Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c68c67eef80ea7562cd171bf1fb6d490ecd6792ce2bd7024cbd9e033ac903250

  • Size

    273KB

  • Sample

    221206-e5j57acd7y

  • MD5

    53d204a62546fa06daf4a00bb2bbaa07

  • SHA1

    6b1a911774a3140a74affbbd71b83913df3abf44

  • SHA256

    c68c67eef80ea7562cd171bf1fb6d490ecd6792ce2bd7024cbd9e033ac903250

  • SHA512

    d681217c28fa3aef0a7ec3195a909182f98ebe3cd5ef1ad330a32412838cd903f2e44b6812f94ce251e57c0b31c3d3ef37b5ec5dffe3098ec80bec1f3d6837b9

  • SSDEEP

    3072:86XVFWYw4VlTIyXVIWR5F9Fn99Lr7ddN/TWoQYiVRvJTcpuqGZj0sqYgV2qs64j:8a/EyXVxpDvZqoQYIDcAqMoVS

Score
10/10
smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

Malware Config

Targets

    • Target

      c68c67eef80ea7562cd171bf1fb6d490ecd6792ce2bd7024cbd9e033ac903250

    • Size

      273KB

    • MD5

      53d204a62546fa06daf4a00bb2bbaa07

    • SHA1

      6b1a911774a3140a74affbbd71b83913df3abf44

    • SHA256

      c68c67eef80ea7562cd171bf1fb6d490ecd6792ce2bd7024cbd9e033ac903250

    • SHA512

      d681217c28fa3aef0a7ec3195a909182f98ebe3cd5ef1ad330a32412838cd903f2e44b6812f94ce251e57c0b31c3d3ef37b5ec5dffe3098ec80bec1f3d6837b9

    • SSDEEP

      3072:86XVFWYw4VlTIyXVIWR5F9Fn99Lr7ddN/TWoQYiVRvJTcpuqGZj0sqYgV2qs64j:8a/EyXVxpDvZqoQYIDcAqMoVS

    Score
    10/10
    smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

2
T1114

Exfiltration

Command and Control

Impact

Tasks