Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-12-2022 17:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3f7b8a4b3e8d14816fc181cd3753c6b040799ef0a79b8f29125cdf6013c5d926.exe

  • Size

    224KB

  • MD5

    2d0cb45a5cae57497e231d8b81986797

  • SHA1

    c7fdede472d241307e1bf21d497ee78a96ba46fa

  • SHA256

    3f7b8a4b3e8d14816fc181cd3753c6b040799ef0a79b8f29125cdf6013c5d926

  • SHA512

    30d52aa31e9e0776a8a9eaf8ce3b209fc123ff25c7f0d02c7483b69130b604c0dfc533b9672ea4391e2f83d05264e39bf67f38c90e72122bfadfacb8d8145a42

  • SSDEEP

    3072:9DnRhLrRcy5eSxsVu2Jrjo4h78AThQiauDnc4B3ejiwf/ln:dLryHSCVlh78GqiaMFBuOK

Score
10/10
smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

Malware Config

Signatures

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 22 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 30 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of FindShellTrayWindow 13 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3f7b8a4b3e8d14816fc181cd3753c6b040799ef0a79b8f29125cdf6013c5d926.exe
    "C:\Users\Admin\AppData\Local\Temp\3f7b8a4b3e8d14816fc181cd3753c6b040799ef0a79b8f29125cdf6013c5d926.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1348
  • C:\Users\Admin\AppData\Local\Temp\995.exe
    C:\Users\Admin\AppData\Local\Temp\995.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:484
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Oyiesauffusw.tmp",Wuuitfqhpt
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Accesses Microsoft Outlook accounts
      • Accesses Microsoft Outlook profiles
      • Suspicious use of SetThreadContext
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:4088
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 17140
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:1572
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
        3⤵
          PID:732
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
          3⤵
            PID:3232
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 484 -s 540
          2⤵
          • Program crash
          PID:3544
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 484 -ip 484
        1⤵
          PID:2376
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:2296
          • C:\Users\Admin\AppData\Roaming\dsrcdjf
            C:\Users\Admin\AppData\Roaming\dsrcdjf
            1⤵
            • Executes dropped EXE
            • Checks SCSI registry key(s)
            • Suspicious behavior: MapViewOfSection
            PID:3096

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\995.exe
            Filesize

            1.0MB

            MD5

            ed11a248a2af894c03adeaa5d9f57a2b

            SHA1

            b2934d359cff3c53158ce3ef329cecd466e8c626

            SHA256

            ebd2be77829bd7882984eaa1065311d781e02e2ae6b56096d79752b9a5f1eddd

            SHA512

            e472a2119c270679b81f6f492b9911a01224d9034da5f22ebc27475a55cc9d97d452d06ca41262cb902f54cfb478d92d7100e9a095b87cacb4444704871a40b1

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\995.exe
            Filesize

            1.0MB

            MD5

            ed11a248a2af894c03adeaa5d9f57a2b

            SHA1

            b2934d359cff3c53158ce3ef329cecd466e8c626

            SHA256

            ebd2be77829bd7882984eaa1065311d781e02e2ae6b56096d79752b9a5f1eddd

            SHA512

            e472a2119c270679b81f6f492b9911a01224d9034da5f22ebc27475a55cc9d97d452d06ca41262cb902f54cfb478d92d7100e9a095b87cacb4444704871a40b1

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Oyiesauffusw.tmp
            Filesize

            730KB

            MD5

            8d039a703875733043526555982e4e60

            SHA1

            f583795e790e682db2feaa5f5b8d282216f581e2

            SHA256

            5cb8e52b000f84494627db8e8e700e7731c9bfa2eb9e6a8a8280d2311327e81a

            SHA512

            3e89ec3eb7e90aa93c0a3cc2d120521b1c2236a8a2169b2654fcc153f926b97e85267a177ef92f3ac3a7aa493a81a3a55c1b6b56ef8f8beb93b78bf3eb10373e

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Oyiesauffusw.tmp
            Filesize

            730KB

            MD5

            8d039a703875733043526555982e4e60

            SHA1

            f583795e790e682db2feaa5f5b8d282216f581e2

            SHA256

            5cb8e52b000f84494627db8e8e700e7731c9bfa2eb9e6a8a8280d2311327e81a

            SHA512

            3e89ec3eb7e90aa93c0a3cc2d120521b1c2236a8a2169b2654fcc153f926b97e85267a177ef92f3ac3a7aa493a81a3a55c1b6b56ef8f8beb93b78bf3eb10373e

            Download Submit

          • C:\Users\Admin\AppData\Roaming\dsrcdjf
            Filesize

            224KB

            MD5

            2d0cb45a5cae57497e231d8b81986797

            SHA1

            c7fdede472d241307e1bf21d497ee78a96ba46fa

            SHA256

            3f7b8a4b3e8d14816fc181cd3753c6b040799ef0a79b8f29125cdf6013c5d926

            SHA512

            30d52aa31e9e0776a8a9eaf8ce3b209fc123ff25c7f0d02c7483b69130b604c0dfc533b9672ea4391e2f83d05264e39bf67f38c90e72122bfadfacb8d8145a42

            Download Submit

          • C:\Users\Admin\AppData\Roaming\dsrcdjf
            Filesize

            224KB

            MD5

            2d0cb45a5cae57497e231d8b81986797

            SHA1

            c7fdede472d241307e1bf21d497ee78a96ba46fa

            SHA256

            3f7b8a4b3e8d14816fc181cd3753c6b040799ef0a79b8f29125cdf6013c5d926

            SHA512

            30d52aa31e9e0776a8a9eaf8ce3b209fc123ff25c7f0d02c7483b69130b604c0dfc533b9672ea4391e2f83d05264e39bf67f38c90e72122bfadfacb8d8145a42

            Download Submit

          • memory/484-139-0x0000000000AD3000-0x0000000000BB0000-memory.dmp

            Filesize

            884KB

            Download

          • memory/484-140-0x0000000002360000-0x000000000247C000-memory.dmp

            Filesize

            1.1MB

            Download

          • memory/484-141-0x0000000000400000-0x000000000052A000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/484-145-0x0000000000400000-0x000000000052A000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/1348-132-0x00000000004BA000-0x00000000004CB000-memory.dmp

            Filesize

            68KB

            Download

          • memory/1348-135-0x0000000000400000-0x000000000045D000-memory.dmp

            Filesize

            372KB

            Download

          • memory/1348-134-0x0000000000400000-0x000000000045D000-memory.dmp

            Filesize

            372KB

            Download

          • memory/1348-133-0x00000000008C0000-0x00000000008C9000-memory.dmp

            Filesize

            36KB

            Download

          • memory/1572-156-0x0000023629450000-0x0000023629590000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/1572-157-0x0000000000630000-0x00000000008CA000-memory.dmp

            Filesize

            2.6MB

            Download

          • memory/1572-158-0x0000023627A00000-0x0000023627CAC000-memory.dmp

            Filesize

            2.7MB

            Download

          • memory/1572-155-0x0000023629450000-0x0000023629590000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/3096-166-0x0000000000400000-0x000000000045D000-memory.dmp

            Filesize

            372KB

            Download

          • memory/3096-165-0x0000000000400000-0x000000000045D000-memory.dmp

            Filesize

            372KB

            Download

          • memory/3096-164-0x000000000049A000-0x00000000004AB000-memory.dmp

            Filesize

            68KB

            Download

          • memory/4088-148-0x0000000005150000-0x0000000005290000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/4088-153-0x0000000005150000-0x0000000005290000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/4088-147-0x00000000057B0000-0x0000000006312000-memory.dmp

            Filesize

            11.4MB

            Download

          • memory/4088-160-0x00000000057B0000-0x0000000006312000-memory.dmp

            Filesize

            11.4MB

            Download

          • memory/4088-149-0x0000000005150000-0x0000000005290000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/4088-146-0x00000000057B0000-0x0000000006312000-memory.dmp

            Filesize

            11.4MB

            Download

          • memory/4088-152-0x0000000005150000-0x0000000005290000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/4088-151-0x0000000005150000-0x0000000005290000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/4088-150-0x0000000005150000-0x0000000005290000-memory.dmp

            Filesize

            1.2MB

            Download