Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/02/2023, 01:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a4ec22bcfe6b8aef8e52550999e2651c9d396604e9b966a3ab54832cb6e5d008.exe

  • Size

    227KB

  • MD5

    ff1eaf52cc5220bbc3f2155afab853ce

  • SHA1

    eaac3f018469268acfc86d8bd3161571cc275c1d

  • SHA256

    a4ec22bcfe6b8aef8e52550999e2651c9d396604e9b966a3ab54832cb6e5d008

  • SHA512

    2c9d3d5aa97f58348c02ddec931db2431630c01c26590eab190740cd6d43e3f712f2f482d6ec5a2308a7c96fc1d81c034ebdd8fa7db1271aab13a6442901c997

  • SSDEEP

    3072:rpRaay9OIlO9jLp7WKI5we0LxWmzMkJvmFS8bz:rpCwJLp7L/zvg

Score
10/10
smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

Malware Config

Signatures

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 30 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a4ec22bcfe6b8aef8e52550999e2651c9d396604e9b966a3ab54832cb6e5d008.exe
    "C:\Users\Admin\AppData\Local\Temp\a4ec22bcfe6b8aef8e52550999e2651c9d396604e9b966a3ab54832cb6e5d008.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:3304
  • C:\Users\Admin\AppData\Local\Temp\DF0A.exe
    C:\Users\Admin\AppData\Local\Temp\DF0A.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2056
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Rqdarrhtrsoihy.dll,start
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Accesses Microsoft Outlook accounts
      • Accesses Microsoft Outlook profiles
      • Suspicious use of SetThreadContext
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:1368
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 14100
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:4700
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
        3⤵
          PID:4756
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
          3⤵
            PID:2484
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 536
          2⤵
          • Program crash
          PID:4052
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2056 -ip 2056
        1⤵
          PID:1732
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:2184

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\DF0A.exe
            Filesize

            3.2MB

            MD5

            e2aafe982145ec8ac01deb5c8da2b30c

            SHA1

            f9aa9f29466dd038503ab66896148024d05e2b64

            SHA256

            8143388d5e63f3e2b3927c8819e9164fbc355f9f27da10f88ec1b6e12709cf9c

            SHA512

            48661cfecb2854d6d426975abce175d599a8272b513611bb8388f51252b56e325666835d7f8b102d596dacd66c97c037ada52c2826bf944466d21b4eae05a97f

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\DF0A.exe
            Filesize

            3.2MB

            MD5

            e2aafe982145ec8ac01deb5c8da2b30c

            SHA1

            f9aa9f29466dd038503ab66896148024d05e2b64

            SHA256

            8143388d5e63f3e2b3927c8819e9164fbc355f9f27da10f88ec1b6e12709cf9c

            SHA512

            48661cfecb2854d6d426975abce175d599a8272b513611bb8388f51252b56e325666835d7f8b102d596dacd66c97c037ada52c2826bf944466d21b4eae05a97f

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Rqdarrhtrsoihy.dll
            Filesize

            4.3MB

            MD5

            e8720a108ab06a718139ead59450621e

            SHA1

            d23f2e8a20798530fe570909e55374195b7838bb

            SHA256

            4b3dcbd0f0e08a3e4f7c5b0318588ebc4d118d9ce669edb0c10c8fe27649c799

            SHA512

            5d25e41520abcb68f5c0c9722cf9db9b2d6e808616c566979f858b2fcda0e43409dba15a19e59f05559b09f8f527abee971d4dc644cc852e21fad29e6202c3e4

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Rqdarrhtrsoihy.dll
            Filesize

            4.3MB

            MD5

            e8720a108ab06a718139ead59450621e

            SHA1

            d23f2e8a20798530fe570909e55374195b7838bb

            SHA256

            4b3dcbd0f0e08a3e4f7c5b0318588ebc4d118d9ce669edb0c10c8fe27649c799

            SHA512

            5d25e41520abcb68f5c0c9722cf9db9b2d6e808616c566979f858b2fcda0e43409dba15a19e59f05559b09f8f527abee971d4dc644cc852e21fad29e6202c3e4

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Rqdarrhtrsoihy.dll
            Filesize

            4.3MB

            MD5

            e8720a108ab06a718139ead59450621e

            SHA1

            d23f2e8a20798530fe570909e55374195b7838bb

            SHA256

            4b3dcbd0f0e08a3e4f7c5b0318588ebc4d118d9ce669edb0c10c8fe27649c799

            SHA512

            5d25e41520abcb68f5c0c9722cf9db9b2d6e808616c566979f858b2fcda0e43409dba15a19e59f05559b09f8f527abee971d4dc644cc852e21fad29e6202c3e4

            Download Submit

          • memory/1368-156-0x0000000003F30000-0x0000000004070000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/1368-146-0x0000000002010000-0x000000000245E000-memory.dmp

            Filesize

            4.3MB

            Download

          • memory/1368-154-0x0000000003F30000-0x0000000004070000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/1368-153-0x0000000003F30000-0x0000000004070000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/1368-152-0x0000000003F30000-0x0000000004070000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/1368-151-0x0000000003F30000-0x0000000004070000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/1368-150-0x0000000003340000-0x0000000003E70000-memory.dmp

            Filesize

            11.2MB

            Download

          • memory/1368-163-0x0000000003340000-0x0000000003E70000-memory.dmp

            Filesize

            11.2MB

            Download

          • memory/1368-155-0x0000000003F30000-0x0000000004070000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/1368-149-0x0000000003340000-0x0000000003E70000-memory.dmp

            Filesize

            11.2MB

            Download

          • memory/1368-148-0x0000000003340000-0x0000000003E70000-memory.dmp

            Filesize

            11.2MB

            Download

          • memory/2056-147-0x0000000000400000-0x0000000002E92000-memory.dmp

            Filesize

            42.6MB

            Download

          • memory/2056-141-0x0000000000400000-0x0000000002E92000-memory.dmp

            Filesize

            42.6MB

            Download

          • memory/2056-140-0x0000000004E10000-0x00000000051C7000-memory.dmp

            Filesize

            3.7MB

            Download

          • memory/2056-139-0x0000000004B02000-0x0000000004E05000-memory.dmp

            Filesize

            3.0MB

            Download

          • memory/3304-134-0x0000000000400000-0x0000000002BA2000-memory.dmp

            Filesize

            39.6MB

            Download

          • memory/3304-132-0x0000000002C99000-0x0000000002CAC000-memory.dmp

            Filesize

            76KB

            Download

          • memory/3304-133-0x00000000047A0000-0x00000000047A9000-memory.dmp

            Filesize

            36KB

            Download

          • memory/3304-135-0x0000000000400000-0x0000000002BA2000-memory.dmp

            Filesize

            39.6MB

            Download

          • memory/4700-158-0x000001FEC8730000-0x000001FEC8870000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/4700-159-0x000001FEC8730000-0x000001FEC8870000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/4700-160-0x0000000000890000-0x0000000000B2B000-memory.dmp

            Filesize

            2.6MB

            Download

          • memory/4700-161-0x000001FEC6CE0000-0x000001FEC6F8C000-memory.dmp

            Filesize

            2.7MB

            Download