
8b98f8b35ec30086a7c877089baff0ffb15b83fb
-
SHA256
2914e42c6297fbaa619b482a24443b1956e9297f79bddd4c2092e1744e545aed
-
SHA512
a594485a4e8ce5db777e2e73e15e1ec1f07c110232be5a208208fe48dddd04e7d3e8cbcb3af8bfd2b39dfa0cec8168095469eaaa8ab5c36029ca92d904d319ec
-
SSDEEP
12288:hJUvxKcxpJ6HL3D0jwiZcaKqqnfrjSZYqWP8Eq7tbgVv09smaM:U3xQDdiZcaKZYkq7tbg9
Malware Config
Extracted
bdaejec
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/2672-31-0x0000000000030000-0x0000000000039000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral1/files/0x0007000000012116-7.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 2672 qJeYHE.exe -
Loads dropped DLL 5 IoCs
pid Process 2392 2025-01-21_276ac3b2560fe493b71e1bdccbcf7778_icedid_smoke-loader_wapomi.exe 2392 2025-01-21_276ac3b2560fe493b71e1bdccbcf7778_icedid_smoke-loader_wapomi.exe 2672 qJeYHE.exe 2672 qJeYHE.exe 2672 qJeYHE.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe qJeYHE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe qJeYHE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe qJeYHE.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe qJeYHE.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe qJeYHE.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE qJeYHE.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe qJeYHE.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe qJeYHE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe qJeYHE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe qJeYHE.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe qJeYHE.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe qJeYHE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe qJeYHE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe qJeYHE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe qJeYHE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe qJeYHE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe qJeYHE.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe qJeYHE.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE qJeYHE.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE qJeYHE.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE qJeYHE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe qJeYHE.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe qJeYHE.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe qJeYHE.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe qJeYHE.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe qJeYHE.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe qJeYHE.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE qJeYHE.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE qJeYHE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe qJeYHE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe qJeYHE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe qJeYHE.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe qJeYHE.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe qJeYHE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe qJeYHE.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe qJeYHE.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe qJeYHE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe qJeYHE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe qJeYHE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe qJeYHE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe qJeYHE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe qJeYHE.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe qJeYHE.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe qJeYHE.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe qJeYHE.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE qJeYHE.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe qJeYHE.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe qJeYHE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe qJeYHE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe qJeYHE.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe qJeYHE.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe qJeYHE.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE qJeYHE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe qJeYHE.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe qJeYHE.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe qJeYHE.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe qJeYHE.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE qJeYHE.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe qJeYHE.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe qJeYHE.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe qJeYHE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe qJeYHE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe qJeYHE.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe qJeYHE.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log 2025-01-21_276ac3b2560fe493b71e1bdccbcf7778_icedid_smoke-loader_wapomi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-01-21_276ac3b2560fe493b71e1bdccbcf7778_icedid_smoke-loader_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qJeYHE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2392 2025-01-21_276ac3b2560fe493b71e1bdccbcf7778_icedid_smoke-loader_wapomi.exe 2392 2025-01-21_276ac3b2560fe493b71e1bdccbcf7778_icedid_smoke-loader_wapomi.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2392 wrote to memory of 2672 2392 2025-01-21_276ac3b2560fe493b71e1bdccbcf7778_icedid_smoke-loader_wapomi.exe 30 PID 2392 wrote to memory of 2672 2392 2025-01-21_276ac3b2560fe493b71e1bdccbcf7778_icedid_smoke-loader_wapomi.exe 30 PID 2392 wrote to memory of 2672 2392 2025-01-21_276ac3b2560fe493b71e1bdccbcf7778_icedid_smoke-loader_wapomi.exe 30 PID 2392 wrote to memory of 2672 2392 2025-01-21_276ac3b2560fe493b71e1bdccbcf7778_icedid_smoke-loader_wapomi.exe 30 PID 2392 wrote to memory of 2672 2392 2025-01-21_276ac3b2560fe493b71e1bdccbcf7778_icedid_smoke-loader_wapomi.exe 30 PID 2392 wrote to memory of 2672 2392 2025-01-21_276ac3b2560fe493b71e1bdccbcf7778_icedid_smoke-loader_wapomi.exe 30 PID 2392 wrote to memory of 2672 2392 2025-01-21_276ac3b2560fe493b71e1bdccbcf7778_icedid_smoke-loader_wapomi.exe 30 PID 2672 wrote to memory of 2588 2672 qJeYHE.exe 31 PID 2672 wrote to memory of 2588 2672 qJeYHE.exe 31 PID 2672 wrote to memory of 2588 2672 qJeYHE.exe 31 PID 2672 wrote to memory of 2588 2672 qJeYHE.exe 31 PID 2672 wrote to memory of 2588 2672 qJeYHE.exe 31 PID 2672 wrote to memory of 2588 2672 qJeYHE.exe 31 PID 2672 wrote to memory of 2588 2672 qJeYHE.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-21_276ac3b2560fe493b71e1bdccbcf7778_icedid_smoke-loader_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-21_276ac3b2560fe493b71e1bdccbcf7778_icedid_smoke-loader_wapomi.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\qJeYHE.exeC:\Users\Admin\AppData\Local\Temp\qJeYHE.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\34c77f7a.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:2588
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD572d320df720657a8fb1ea13f7dcdb6e2
SHA1e056524e2159c4dad2a925f468afb5a3019e1bb2
SHA2561860f37d1b61da141de153301ef31c3074b93dcc4ac5eb910f407d0f22ae2ffe
SHA512a9d59f3a15178ead68d93109cdc4cf3194cee6a4d2c63828648a9267092b461bff92357140f08121b2f705c5a028e4b4357c73fd977473d4c7b0afdd3d764c27
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e