Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1eb57c2fe1db10b6a28b048bf1e88b134c3ac13738be60b8f7a1aef4f3b446cc

  • Size

    188KB

  • Sample

    221125-gg616aee86

  • MD5

    eecb09fbcdc28262be91de5a17ab7a17

  • SHA1

    468478d9b2a36be48b6a52c8e1c7776295591775

  • SHA256

    1eb57c2fe1db10b6a28b048bf1e88b134c3ac13738be60b8f7a1aef4f3b446cc

  • SHA512

    a8a785eb3ec52586f0d0e1826933ec66db9e6845b18bf464e79f3ed1aa7d6b25cc266e87885dbb4df2d07092e4c4ae887ed272a92aa51d38fca7d553236e3d32

  • SSDEEP

    3072:IA3129DCD2K79/LPg8hOZ+5djM3w8FdgzyOmV:F3TLPgLrw8Fdgzn6

Score
10/10
smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

Malware Config

Targets

    • Target

      1eb57c2fe1db10b6a28b048bf1e88b134c3ac13738be60b8f7a1aef4f3b446cc

    • Size

      188KB

    • MD5

      eecb09fbcdc28262be91de5a17ab7a17

    • SHA1

      468478d9b2a36be48b6a52c8e1c7776295591775

    • SHA256

      1eb57c2fe1db10b6a28b048bf1e88b134c3ac13738be60b8f7a1aef4f3b446cc

    • SHA512

      a8a785eb3ec52586f0d0e1826933ec66db9e6845b18bf464e79f3ed1aa7d6b25cc266e87885dbb4df2d07092e4c4ae887ed272a92aa51d38fca7d553236e3d32

    • SSDEEP

      3072:IA3129DCD2K79/LPg8hOZ+5djM3w8FdgzyOmV:F3TLPgLrw8Fdgzn6

    Score
    10/10
    smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

2
T1114

Exfiltration

Command and Control

Impact

Tasks