Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/01/2025, 12:27
Static task
static1
Behavioral task
behavioral1
Sample
2025-01-31_d6ef21245b29bcb94aa1030e888c173b_smoke-loader_wapomi.exe
Resource
win7-20240903-en
General
-
Target
2025-01-31_d6ef21245b29bcb94aa1030e888c173b_smoke-loader_wapomi.exe
-
Size
80KB
-
MD5
d6ef21245b29bcb94aa1030e888c173b
-
SHA1
683c580e2c3af13f9c0116f5971aaf3c898a5b2c
-
SHA256
83ff583fa073675bace6d539d2ec940fcfd917a5f102b0b3cb490a4f91fab8ee
-
SHA512
8db92ebdc9f7d909a18d01ab45e5e52227e8477d467535252dfcc43d24bdba18fe3c2dcc84966f5851b8f95c4572d01f0dc70d94e54130eeda7464cb59809cfe
-
SSDEEP
1536:Yg/6/tM8NXDjPX0QWlfGMckTQMLGCq2iW7z:Hk3U8kTQaGCH
Malware Config
Extracted
bdaejec
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/2668-29-0x0000000000B40000-0x0000000000B49000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral1/files/0x0007000000012119-4.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 2668 QLZVMlIT.exe -
Loads dropped DLL 2 IoCs
pid Process 3004 2025-01-31_d6ef21245b29bcb94aa1030e888c173b_smoke-loader_wapomi.exe 3004 2025-01-31_d6ef21245b29bcb94aa1030e888c173b_smoke-loader_wapomi.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe QLZVMlIT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe QLZVMlIT.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{5EB8F02B-573C-439E-BE36-635B3B6563D9}\chrome_installer.exe QLZVMlIT.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE QLZVMlIT.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe QLZVMlIT.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe QLZVMlIT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe QLZVMlIT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe QLZVMlIT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe QLZVMlIT.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe QLZVMlIT.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe QLZVMlIT.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE QLZVMlIT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe QLZVMlIT.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe QLZVMlIT.exe File opened for modification C:\Program Files\Windows Journal\Journal.exe QLZVMlIT.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe QLZVMlIT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe QLZVMlIT.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe QLZVMlIT.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe QLZVMlIT.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE QLZVMlIT.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE QLZVMlIT.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE QLZVMlIT.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe QLZVMlIT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe QLZVMlIT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe QLZVMlIT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe QLZVMlIT.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe QLZVMlIT.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe QLZVMlIT.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe QLZVMlIT.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\sidebar.exe QLZVMlIT.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe QLZVMlIT.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE QLZVMlIT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe QLZVMlIT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe QLZVMlIT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe QLZVMlIT.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe QLZVMlIT.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe QLZVMlIT.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe QLZVMlIT.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe QLZVMlIT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe QLZVMlIT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe QLZVMlIT.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe QLZVMlIT.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE QLZVMlIT.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe QLZVMlIT.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE QLZVMlIT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe QLZVMlIT.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe QLZVMlIT.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe QLZVMlIT.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe QLZVMlIT.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe QLZVMlIT.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE QLZVMlIT.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE QLZVMlIT.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE QLZVMlIT.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe QLZVMlIT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe QLZVMlIT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe QLZVMlIT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe QLZVMlIT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe QLZVMlIT.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe QLZVMlIT.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE QLZVMlIT.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe QLZVMlIT.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe QLZVMlIT.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe QLZVMlIT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe QLZVMlIT.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-01-31_d6ef21245b29bcb94aa1030e888c173b_smoke-loader_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QLZVMlIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3004 wrote to memory of 2668 3004 2025-01-31_d6ef21245b29bcb94aa1030e888c173b_smoke-loader_wapomi.exe 30 PID 3004 wrote to memory of 2668 3004 2025-01-31_d6ef21245b29bcb94aa1030e888c173b_smoke-loader_wapomi.exe 30 PID 3004 wrote to memory of 2668 3004 2025-01-31_d6ef21245b29bcb94aa1030e888c173b_smoke-loader_wapomi.exe 30 PID 3004 wrote to memory of 2668 3004 2025-01-31_d6ef21245b29bcb94aa1030e888c173b_smoke-loader_wapomi.exe 30 PID 2668 wrote to memory of 2536 2668 QLZVMlIT.exe 31 PID 2668 wrote to memory of 2536 2668 QLZVMlIT.exe 31 PID 2668 wrote to memory of 2536 2668 QLZVMlIT.exe 31 PID 2668 wrote to memory of 2536 2668 QLZVMlIT.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-31_d6ef21245b29bcb94aa1030e888c173b_smoke-loader_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-31_d6ef21245b29bcb94aa1030e888c173b_smoke-loader_wapomi.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\QLZVMlIT.exeC:\Users\Admin\AppData\Local\Temp\QLZVMlIT.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\2d9a4709.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:2536
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
191B
MD5d5b84f49ece8d8d102650f2a1e93fcf3
SHA17ca32baf8b4342227f6727800b113b9aa969bb19
SHA256075c2697c4080c49ed3d675dd842a3c4f21e96d9bcf95c22a79f814cffeb3784
SHA5121709a375562881cc1f4d1e5847c4c93793f28d591c85e3c3a46649a2074163bb571071b9912adc663a64dbf7e57dbf7059e9a4e6ad21ce5bb52f36ee05ebe4de
-
Filesize
15KB
MD5f7d21de5c4e81341eccd280c11ddcc9a
SHA1d4e9ef10d7685d491583c6fa93ae5d9105d815bd
SHA2564485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
SHA512e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3