Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-10-2022 07:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    409cfd7bf3b2ca5805b62180f8dc6677fd078b70da93d0d4ce0efa6db404b57c.exe

  • Size

    222KB

  • MD5

    a6899a06baf4f22e439aead0ab66d7f9

  • SHA1

    47fc19ba55c4e9a00ad87ac9f58d598fc8ec07c8

  • SHA256

    409cfd7bf3b2ca5805b62180f8dc6677fd078b70da93d0d4ce0efa6db404b57c

  • SHA512

    8fdfa1d9a68524d60dc766464eb8c74f4d0f2eed2606f76efb45070b13aaa04f82f82f99f725ea472c4b7ed00a253f46e0cec31c866c1a692ee9f2d6c62b3c82

  • SSDEEP

    3072:gnQW+6LjoyAQ7Ix6yLNGt6r5DCaEc8MG+9batAraUejl1g/p:gnQ5eo07IkyLYtgCNpF/Ud

Score
10/10
smokeloadervidar937backdoordiscoveryspywarestealertrojan

Malware Config

Extracted

Family

vidar

Version

55.2

Botnet

937

C2

https://t.me/slivetalks

https://c.im/@xinibin420
Attributes
  • profile_id

    937

Signatures

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\409cfd7bf3b2ca5805b62180f8dc6677fd078b70da93d0d4ce0efa6db404b57c.exe
    "C:\Users\Admin\AppData\Local\Temp\409cfd7bf3b2ca5805b62180f8dc6677fd078b70da93d0d4ce0efa6db404b57c.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:5008
  • C:\Users\Admin\AppData\Local\Temp\8EA3.exe
    C:\Users\Admin\AppData\Local\Temp\8EA3.exe
    1⤵
    • Executes dropped EXE
    • Checks computer location settings
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:3100
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\8EA3.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1580
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 6
        3⤵
        • Delays execution with timeout.exe
        PID:1368
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 1636
      2⤵
      • Program crash
      PID:3176
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3100 -ip 3100
    1⤵
      PID:2488

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Credentials in Files

    3
    T1081

    Discovery

    Query Registry

    4
    T1012

    System Information Discovery

    4
    T1082

    Peripheral Device Discovery

    1
    T1120

    Lateral Movement

    Collection

    Data from Local System

    3
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\mozglue.dll
      Filesize

      593KB

      MD5

      c8fd9be83bc728cc04beffafc2907fe9

      SHA1

      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

      SHA256

      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

      SHA512

      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

      Download Submit
    • C:\ProgramData\nss3.dll
      Filesize

      2.0MB

      MD5

      1cc453cdf74f31e4d913ff9c10acdde2

      SHA1

      6e85eae544d6e965f15fa5c39700fa7202f3aafe

      SHA256

      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

      SHA512

      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

      Download Submit
    • C:\ProgramData\sqlite3.dll
      Filesize

      1.1MB

      MD5

      1f44d4d3087c2b202cf9c90ee9d04b0f

      SHA1

      106a3ebc9e39ab6ddb3ff987efb6527c956f192d

      SHA256

      4841020c8bd06b08fde6e44cbe2e2ab33439e1c8368e936ec5b00dc0584f7260

      SHA512

      b614c72a3c1ce681ebffa628e29aa50275cc80ca9267380960c5198ea4d0a3f2df6cfb7275491d220bad72f14fc94e6656501e9a061d102fb11e00cfda2beb45

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\8EA3.exe
      Filesize

      331KB

      MD5

      09551ab38f2e8cf814cf67f5d7a5f8e4

      SHA1

      9f0df37c979517c5c73c62f082ab6ecf87045e17

      SHA256

      1beb50ab8de7ec33aec7deb5365fbebce3a91bfe9cf31387a5bf326ace08d48b

      SHA512

      ee03f58b9a12e34735a0cf98ab4dd8cdc5f8006b657c6077aab457d6f7a585cd9bbe09309060d39764320122ecda85978dd8c4c5d6658f9089c4aeebab97614b

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\8EA3.exe
      Filesize

      331KB

      MD5

      09551ab38f2e8cf814cf67f5d7a5f8e4

      SHA1

      9f0df37c979517c5c73c62f082ab6ecf87045e17

      SHA256

      1beb50ab8de7ec33aec7deb5365fbebce3a91bfe9cf31387a5bf326ace08d48b

      SHA512

      ee03f58b9a12e34735a0cf98ab4dd8cdc5f8006b657c6077aab457d6f7a585cd9bbe09309060d39764320122ecda85978dd8c4c5d6658f9089c4aeebab97614b

      Download Submit
    • memory/1368-146-0x0000000000000000-mapping.dmp
      Download
    • memory/1580-145-0x0000000000000000-mapping.dmp
      Download
    • memory/3100-136-0x0000000000000000-mapping.dmp
      Download
    • memory/3100-140-0x0000000000800000-0x0000000000849000-memory.dmp
      Filesize

      292KB

      Download
    • memory/3100-141-0x0000000000400000-0x00000000005B0000-memory.dmp
      Filesize

      1.7MB

      Download
    • memory/3100-139-0x0000000000919000-0x0000000000944000-memory.dmp
      Filesize

      172KB

      Download
    • memory/3100-147-0x0000000000919000-0x0000000000944000-memory.dmp
      Filesize

      172KB

      Download
    • memory/3100-148-0x0000000000400000-0x00000000005B0000-memory.dmp
      Filesize

      1.7MB

      Download
    • memory/5008-132-0x00000000007D8000-0x00000000007E8000-memory.dmp
      Filesize

      64KB

      Download
    • memory/5008-135-0x0000000000400000-0x0000000000595000-memory.dmp
      Filesize

      1.6MB

      Download
    • memory/5008-134-0x0000000000400000-0x0000000000595000-memory.dmp
      Filesize

      1.6MB

      Download
    • memory/5008-133-0x00000000006F0000-0x00000000006F9000-memory.dmp
      Filesize

      36KB

      Download