Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/12/2022, 15:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3ea49e28c63b670e03698915865f7d2f07bb35894517e4742f0da5b2fd3bc900.exe

  • Size

    223KB

  • MD5

    fb61094230a4ed3c7a265e3ed14dbdd0

  • SHA1

    7e5527b77081980e174d356766f75c33623c4ee7

  • SHA256

    3ea49e28c63b670e03698915865f7d2f07bb35894517e4742f0da5b2fd3bc900

  • SHA512

    ea64d0ac7256ee92e5813eb414fa91c27b33a027c4793e5e1e6927c6e027c587699f1b155e533bec961c24e572a9e96e54f730aef631113d3b563b39343a5767

  • SSDEEP

    6144:wMLP4eLTYo4PiPZX0tU3DMMy3LxKdi3tm:b8wYpPiPWZ3toi3tm

Score
10/10
smokeloaderbackdoordiscoverytrojan

Malware Config

Signatures

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 26 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 30 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3ea49e28c63b670e03698915865f7d2f07bb35894517e4742f0da5b2fd3bc900.exe
    "C:\Users\Admin\AppData\Local\Temp\3ea49e28c63b670e03698915865f7d2f07bb35894517e4742f0da5b2fd3bc900.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1524
  • C:\Users\Admin\AppData\Local\Temp\FAB0.exe
    C:\Users\Admin\AppData\Local\Temp\FAB0.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3364
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Qfyshwqueqdpai.tmp",Dioeeedresq
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Checks processor information in registry
      • Suspicious use of WriteProcessMemory
      PID:3728
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 14005
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:3584
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 356
      2⤵
      • Program crash
      PID:764
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3364 -ip 3364
    1⤵
      PID:1832
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:824
      • C:\Users\Admin\AppData\Roaming\jsvjrut
        C:\Users\Admin\AppData\Roaming\jsvjrut
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious behavior: MapViewOfSection
        PID:856

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\FAB0.exe
        Filesize

        1021KB

        MD5

        bbac8c49e50b282cd6ec6ee4800730a6

        SHA1

        0c3a643df3441a3bea475d563fcdc2dcaf159068

        SHA256

        a74b73ced4162e7d54aa19d37661b77ef6db4188651e3410f1a73e17d64c4631

        SHA512

        825d55acf30222137a6d8cdcebf1db83582b2629d2483ed78f1bf43ac0aba0f566a7c2d37d573d0dbc5e81154e7d0880c07e34e061931000f7f4f8717172907d

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\FAB0.exe
        Filesize

        1021KB

        MD5

        bbac8c49e50b282cd6ec6ee4800730a6

        SHA1

        0c3a643df3441a3bea475d563fcdc2dcaf159068

        SHA256

        a74b73ced4162e7d54aa19d37661b77ef6db4188651e3410f1a73e17d64c4631

        SHA512

        825d55acf30222137a6d8cdcebf1db83582b2629d2483ed78f1bf43ac0aba0f566a7c2d37d573d0dbc5e81154e7d0880c07e34e061931000f7f4f8717172907d

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Qfyshwqueqdpai.tmp
        Filesize

        792KB

        MD5

        822d3ead416a1a85cb96e65f65cd5ae2

        SHA1

        af32b69e2835d1cacdadb97ae6dfafccc32d1837

        SHA256

        72bdb3a06dca8458ac9aedf06785b2d7b95a19f8b9f3f8f5be2eb4744e9c5d1d

        SHA512

        48d0d61efd51fd2d8eb04d990b4a5b3ca34c916199d3b0a3b135d2089e028ee37f5145e4705fb75da77eaabbe12f8c4ea55775a41e1b1c68a90ce68b8c2a7260

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Qfyshwqueqdpai.tmp
        Filesize

        792KB

        MD5

        822d3ead416a1a85cb96e65f65cd5ae2

        SHA1

        af32b69e2835d1cacdadb97ae6dfafccc32d1837

        SHA256

        72bdb3a06dca8458ac9aedf06785b2d7b95a19f8b9f3f8f5be2eb4744e9c5d1d

        SHA512

        48d0d61efd51fd2d8eb04d990b4a5b3ca34c916199d3b0a3b135d2089e028ee37f5145e4705fb75da77eaabbe12f8c4ea55775a41e1b1c68a90ce68b8c2a7260

        Download Submit

      • C:\Users\Admin\AppData\Roaming\jsvjrut
        Filesize

        223KB

        MD5

        fb61094230a4ed3c7a265e3ed14dbdd0

        SHA1

        7e5527b77081980e174d356766f75c33623c4ee7

        SHA256

        3ea49e28c63b670e03698915865f7d2f07bb35894517e4742f0da5b2fd3bc900

        SHA512

        ea64d0ac7256ee92e5813eb414fa91c27b33a027c4793e5e1e6927c6e027c587699f1b155e533bec961c24e572a9e96e54f730aef631113d3b563b39343a5767

        Download Submit

      • C:\Users\Admin\AppData\Roaming\jsvjrut
        Filesize

        223KB

        MD5

        fb61094230a4ed3c7a265e3ed14dbdd0

        SHA1

        7e5527b77081980e174d356766f75c33623c4ee7

        SHA256

        3ea49e28c63b670e03698915865f7d2f07bb35894517e4742f0da5b2fd3bc900

        SHA512

        ea64d0ac7256ee92e5813eb414fa91c27b33a027c4793e5e1e6927c6e027c587699f1b155e533bec961c24e572a9e96e54f730aef631113d3b563b39343a5767

        Download Submit

      • memory/856-163-0x0000000000400000-0x000000000045B000-memory.dmp

        Filesize

        364KB

        Download

      • memory/856-162-0x0000000000400000-0x000000000045B000-memory.dmp

        Filesize

        364KB

        Download

      • memory/856-161-0x00000000006C8000-0x00000000006D9000-memory.dmp

        Filesize

        68KB

        Download

      • memory/1524-132-0x00000000004A9000-0x00000000004BA000-memory.dmp

        Filesize

        68KB

        Download

      • memory/1524-135-0x0000000000400000-0x000000000045B000-memory.dmp

        Filesize

        364KB

        Download

      • memory/1524-134-0x0000000000400000-0x000000000045B000-memory.dmp

        Filesize

        364KB

        Download

      • memory/1524-133-0x0000000000460000-0x0000000000469000-memory.dmp

        Filesize

        36KB

        Download

      • memory/3364-144-0x0000000000400000-0x0000000000523000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/3364-143-0x0000000002250000-0x0000000002361000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/3364-142-0x0000000002176000-0x000000000224C000-memory.dmp

        Filesize

        856KB

        Download

      • memory/3584-156-0x0000000000130000-0x00000000003CC000-memory.dmp

        Filesize

        2.6MB

        Download

      • memory/3584-154-0x0000019B963D0000-0x0000019B96510000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/3584-157-0x0000019B96540000-0x0000019B967EE000-memory.dmp

        Filesize

        2.7MB

        Download

      • memory/3584-155-0x0000019B963D0000-0x0000019B96510000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/3728-149-0x0000000005090000-0x00000000051D0000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/3728-152-0x0000000005090000-0x00000000051D0000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/3728-150-0x0000000005090000-0x00000000051D0000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/3728-151-0x0000000005090000-0x00000000051D0000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/3728-158-0x0000000006B30000-0x000000000768D000-memory.dmp

        Filesize

        11.4MB

        Download

      • memory/3728-148-0x0000000005090000-0x00000000051D0000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/3728-147-0x0000000005090000-0x00000000051D0000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/3728-146-0x0000000006B30000-0x000000000768D000-memory.dmp

        Filesize

        11.4MB

        Download

      • memory/3728-145-0x0000000006B30000-0x000000000768D000-memory.dmp

        Filesize

        11.4MB

        Download