Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Analysis

  • max time kernel
    191s
  • max time network
    216s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2022, 13:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    be1a580baf710ea9c7e28339e4dc408124013e167bb96363eae21d9b2e45e6b2.exe

  • Size

    261KB

  • MD5

    9411587a02352759aa9ec1fdddd46ac4

  • SHA1

    17d92151e60e5a87b8b59fb3ff9683275453d958

  • SHA256

    be1a580baf710ea9c7e28339e4dc408124013e167bb96363eae21d9b2e45e6b2

  • SHA512

    8c11451bb1a69f1ba9dd1961ce9b5d91e5eb966bd7c625ab06d9e925def64778ccf9cc7d960c87af8568d043d5508d418570f6279a3a9f6a27580d7570c2978d

  • SSDEEP

    3072:w+X17D+mQG6nG7/gmi5L8u18d0oyec2zQF9hTDw02rwdGine2ZeXGMh0r:nHRo6giu1ShgFU02sAinVe2U

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Signatures

  • Detects Smokeloader packer 6 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\be1a580baf710ea9c7e28339e4dc408124013e167bb96363eae21d9b2e45e6b2.exe
    "C:\Users\Admin\AppData\Local\Temp\be1a580baf710ea9c7e28339e4dc408124013e167bb96363eae21d9b2e45e6b2.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:5012
    • C:\Users\Admin\AppData\Local\Temp\be1a580baf710ea9c7e28339e4dc408124013e167bb96363eae21d9b2e45e6b2.exe
      "C:\Users\Admin\AppData\Local\Temp\be1a580baf710ea9c7e28339e4dc408124013e167bb96363eae21d9b2e45e6b2.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:4824
  • C:\Users\Admin\AppData\Roaming\uwfiivs
    C:\Users\Admin\AppData\Roaming\uwfiivs
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4612
    • C:\Users\Admin\AppData\Roaming\uwfiivs
      C:\Users\Admin\AppData\Roaming\uwfiivs
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:1860

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\uwfiivs
    Filesize

    261KB

    MD5

    9411587a02352759aa9ec1fdddd46ac4

    SHA1

    17d92151e60e5a87b8b59fb3ff9683275453d958

    SHA256

    be1a580baf710ea9c7e28339e4dc408124013e167bb96363eae21d9b2e45e6b2

    SHA512

    8c11451bb1a69f1ba9dd1961ce9b5d91e5eb966bd7c625ab06d9e925def64778ccf9cc7d960c87af8568d043d5508d418570f6279a3a9f6a27580d7570c2978d

    Download Submit

  • C:\Users\Admin\AppData\Roaming\uwfiivs
    Filesize

    261KB

    MD5

    9411587a02352759aa9ec1fdddd46ac4

    SHA1

    17d92151e60e5a87b8b59fb3ff9683275453d958

    SHA256

    be1a580baf710ea9c7e28339e4dc408124013e167bb96363eae21d9b2e45e6b2

    SHA512

    8c11451bb1a69f1ba9dd1961ce9b5d91e5eb966bd7c625ab06d9e925def64778ccf9cc7d960c87af8568d043d5508d418570f6279a3a9f6a27580d7570c2978d

    Download Submit

  • C:\Users\Admin\AppData\Roaming\uwfiivs
    Filesize

    261KB

    MD5

    9411587a02352759aa9ec1fdddd46ac4

    SHA1

    17d92151e60e5a87b8b59fb3ff9683275453d958

    SHA256

    be1a580baf710ea9c7e28339e4dc408124013e167bb96363eae21d9b2e45e6b2

    SHA512

    8c11451bb1a69f1ba9dd1961ce9b5d91e5eb966bd7c625ab06d9e925def64778ccf9cc7d960c87af8568d043d5508d418570f6279a3a9f6a27580d7570c2978d

    Download Submit

  • memory/1860-145-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/1860-146-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/4612-140-0x0000000000628000-0x0000000000639000-memory.dmp

    Filesize

    68KB

    Download

  • memory/4612-144-0x0000000000628000-0x0000000000639000-memory.dmp

    Filesize

    68KB

    Download

  • memory/4824-136-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/4824-137-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/4824-133-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/5012-134-0x0000000000598000-0x00000000005A9000-memory.dmp

    Filesize

    68KB

    Download

  • memory/5012-135-0x0000000002060000-0x0000000002069000-memory.dmp

    Filesize

    36KB

    Download