Analysis
- max time kernel
132s - max time network
145s - platform
windows7_x64 - resource
win7v20201028 - submitted
23/11/2020, 18:36
General
- Target inv_112020_65098.pif.exe
- Size 656KB
- Sample201123-nn191jmxse
- SHA256 7af038d2f4f41c0d130aaa1e4557d821e2b7f4c6bda2be44300e229cd5c721df
Malware Config
Extracted
-
smokeloader
-
2020
-
http://penodux.com/xsmkld/index.php
-
http://tommusikirtyur.com/xsmkld/index.php
-
http://ploaernysannyer.com/xsmkld/index.php
-
http://dersmasfannyer.com/xsmkld/index.php
-
http://derdsgdannyer.com/xsmkld/index.php
Extracted
-
dridex
-
10444
-
175.126.167.148:443
-
173.249.20.233:8043
-
162.241.204.233:4443
-
138.122.143.40:8043
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- CryptOne packer 2 IoCs
Detects CryptOne packer defined in NCC blogpost.
- Dridex Loader 2 IoCs
Detects Dridex both x86 and x64 loader in memory.
- Executes dropped EXE 1 IoCs
- Deletes itself 1 IoCs
- Loads dropped DLL 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 11 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 45 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\inv_112020_65098.pif.exe"C:\Users\Admin\AppData\Local\Temp\inv_112020_65098.pif.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\inv_112020_65098.pif.exe"C:\Users\Admin\AppData\Local\Temp\inv_112020_65098.pif.exe"2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\EA20.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\EA20.dll2⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\F1FE.exeC:\Users\Admin\AppData\Local\Temp\F1FE.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/336-14-0x0000000010000000-0x000000001001D000-memory.dmp
memory/336-11-0x0000000074670000-0x0000000074813000-memory.dmp
memory/436-8-0x0000000000980000-0x00000000009BD000-memory.dmp
memory/628-15-0x00000000000D0000-0x000000000013B000-memory.dmp
memory/628-16-0x0000000000140000-0x00000000001B5000-memory.dmp
memory/884-0-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1184-317-0x00000000000F0000-0x00000000000F6000-memory.dmp
memory/1184-313-0x00000000000E0000-0x00000000000EC000-memory.dmp
memory/1244-221-0x0000000000060000-0x000000000006E000-memory.dmp
memory/1268-628-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-639-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-58-0x0000000002AF0000-0x0000000002AF7000-memory.dmp
memory/1268-605-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-606-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-607-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-183-0x0000000002AF0000-0x0000000002AFA000-memory.dmp
memory/1268-608-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-609-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-610-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-215-0x0000000002B00000-0x0000000002B09000-memory.dmp
memory/1268-611-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-612-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-241-0x0000000002B00000-0x0000000002B09000-memory.dmp
memory/1268-613-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-614-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-615-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-300-0x0000000002B00000-0x0000000002B09000-memory.dmp
memory/1268-21-0x0000000002AF0000-0x0000000002AF7000-memory.dmp
memory/1268-616-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-617-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-337-0x0000000002B00000-0x0000000002B09000-memory.dmp
memory/1268-618-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-619-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-621-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-622-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-623-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-624-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-625-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-626-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-627-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-620-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-640-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-57-0x0000000002AF0000-0x0000000002AF7000-memory.dmp
memory/1268-638-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-637-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-636-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-635-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-634-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-633-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-632-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-631-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-630-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-629-0x0000000002AF0000-0x0000000002AF6000-memory.dmp
memory/1268-3-0x0000000002BA0000-0x0000000002BB6000-memory.dmp
memory/1312-23-0x0000000000060000-0x000000000006C000-memory.dmp
memory/1692-186-0x0000000000080000-0x000000000008B000-memory.dmp
memory/1692-187-0x00000000000D0000-0x00000000000D7000-memory.dmp
memory/1744-350-0x00000000000C0000-0x00000000000E7000-memory.dmp
memory/1744-353-0x00000000000F0000-0x0000000000112000-memory.dmp
memory/1848-259-0x00000000000D0000-0x00000000000D5000-memory.dmp
memory/1848-256-0x00000000000C0000-0x00000000000C9000-memory.dmp
memory/1904-483-0x0000000000080000-0x000000000008B000-memory.dmp
memory/1904-484-0x0000000000090000-0x0000000000096000-memory.dmp
memory/1908-12-0x000007FEF6510000-0x000007FEF678A000-memory.dmp
memory/1988-539-0x0000000000060000-0x000000000006D000-memory.dmp
memory/1988-541-0x0000000000070000-0x0000000000077000-memory.dmp
memory/1988-60-0x00000000000C0000-0x00000000000CB000-memory.dmp
memory/1988-61-0x00000000000D0000-0x00000000000DA000-memory.dmp