Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/01/2023, 00:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e5a7f5ebac116313c1e61e55fd4db09ae60f7762bd4110ff43d6032fab605e27.exe

  • Size

    167KB

  • MD5

    5a059ed72a6871e8e9c8f6124ac5be9a

  • SHA1

    e74b28cb61e542c79d84b4cca737f33f4e680ca6

  • SHA256

    e5a7f5ebac116313c1e61e55fd4db09ae60f7762bd4110ff43d6032fab605e27

  • SHA512

    061a3abfa88eeb1e99319929eeed4eb31c33886a9eeca9f325b49e1a65f9a8c54e93eed3199136eee11c9b849aabf02dde8a31f9dc1f570568361e1eb67fdd8c

  • SSDEEP

    3072:Sj1huo38LoYhiUx5YHnzfzmUSY4w87cY8MWQCtY:FLoYhiU8Hzfz3pOB

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Signatures

  • Detects Smokeloader packer 6 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e5a7f5ebac116313c1e61e55fd4db09ae60f7762bd4110ff43d6032fab605e27.exe
    "C:\Users\Admin\AppData\Local\Temp\e5a7f5ebac116313c1e61e55fd4db09ae60f7762bd4110ff43d6032fab605e27.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4656
    • C:\Users\Admin\AppData\Local\Temp\e5a7f5ebac116313c1e61e55fd4db09ae60f7762bd4110ff43d6032fab605e27.exe
      "C:\Users\Admin\AppData\Local\Temp\e5a7f5ebac116313c1e61e55fd4db09ae60f7762bd4110ff43d6032fab605e27.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:5064
  • C:\Users\Admin\AppData\Roaming\bdwhaaj
    C:\Users\Admin\AppData\Roaming\bdwhaaj
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4512
    • C:\Users\Admin\AppData\Roaming\bdwhaaj
      C:\Users\Admin\AppData\Roaming\bdwhaaj
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:4424

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\bdwhaaj
    Filesize

    167KB

    MD5

    5a059ed72a6871e8e9c8f6124ac5be9a

    SHA1

    e74b28cb61e542c79d84b4cca737f33f4e680ca6

    SHA256

    e5a7f5ebac116313c1e61e55fd4db09ae60f7762bd4110ff43d6032fab605e27

    SHA512

    061a3abfa88eeb1e99319929eeed4eb31c33886a9eeca9f325b49e1a65f9a8c54e93eed3199136eee11c9b849aabf02dde8a31f9dc1f570568361e1eb67fdd8c

    Download Submit

  • C:\Users\Admin\AppData\Roaming\bdwhaaj
    Filesize

    167KB

    MD5

    5a059ed72a6871e8e9c8f6124ac5be9a

    SHA1

    e74b28cb61e542c79d84b4cca737f33f4e680ca6

    SHA256

    e5a7f5ebac116313c1e61e55fd4db09ae60f7762bd4110ff43d6032fab605e27

    SHA512

    061a3abfa88eeb1e99319929eeed4eb31c33886a9eeca9f325b49e1a65f9a8c54e93eed3199136eee11c9b849aabf02dde8a31f9dc1f570568361e1eb67fdd8c

    Download Submit

  • C:\Users\Admin\AppData\Roaming\bdwhaaj
    Filesize

    167KB

    MD5

    5a059ed72a6871e8e9c8f6124ac5be9a

    SHA1

    e74b28cb61e542c79d84b4cca737f33f4e680ca6

    SHA256

    e5a7f5ebac116313c1e61e55fd4db09ae60f7762bd4110ff43d6032fab605e27

    SHA512

    061a3abfa88eeb1e99319929eeed4eb31c33886a9eeca9f325b49e1a65f9a8c54e93eed3199136eee11c9b849aabf02dde8a31f9dc1f570568361e1eb67fdd8c

    Download Submit

  • memory/4424-144-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/4424-145-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/4512-143-0x0000000002C2D000-0x0000000002C40000-memory.dmp

    Filesize

    76KB

    Download

  • memory/4656-135-0x0000000002CE0000-0x0000000002CE9000-memory.dmp

    Filesize

    36KB

    Download

  • memory/4656-134-0x0000000002EDD000-0x0000000002EF0000-memory.dmp

    Filesize

    76KB

    Download

  • memory/5064-136-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/5064-137-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/5064-133-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download