Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/09/2022, 02:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    05a16e465c4aa7efcca992a294ba83fc2eac1d33cfa2af1faac0c70915fb1a97.exe

  • Size

    280KB

  • MD5

    9d8a4f0d70d2ad12ac594188364925a6

  • SHA1

    75494c299a585f663095885afac47c40a6d723b7

  • SHA256

    05a16e465c4aa7efcca992a294ba83fc2eac1d33cfa2af1faac0c70915fb1a97

  • SHA512

    87d513a6cdc70f0fb0c85f3447f2a56dc0ddfb646b6078ce07aaf3f727f5f4aa939cd60c8c32c14b10e7baa41456d04c5ac59ff781fb33bc2eaca383cf60cdbe

  • SSDEEP

    6144:80ZSGdyYDOTAK7e6EAnTcrZl0M21ulHZZQg:80FdyeOTAK7eycrZl0M24dE

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Signatures

  • Detects Smokeloader packer 6 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\05a16e465c4aa7efcca992a294ba83fc2eac1d33cfa2af1faac0c70915fb1a97.exe
    "C:\Users\Admin\AppData\Local\Temp\05a16e465c4aa7efcca992a294ba83fc2eac1d33cfa2af1faac0c70915fb1a97.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2400
    • C:\Users\Admin\AppData\Local\Temp\05a16e465c4aa7efcca992a294ba83fc2eac1d33cfa2af1faac0c70915fb1a97.exe
      "C:\Users\Admin\AppData\Local\Temp\05a16e465c4aa7efcca992a294ba83fc2eac1d33cfa2af1faac0c70915fb1a97.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:4416
  • C:\Users\Admin\AppData\Roaming\hejtsts
    C:\Users\Admin\AppData\Roaming\hejtsts
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3960
    • C:\Users\Admin\AppData\Roaming\hejtsts
      C:\Users\Admin\AppData\Roaming\hejtsts
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:4348

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\hejtsts
    Filesize

    280KB

    MD5

    9d8a4f0d70d2ad12ac594188364925a6

    SHA1

    75494c299a585f663095885afac47c40a6d723b7

    SHA256

    05a16e465c4aa7efcca992a294ba83fc2eac1d33cfa2af1faac0c70915fb1a97

    SHA512

    87d513a6cdc70f0fb0c85f3447f2a56dc0ddfb646b6078ce07aaf3f727f5f4aa939cd60c8c32c14b10e7baa41456d04c5ac59ff781fb33bc2eaca383cf60cdbe

    Download Submit

  • C:\Users\Admin\AppData\Roaming\hejtsts
    Filesize

    280KB

    MD5

    9d8a4f0d70d2ad12ac594188364925a6

    SHA1

    75494c299a585f663095885afac47c40a6d723b7

    SHA256

    05a16e465c4aa7efcca992a294ba83fc2eac1d33cfa2af1faac0c70915fb1a97

    SHA512

    87d513a6cdc70f0fb0c85f3447f2a56dc0ddfb646b6078ce07aaf3f727f5f4aa939cd60c8c32c14b10e7baa41456d04c5ac59ff781fb33bc2eaca383cf60cdbe

    Download Submit

  • C:\Users\Admin\AppData\Roaming\hejtsts
    Filesize

    280KB

    MD5

    9d8a4f0d70d2ad12ac594188364925a6

    SHA1

    75494c299a585f663095885afac47c40a6d723b7

    SHA256

    05a16e465c4aa7efcca992a294ba83fc2eac1d33cfa2af1faac0c70915fb1a97

    SHA512

    87d513a6cdc70f0fb0c85f3447f2a56dc0ddfb646b6078ce07aaf3f727f5f4aa939cd60c8c32c14b10e7baa41456d04c5ac59ff781fb33bc2eaca383cf60cdbe

    Download Submit

  • memory/2400-135-0x0000000000630000-0x0000000000639000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2400-134-0x0000000000658000-0x0000000000669000-memory.dmp

    Filesize

    68KB

    Download

  • memory/3960-143-0x00000000009B8000-0x00000000009C8000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4348-144-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/4348-145-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/4416-136-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/4416-137-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/4416-133-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download