Analysis
- max time kernel
104s - max time network
107s - platform
windows10_x64 - resource
win10v20201028 - submitted
23/11/2020, 14:39
General
- Target dc6yuusd.exe
- Size 360KB
- Sample201123-ex3wblszyx
- SHA256 4b1f2c18b149fd0e878c362ffba50bb553d7bea93a795b33e398d032dc0b7663
Malware Config
Extracted
-
smokeloader
-
2020
-
http://penodux.com/xsmkld/index.php
-
http://tommusikirtyur.com/xsmkld/index.php
-
http://ploaernysannyer.com/xsmkld/index.php
-
http://dersmasfannyer.com/xsmkld/index.php
-
http://derdsgdannyer.com/xsmkld/index.php
Extracted
-
dridex
-
10444
-
175.126.167.148:443
-
173.249.20.233:8043
-
162.241.204.233:4443
-
138.122.143.40:8043
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- CryptOne packer 2 IoCs
Detects CryptOne packer defined in NCC blogpost.
- Dridex Loader 2 IoCs
Detects Dridex both x86 and x64 loader in memory.
- Executes dropped EXE 1 IoCs
- Deletes itself 1 IoCs
- Loads dropped DLL 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc6yuusd.exe"C:\Users\Admin\AppData\Local\Temp\dc6yuusd.exe"1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\D245.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\D245.dll2⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\DA45.exeC:\Users\Admin\AppData\Local\Temp\DA45.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/192-407-0x0000000000640000-0x0000000000647000-memory.dmp
memory/192-403-0x0000000000630000-0x000000000063D000-memory.dmp
memory/1512-272-0x0000000000E00000-0x0000000000E06000-memory.dmp
memory/1512-267-0x0000000000BF0000-0x0000000000BFC000-memory.dmp
memory/1736-20-0x00000000004C0000-0x00000000004C7000-memory.dmp
memory/1736-18-0x00000000004B0000-0x00000000004BC000-memory.dmp
memory/2072-361-0x0000000000C80000-0x0000000000C8B000-memory.dmp
memory/2072-367-0x0000000000C90000-0x0000000000C96000-memory.dmp
memory/2120-125-0x00000000033F0000-0x00000000033F7000-memory.dmp
memory/2120-124-0x00000000033E0000-0x00000000033EB000-memory.dmp
memory/2396-378-0x0000000001200000-0x000000000120B000-memory.dmp
memory/2396-649-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-127-0x0000000001210000-0x000000000121B000-memory.dmp
memory/2396-1040-0x0000000001210000-0x000000000121B000-memory.dmp
memory/2396-129-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-132-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-136-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-141-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-137-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-143-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-146-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-150-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-157-0x0000000001200000-0x000000000120B000-memory.dmp
memory/2396-152-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-155-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-159-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-163-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-167-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-1013-0x0000000001210000-0x000000000121B000-memory.dmp
memory/2396-824-0x0000000001210000-0x000000000121B000-memory.dmp
memory/2396-175-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-169-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-814-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-179-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-181-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-193-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-185-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-189-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-197-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-208-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-204-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-806-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-215-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-810-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-217-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-222-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-229-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-803-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-234-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-212-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-243-0x0000000001200000-0x000000000120B000-memory.dmp
memory/2396-248-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-242-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-799-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-237-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-254-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-795-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-790-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-275-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-283-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-288-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-292-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-271-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-427-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-260-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-300-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-297-0x0000000001200000-0x000000000120B000-memory.dmp
memory/2396-291-0x0000000001200000-0x000000000120B000-memory.dmp
memory/2396-786-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-430-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-306-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-326-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-321-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-782-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-420-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-333-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-337-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-343-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-354-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-359-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-365-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-349-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-14-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-369-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-778-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-775-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-375-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-387-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-391-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-381-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-772-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-767-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-396-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-10-0x0000000003150000-0x00000000031C5000-memory.dmp
memory/2396-398-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-402-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-411-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-408-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-417-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-1-0x0000000001060000-0x0000000001076000-memory.dmp
memory/2396-763-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-313-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-264-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-435-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-442-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-451-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-455-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-445-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-462-0x00000000011F0000-0x00000000011FB000-memory.dmp
memory/2396-474-0x0000000001210000-0x000000000121B000-memory.dmp
memory/2396-478-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-487-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-484-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-493-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-497-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-501-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-505-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-511-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-515-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-522-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-518-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-527-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-531-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-541-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-545-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-550-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-536-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-555-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-560-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-565-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-570-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-579-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-574-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-584-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-588-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-595-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-598-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-605-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-608-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-613-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-619-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-622-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-627-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-636-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-632-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-640-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-759-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-653-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-646-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-659-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-656-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-663-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-667-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-673-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-676-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-681-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-683-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-687-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-691-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-695-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-703-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-698-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-707-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-711-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-717-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-721-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-726-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-731-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-736-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-742-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-745-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-750-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2396-755-0x00000000011F0000-0x00000000011FA000-memory.dmp
memory/2520-74-0x0000000000BD0000-0x0000000000BDB000-memory.dmp
memory/2520-76-0x0000000000BE0000-0x0000000000BEA000-memory.dmp
memory/2660-317-0x0000000000740000-0x0000000000767000-memory.dmp
memory/2660-323-0x0000000000770000-0x0000000000792000-memory.dmp
memory/2916-6-0x0000000004E70000-0x0000000004EAD000-memory.dmp
memory/3408-170-0x00000000009C0000-0x00000000009CE000-memory.dmp
memory/3408-173-0x00000000009D0000-0x00000000009D9000-memory.dmp
memory/3444-12-0x0000000003600000-0x000000000366B000-memory.dmp
memory/3616-40-0x0000000010000000-0x000000001001D000-memory.dmp
memory/3940-216-0x0000000000CD0000-0x0000000000CD9000-memory.dmp
memory/3940-221-0x0000000000CE0000-0x0000000000CE5000-memory.dmp