Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    17/10/2022, 02:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    391e57083b6f4248eefc55aeb270b12f337e49f1f72d3b0904d6e56b8ebba2bd.exe

  • Size

    226KB

  • MD5

    7ec254f99c0cd555e7f9eb1a3a07a47c

  • SHA1

    dd93536caf74b631948051a0fef0f91793a7ce77

  • SHA256

    391e57083b6f4248eefc55aeb270b12f337e49f1f72d3b0904d6e56b8ebba2bd

  • SHA512

    53882813d28b800b3cc071107c717eda414612553217dbf9ccfad2b3a7dc15b763da2761a561a88f4d13ba372baada639e53c4342be60409e8b5c46695d6d10e

  • SSDEEP

    6144:2yC/Df4LjFRRP7O8mijRQc0iA8s0GbiSKHuSs:2y+f4HF3PS8mwRQ2ZIcH

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Signatures

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Deletes itself 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\391e57083b6f4248eefc55aeb270b12f337e49f1f72d3b0904d6e56b8ebba2bd.exe
    "C:\Users\Admin\AppData\Local\Temp\391e57083b6f4248eefc55aeb270b12f337e49f1f72d3b0904d6e56b8ebba2bd.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2432

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2432-115-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-116-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-117-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-118-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-119-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-120-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-121-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-123-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-124-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-125-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-126-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-127-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-128-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-129-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-130-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-131-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-133-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-134-0x00000000004A0000-0x000000000054E000-memory.dmp

          Filesize

          696KB

          Download

        • memory/2432-136-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-137-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-139-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-140-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-141-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-142-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-143-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-144-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-145-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-146-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-148-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-149-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-150-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-151-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-147-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-138-0x0000000000400000-0x000000000049B000-memory.dmp

          Filesize

          620KB

          Download

        • memory/2432-135-0x00000000001D0000-0x00000000001D9000-memory.dmp

          Filesize

          36KB

          Download

        • memory/2432-132-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2432-152-0x0000000000400000-0x000000000049B000-memory.dmp

          Filesize

          620KB

          Download