Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    09/02/2023, 06:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    e3c52701a4e6f27db4476a97879b6781ac6bff224d0982b8ce055ed9a8ea9f60.exe

  • Size

    197KB

  • MD5

    09a57073477de4a9f6e7fe6d988dd40c

  • SHA1

    0471d70b28def5c5fab8b7d1c81913299450ad99

  • SHA256

    e3c52701a4e6f27db4476a97879b6781ac6bff224d0982b8ce055ed9a8ea9f60

  • SHA512

    8e80d851af436e834715e5412ee6bbaff713e5d90aedd10e796c29868e6808ead60ead0dce22627677f6b8f09cb7342986cb901a20e9786fe5212fcf9bbdd6fc

  • SSDEEP

    3072:VG4OvpSAlIfTLXHHAPWbzd5ycaTFYZJ99lhQ3zqc6KKVEkkLLZyaaLHHJic0:VG4fDbLXHgPI1jfuqcxJkkLdaLnJ0

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Signatures

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Deletes itself 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e3c52701a4e6f27db4476a97879b6781ac6bff224d0982b8ce055ed9a8ea9f60.exe
    "C:\Users\Admin\AppData\Local\Temp\e3c52701a4e6f27db4476a97879b6781ac6bff224d0982b8ce055ed9a8ea9f60.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:3680

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3680-116-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-117-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-118-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-119-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-120-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-121-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-122-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-123-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-124-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-125-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-126-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-127-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-128-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-129-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-130-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-131-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-132-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-133-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-134-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-135-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-136-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-137-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-138-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-139-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-140-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-141-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-142-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-143-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-144-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-145-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-146-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-147-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-149-0x000000000094A000-0x000000000095D000-memory.dmp

          Filesize

          76KB

          Download

        • memory/3680-150-0x00000000008E0000-0x00000000008E9000-memory.dmp

          Filesize

          36KB

          Download

        • memory/3680-148-0x0000000077200000-0x000000007738E000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3680-151-0x0000000000400000-0x0000000000562000-memory.dmp

          Filesize

          1.4MB

          Download

        • memory/3680-152-0x000000000094A000-0x000000000095D000-memory.dmp

          Filesize

          76KB

          Download

        • memory/3680-153-0x0000000000400000-0x0000000000562000-memory.dmp

          Filesize

          1.4MB

          Download