Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    67s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03-11-2022 20:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f0c3c4a76875384cc536d4f018903d69185fb8154e181bf739dfd6260cf2c05a.exe

  • Size

    211KB

  • MD5

    d38f8657298596f3c33904e42e5fe10f

  • SHA1

    4fa2e7b7474defe9b5d7d2fcafbf4bea2093faa2

  • SHA256

    f0c3c4a76875384cc536d4f018903d69185fb8154e181bf739dfd6260cf2c05a

  • SHA512

    63e213ec90fa57e885e67416ab9cfcf647785d10e49c06d795da3fed3fd4ccd1cc9fc537b3afcb135fb10c0b3d84b00f5b39c2142a128e66d1adc01810a6c74b

  • SSDEEP

    3072:0LoDf5vD1coawLGlB/6OJ5aI0CpjjOnt6M09SeJXb+RwIIsx:0LuZpcofLYB/Z0CxTZVKGId

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Signatures

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Deletes itself 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f0c3c4a76875384cc536d4f018903d69185fb8154e181bf739dfd6260cf2c05a.exe
    "C:\Users\Admin\AppData\Local\Temp\f0c3c4a76875384cc536d4f018903d69185fb8154e181bf739dfd6260cf2c05a.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4808

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4808-120-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-121-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-122-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-123-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-124-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-125-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-126-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-127-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-128-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-129-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-130-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-131-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-133-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-132-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-134-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-135-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-136-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-137-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-138-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-139-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-140-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-141-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-143-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-144-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-145-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-146-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-147-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-148-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-149-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-150-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-151-0x00000000006F0000-0x000000000083A000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/4808-153-0x00000000006C0000-0x00000000006C9000-memory.dmp

    Filesize

    36KB

    Download

  • memory/4808-152-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-155-0x0000000000400000-0x0000000000591000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-154-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-156-0x0000000077340000-0x00000000774CE000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4808-157-0x0000000000400000-0x0000000000591000-memory.dmp

    Filesize

    1.6MB

    Download