Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/01/2023, 08:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    4c19c053186dbe91f79872857581e6d7ef3bf1d383b42054e6ede398557e8007.exe

  • Size

    353KB

  • MD5

    7ed687ac3ea2d88751c61ee4242d2cb1

  • SHA1

    f4540c03affd6da03d56ebde96b3405877c4339d

  • SHA256

    4c19c053186dbe91f79872857581e6d7ef3bf1d383b42054e6ede398557e8007

  • SHA512

    cfa89214d7697471a57ea3aef851250ec3bed42f3daef40d7c976c5ea407a4a5e3ee1d5b22c3e0dc060e02e3fc321f265cca10b1efa15fe4348f0818e6fdb1c6

  • SSDEEP

    6144:lMp1X8LuBpx5L6/+G/2gV2QWRFCFuedp2PrT++g:lMph8qBDgH2gathn++g

Score
10/10
smokeloaderbackdoorcollectiondiscoverypersistencespywarestealertrojan

Malware Config

Signatures

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Sets DLL path for service in the registry 2 TTPs 2 IoCs
    persistence
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 25 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 28 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 30 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4c19c053186dbe91f79872857581e6d7ef3bf1d383b42054e6ede398557e8007.exe
    "C:\Users\Admin\AppData\Local\Temp\4c19c053186dbe91f79872857581e6d7ef3bf1d383b42054e6ede398557e8007.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4708
  • C:\Users\Admin\AppData\Local\Temp\EFA4.exe
    C:\Users\Admin\AppData\Local\Temp\EFA4.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4616
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Wtfoiq.tmp",Iyidwoiowsw
      2⤵
      • Blocklisted process makes network request
      • Sets DLL path for service in the registry
      • Sets service image path in registry
      • Loads dropped DLL
      • Accesses Microsoft Outlook accounts
      • Accesses Microsoft Outlook profiles
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:2576
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 15561
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:1528
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
        3⤵
          PID:2616
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
          3⤵
            PID:1828
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 528
          2⤵
          • Program crash
          PID:3872
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4616 -ip 4616
        1⤵
          PID:3748
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:2008
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\SysWOW64\svchost.exe -k LocalService
            1⤵
              PID:4660

            Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Program Files (x86)\WindowsPowerShell\Modules\64BitMAPIBroker.dll
                    Filesize

                    714KB

                    MD5

                    ea4c0d4ad40c98a4441460ea7d52d28d

                    SHA1

                    6ba49ddc684483e9549ceb789bdd6f1b5c282fe8

                    SHA256

                    90ed9f52c40413847bc58fdd4e1edf1968dc643629764e0977abc7e8a75b547a

                    SHA512

                    be05e7ce88537e2f103b5a41d35e51b85264f56916464a9bbd046aa02c124ecf44191c24058c4cf3086f801b374375efdaf3b23c3a043f6311e93b07fd2a1712

                    Download Submit

                  • C:\ProgramData\{B7E8E476-349D-60AA-651B-798B40E3CAEC}\Rwdfud.tmp
                    Filesize

                    2.3MB

                    MD5

                    32cf69888954e2c9753ce4f45a9c58fc

                    SHA1

                    ba3d7691e7b5f67d9731a0d332c6a751803fb2dc

                    SHA256

                    bc2220d1b3db5e924c72841fc0a742467e3b560cb03d2dc9b013a87abfaf7ae2

                    SHA512

                    5d867eee4f9787c0a90dace48b6a0f8828e2001fc635de043ec9a22efa4306c86f8890e67eac5658d9d35fdbac93e5d08048030dbe0d64b7b6c94e52205c5937

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\EFA4.exe
                    Filesize

                    1.1MB

                    MD5

                    3a4c8edfb1e532e3d5953be6fd002d87

                    SHA1

                    3718fae1ac1bf9a63763fe317a12d483905a375c

                    SHA256

                    74d5fc29b238728bc326f33efbedab3a42e9833c2d0ececea2d73ae29f3b03cc

                    SHA512

                    be5438e4fd62103aeff01ddd7c199552205959103a885c28d6cf4934c25f49c649a779129b0f11ee5b2128ae192d44353cf50a54b4f96550a36e369eee1cf647

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\EFA4.exe
                    Filesize

                    1.1MB

                    MD5

                    3a4c8edfb1e532e3d5953be6fd002d87

                    SHA1

                    3718fae1ac1bf9a63763fe317a12d483905a375c

                    SHA256

                    74d5fc29b238728bc326f33efbedab3a42e9833c2d0ececea2d73ae29f3b03cc

                    SHA512

                    be5438e4fd62103aeff01ddd7c199552205959103a885c28d6cf4934c25f49c649a779129b0f11ee5b2128ae192d44353cf50a54b4f96550a36e369eee1cf647

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Wtfoiq.tmp
                    Filesize

                    714KB

                    MD5

                    9dd70d24b2657a9254b9fd536a4d06d5

                    SHA1

                    348a1d210d7c4daef8ecdb692eadf3975971e8ee

                    SHA256

                    d0ac0e9021c6e231c60256198309b7f72ce4c5e772cf343b5456c2ce0664b9bd

                    SHA512

                    dee5bfe83fdf196c78ee255e50a25994220ce9ecac22eb24323df70e668714d7a810b67ddace7809d9d7e2160a35c4603deedb64b1660d82dde58586c34d2ab6

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Wtfoiq.tmp
                    Filesize

                    714KB

                    MD5

                    9dd70d24b2657a9254b9fd536a4d06d5

                    SHA1

                    348a1d210d7c4daef8ecdb692eadf3975971e8ee

                    SHA256

                    d0ac0e9021c6e231c60256198309b7f72ce4c5e772cf343b5456c2ce0664b9bd

                    SHA512

                    dee5bfe83fdf196c78ee255e50a25994220ce9ecac22eb24323df70e668714d7a810b67ddace7809d9d7e2160a35c4603deedb64b1660d82dde58586c34d2ab6

                    Download Submit

                  • \??\c:\program files (x86)\windowspowershell\modules\64bitmapibroker.dll
                    Filesize

                    714KB

                    MD5

                    ea4c0d4ad40c98a4441460ea7d52d28d

                    SHA1

                    6ba49ddc684483e9549ceb789bdd6f1b5c282fe8

                    SHA256

                    90ed9f52c40413847bc58fdd4e1edf1968dc643629764e0977abc7e8a75b547a

                    SHA512

                    be05e7ce88537e2f103b5a41d35e51b85264f56916464a9bbd046aa02c124ecf44191c24058c4cf3086f801b374375efdaf3b23c3a043f6311e93b07fd2a1712

                    Download Submit

                  • memory/1528-156-0x0000000000440000-0x00000000006E1000-memory.dmp

                    Filesize

                    2.6MB

                    Download

                  • memory/1528-159-0x000001CB0E7B0000-0x000001CB0EA62000-memory.dmp

                    Filesize

                    2.7MB

                    Download

                  • memory/1528-157-0x000001CB10210000-0x000001CB10350000-memory.dmp

                    Filesize

                    1.2MB

                    Download

                  • memory/1528-158-0x000001CB0E7B0000-0x000001CB0EA62000-memory.dmp

                    Filesize

                    2.7MB

                    Download

                  • memory/1528-155-0x000001CB10210000-0x000001CB10350000-memory.dmp

                    Filesize

                    1.2MB

                    Download

                  • memory/2576-146-0x0000000004CF0000-0x0000000005831000-memory.dmp

                    Filesize

                    11.3MB

                    Download

                  • memory/2576-147-0x0000000004CF0000-0x0000000005831000-memory.dmp

                    Filesize

                    11.3MB

                    Download

                  • memory/2576-148-0x00000000047C0000-0x0000000004900000-memory.dmp

                    Filesize

                    1.2MB

                    Download

                  • memory/2576-149-0x00000000047C0000-0x0000000004900000-memory.dmp

                    Filesize

                    1.2MB

                    Download

                  • memory/2576-150-0x00000000047C0000-0x0000000004900000-memory.dmp

                    Filesize

                    1.2MB

                    Download

                  • memory/2576-151-0x00000000047C0000-0x0000000004900000-memory.dmp

                    Filesize

                    1.2MB

                    Download

                  • memory/2576-152-0x00000000047C0000-0x0000000004900000-memory.dmp

                    Filesize

                    1.2MB

                    Download

                  • memory/2576-153-0x00000000047C0000-0x0000000004900000-memory.dmp

                    Filesize

                    1.2MB

                    Download

                  • memory/2576-161-0x0000000004CF0000-0x0000000005831000-memory.dmp

                    Filesize

                    11.3MB

                    Download

                  • memory/4616-144-0x0000000000400000-0x00000000030DA000-memory.dmp

                    Filesize

                    44.9MB

                    Download

                  • memory/4616-143-0x0000000004EA0000-0x0000000004FB5000-memory.dmp

                    Filesize

                    1.1MB

                    Download

                  • memory/4616-142-0x0000000004DA5000-0x0000000004E79000-memory.dmp

                    Filesize

                    848KB

                    Download

                  • memory/4616-145-0x0000000000400000-0x00000000030DA000-memory.dmp

                    Filesize

                    44.9MB

                    Download

                  • memory/4660-166-0x00000000044B0000-0x0000000004FF1000-memory.dmp

                    Filesize

                    11.3MB

                    Download

                  • memory/4708-132-0x000000000330D000-0x0000000003323000-memory.dmp

                    Filesize

                    88KB

                    Download

                  • memory/4708-135-0x0000000000400000-0x000000000301B000-memory.dmp

                    Filesize

                    44.1MB

                    Download

                  • memory/4708-134-0x0000000000400000-0x000000000301B000-memory.dmp

                    Filesize

                    44.1MB

                    Download

                  • memory/4708-133-0x0000000003160000-0x0000000003169000-memory.dmp

                    Filesize

                    36KB

                    Download