Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-01-2023 19:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fc322da0809f155a0472e3be945fb5031211ea614b839349bece998ebf5d3823.exe

  • Size

    300KB

  • MD5

    d390c02bab20349c4d948e105df03aec

  • SHA1

    d1904de1e6b76f101f62471efc0d8e7602f0c163

  • SHA256

    fc322da0809f155a0472e3be945fb5031211ea614b839349bece998ebf5d3823

  • SHA512

    40f559a031e6d3cb5757fafb48072a473110a44181468df470fcbe830f4bb91998b6f3ddd40273f7ccee8bade301992ef3d025f9c1ad15bc98be1679d60107be

  • SSDEEP

    6144:0MxmLCbVylBzAUL+TUTBAeif+uLc+y0B:pxmubVyXz9+wTB7if+uc+yS

Score
10/10
smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

Malware Config

Signatures

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 30 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fc322da0809f155a0472e3be945fb5031211ea614b839349bece998ebf5d3823.exe
    "C:\Users\Admin\AppData\Local\Temp\fc322da0809f155a0472e3be945fb5031211ea614b839349bece998ebf5d3823.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:5004
  • C:\Users\Admin\AppData\Local\Temp\2D1B.exe
    C:\Users\Admin\AppData\Local\Temp\2D1B.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4152
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Wtfoiq.tmp",Iyidwoiowsw
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Accesses Microsoft Outlook accounts
      • Accesses Microsoft Outlook profiles
      • Suspicious use of SetThreadContext
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:2292
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 15611
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:1368
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
        3⤵
          PID:1084
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
          3⤵
            PID:2872
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 540
          2⤵
          • Program crash
          PID:2360
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4152 -ip 4152
        1⤵
          PID:3560
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:1976

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\2D1B.exe
            Filesize

            1.0MB

            MD5

            9b2fde9ca7b2b532914e194ebe98b077

            SHA1

            401f4fb2bb01f241cc03bf1e0f78e9a26862ccb0

            SHA256

            fb97ab85e72c8dfa6e149c174c176f9c9afb391a134edae31f5d7e51a8d2577b

            SHA512

            e167173946d6fb284801c73bd2fd349c5f8386ae194293ff052c0e8b9b1e225ee388761efc63bd9e9ba841ab22d1ddb2bf0458e4215abd14025375232e229ee6

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\2D1B.exe
            Filesize

            1.0MB

            MD5

            9b2fde9ca7b2b532914e194ebe98b077

            SHA1

            401f4fb2bb01f241cc03bf1e0f78e9a26862ccb0

            SHA256

            fb97ab85e72c8dfa6e149c174c176f9c9afb391a134edae31f5d7e51a8d2577b

            SHA512

            e167173946d6fb284801c73bd2fd349c5f8386ae194293ff052c0e8b9b1e225ee388761efc63bd9e9ba841ab22d1ddb2bf0458e4215abd14025375232e229ee6

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Wtfoiq.tmp
            Filesize

            714KB

            MD5

            9dd70d24b2657a9254b9fd536a4d06d5

            SHA1

            348a1d210d7c4daef8ecdb692eadf3975971e8ee

            SHA256

            d0ac0e9021c6e231c60256198309b7f72ce4c5e772cf343b5456c2ce0664b9bd

            SHA512

            dee5bfe83fdf196c78ee255e50a25994220ce9ecac22eb24323df70e668714d7a810b67ddace7809d9d7e2160a35c4603deedb64b1660d82dde58586c34d2ab6

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Wtfoiq.tmp
            Filesize

            714KB

            MD5

            9dd70d24b2657a9254b9fd536a4d06d5

            SHA1

            348a1d210d7c4daef8ecdb692eadf3975971e8ee

            SHA256

            d0ac0e9021c6e231c60256198309b7f72ce4c5e772cf343b5456c2ce0664b9bd

            SHA512

            dee5bfe83fdf196c78ee255e50a25994220ce9ecac22eb24323df70e668714d7a810b67ddace7809d9d7e2160a35c4603deedb64b1660d82dde58586c34d2ab6

            Download Submit

          • memory/1368-157-0x000001C2D2150000-0x000001C2D2402000-memory.dmp

            Filesize

            2.7MB

            Download

          • memory/1368-156-0x0000000000EA0000-0x0000000001141000-memory.dmp

            Filesize

            2.6MB

            Download

          • memory/1368-155-0x000001C2D3BB0000-0x000001C2D3CF0000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/1368-154-0x000001C2D3BB0000-0x000001C2D3CF0000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2292-152-0x0000000004430000-0x0000000004570000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2292-158-0x0000000004A30000-0x0000000005571000-memory.dmp

            Filesize

            11.3MB

            Download

          • memory/2292-145-0x0000000004A30000-0x0000000005571000-memory.dmp

            Filesize

            11.3MB

            Download

          • memory/2292-146-0x0000000004A30000-0x0000000005571000-memory.dmp

            Filesize

            11.3MB

            Download

          • memory/2292-147-0x0000000004430000-0x0000000004570000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2292-148-0x0000000004430000-0x0000000004570000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2292-149-0x0000000004430000-0x0000000004570000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2292-150-0x0000000004430000-0x0000000004570000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2292-151-0x0000000004430000-0x0000000004570000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/4152-143-0x0000000004B10000-0x0000000004C25000-memory.dmp

            Filesize

            1.1MB

            Download

          • memory/4152-142-0x0000000004A36000-0x0000000004B0A000-memory.dmp

            Filesize

            848KB

            Download

          • memory/4152-144-0x0000000000400000-0x0000000002CFC000-memory.dmp

            Filesize

            41.0MB

            Download

          • memory/5004-133-0x0000000002DD0000-0x0000000002DD9000-memory.dmp

            Filesize

            36KB

            Download

          • memory/5004-135-0x0000000000400000-0x0000000002C3D000-memory.dmp

            Filesize

            40.2MB

            Download

          • memory/5004-134-0x0000000000400000-0x0000000002C3D000-memory.dmp

            Filesize

            40.2MB

            Download

          • memory/5004-132-0x0000000002E4D000-0x0000000002E62000-memory.dmp

            Filesize

            84KB

            Download