Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    20/10/2022, 11:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    6445ea64fad601ddbae623d60fdd2b874eb82adc1ab41b5229b44f6b579a14c0.exe

  • Size

    195KB

  • MD5

    082ec822cdc533ba0dea2e4831e64778

  • SHA1

    c90c63ebe372c0e34146439cd5b1cec9e1c44cae

  • SHA256

    6445ea64fad601ddbae623d60fdd2b874eb82adc1ab41b5229b44f6b579a14c0

  • SHA512

    f91a1ec6c5f44cd2130d25326766ae31d8912678afecfc8d63eb2d648ee61a0a89b0de6a85fd51777143ace87ba1177daecae87c438b59c65533d20a3fc70964

  • SSDEEP

    3072:/Xejlxk6OLXkUKiE5vqyeqcc/7GYaaeltzOG7r70KPZl:v+lxvOLUziUXUQkX7r70qZ

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Signatures

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Deletes itself 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6445ea64fad601ddbae623d60fdd2b874eb82adc1ab41b5229b44f6b579a14c0.exe
    "C:\Users\Admin\AppData\Local\Temp\6445ea64fad601ddbae623d60fdd2b874eb82adc1ab41b5229b44f6b579a14c0.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2716

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2716-116-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-117-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-118-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-119-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-120-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-121-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-122-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-123-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-124-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-125-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-126-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-127-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-128-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-129-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-130-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-131-0x00000000005F6000-0x0000000000607000-memory.dmp

          Filesize

          68KB

          Download

        • memory/2716-132-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-133-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-134-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-135-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-136-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-137-0x00000000004B0000-0x00000000005FA000-memory.dmp

          Filesize

          1.3MB

          Download

        • memory/2716-138-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-139-0x0000000000490000-0x0000000000499000-memory.dmp

          Filesize

          36KB

          Download

        • memory/2716-141-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-140-0x0000000000400000-0x0000000000436000-memory.dmp

          Filesize

          216KB

          Download

        • memory/2716-142-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-143-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-144-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-145-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-146-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-147-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-148-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-149-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-150-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-151-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-152-0x0000000077A60000-0x0000000077BEE000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2716-153-0x0000000000400000-0x0000000000436000-memory.dmp

          Filesize

          216KB

          Download