Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04-01-2023 07:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4cda4f1e3f0cefbc77757241ae98f3a0891649dce2a2a5ef8859f24d337bdcc0.exe

  • Size

    366KB

  • MD5

    88c1b8ec4bc2635c5bb83759cbe71c61

  • SHA1

    ad057975a22cbbdafd86f0217d335c14f75fc8d2

  • SHA256

    4cda4f1e3f0cefbc77757241ae98f3a0891649dce2a2a5ef8859f24d337bdcc0

  • SHA512

    60baef7541ff029811687f458fceef328f99efcbce9071105f9ae0b57f4191e60da51250f8406502b725a1b2d29867043503cb5f4bdb945559a08fccc2df0b4d

  • SSDEEP

    6144:degLrSsm+zE3f4y9v1zeB34eUWooxupmLIjT:dRqspzE3f4y9v1z24qooxupmL

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Signatures

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Deletes itself 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4cda4f1e3f0cefbc77757241ae98f3a0891649dce2a2a5ef8859f24d337bdcc0.exe
    "C:\Users\Admin\AppData\Local\Temp\4cda4f1e3f0cefbc77757241ae98f3a0891649dce2a2a5ef8859f24d337bdcc0.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:3728

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3728-116-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-117-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-118-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-119-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-120-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-121-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-122-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-123-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-124-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-125-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-126-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-127-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-128-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-129-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-130-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-131-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-133-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-134-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-135-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-136-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-138-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-137-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-132-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-139-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-140-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-142-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-141-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-143-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-144-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-145-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-146-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-147-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-149-0x0000000077C90000-0x0000000077E1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3728-148-0x0000000002FBA000-0x0000000002FCF000-memory.dmp

    Filesize

    84KB

    Download

  • memory/3728-150-0x0000000002F90000-0x0000000002F99000-memory.dmp

    Filesize

    36KB

    Download

  • memory/3728-151-0x0000000000400000-0x0000000002C4E000-memory.dmp

    Filesize

    40.3MB

    Download

  • memory/3728-152-0x0000000002FBA000-0x0000000002FCF000-memory.dmp

    Filesize

    84KB

    Download

  • memory/3728-153-0x0000000000400000-0x0000000002C4E000-memory.dmp

    Filesize

    40.3MB

    Download