Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/02/2023, 01:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ac0f63093501fdc89039356f97161f4dad58f6398350f9f64320d169c94338e5.exe

  • Size

    205KB

  • MD5

    1b7febefdcd54645120623c4ce42a459

  • SHA1

    fd8d246609e05c95b48fd3050de7f1e0e84aea19

  • SHA256

    ac0f63093501fdc89039356f97161f4dad58f6398350f9f64320d169c94338e5

  • SHA512

    c134999371558246b1d64e49e2b4618cbab39f70e4359dbd79fd2ad76d7e60cd8cd4e3657e970f011f1a3337c0bbec375ca1312e44392ae044dc245715812ee0

  • SSDEEP

    3072:bYwx7qrhMfHSeoXeb7XT4wQY5BH/jWRtoQklZTBdxJCvysXaMxoXHrnpKQ:0O7E9ObzT5V5gRbklHd6ysXa5N

Score
10/10
smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

Malware Config

Signatures

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 27 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 30 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac0f63093501fdc89039356f97161f4dad58f6398350f9f64320d169c94338e5.exe
    "C:\Users\Admin\AppData\Local\Temp\ac0f63093501fdc89039356f97161f4dad58f6398350f9f64320d169c94338e5.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1088
  • C:\Users\Admin\AppData\Local\Temp\DE4F.exe
    C:\Users\Admin\AppData\Local\Temp\DE4F.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4556
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ruifriwreh.dll,start
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Accesses Microsoft Outlook accounts
      • Accesses Microsoft Outlook profiles
      • Suspicious use of SetThreadContext
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:4696
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 14184
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:2104
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
        3⤵
          PID:2832
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
          3⤵
            PID:3192
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 480
          2⤵
          • Program crash
          PID:4692
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4556 -ip 4556
        1⤵
          PID:1840
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:3896

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\DE4F.exe
            Filesize

            3.7MB

            MD5

            97107803c704b37f452541c876c0d90c

            SHA1

            cbd35074317c0d6373842c0a115f31ad5c7aacd9

            SHA256

            eb60c23e27f50cf733d1af7d1132298ba24cb67286b2b2f025200bdd226c7a02

            SHA512

            36860cd28fbd1fdaf4893277d690333693e857d37faf5a7089eba16f9a062186f3aa4936a1fcf308161065c4cd72a339d0eb11f80d24bc26f649e05d482ab5d6

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\DE4F.exe
            Filesize

            3.7MB

            MD5

            97107803c704b37f452541c876c0d90c

            SHA1

            cbd35074317c0d6373842c0a115f31ad5c7aacd9

            SHA256

            eb60c23e27f50cf733d1af7d1132298ba24cb67286b2b2f025200bdd226c7a02

            SHA512

            36860cd28fbd1fdaf4893277d690333693e857d37faf5a7089eba16f9a062186f3aa4936a1fcf308161065c4cd72a339d0eb11f80d24bc26f649e05d482ab5d6

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Ruifriwreh.dll
            Filesize

            4.3MB

            MD5

            c3a82c601f9404ae027f1f75eb331ba3

            SHA1

            cecb395cf626c598189e92e2afa0eb5af3d16403

            SHA256

            394ffa9fade1eee95dd7fdfeb354bf29f6dd7a8242913bb2681330a3f5cc9c0b

            SHA512

            b02617b13eaecb2d52ebfea3a54ef7739c95362ce3b4572f49c44abe0339284038571280da665ff7242391bb440fb34a06521a14602bf659ca4f3cb4844822a0

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Ruifriwreh.dll
            Filesize

            4.3MB

            MD5

            c3a82c601f9404ae027f1f75eb331ba3

            SHA1

            cecb395cf626c598189e92e2afa0eb5af3d16403

            SHA256

            394ffa9fade1eee95dd7fdfeb354bf29f6dd7a8242913bb2681330a3f5cc9c0b

            SHA512

            b02617b13eaecb2d52ebfea3a54ef7739c95362ce3b4572f49c44abe0339284038571280da665ff7242391bb440fb34a06521a14602bf659ca4f3cb4844822a0

            Download Submit

          • memory/1088-135-0x0000000000400000-0x0000000000567000-memory.dmp

            Filesize

            1.4MB

            Download

          • memory/1088-132-0x00000000006EF000-0x0000000000702000-memory.dmp

            Filesize

            76KB

            Download

          • memory/1088-134-0x0000000000400000-0x0000000000567000-memory.dmp

            Filesize

            1.4MB

            Download

          • memory/1088-133-0x00000000005E0000-0x00000000005E9000-memory.dmp

            Filesize

            36KB

            Download

          • memory/2104-160-0x0000018DB7D90000-0x0000018DB8039000-memory.dmp

            Filesize

            2.7MB

            Download

          • memory/2104-159-0x00000000009C0000-0x0000000000C57000-memory.dmp

            Filesize

            2.6MB

            Download

          • memory/2104-158-0x0000018DB97E0000-0x0000018DB9920000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2104-157-0x0000018DB97E0000-0x0000018DB9920000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/4556-140-0x0000000002AC0000-0x0000000002FAA000-memory.dmp

            Filesize

            4.9MB

            Download

          • memory/4556-146-0x0000000000400000-0x00000000008F6000-memory.dmp

            Filesize

            5.0MB

            Download

          • memory/4556-139-0x0000000002730000-0x0000000002AB8000-memory.dmp

            Filesize

            3.5MB

            Download

          • memory/4556-141-0x0000000000400000-0x00000000008F6000-memory.dmp

            Filesize

            5.0MB

            Download

          • memory/4556-142-0x0000000000400000-0x00000000008F6000-memory.dmp

            Filesize

            5.0MB

            Download

          • memory/4696-152-0x0000000005240000-0x0000000005380000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/4696-154-0x0000000004820000-0x0000000004960000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/4696-155-0x0000000004820000-0x0000000004960000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/4696-147-0x0000000003C10000-0x000000000475D000-memory.dmp

            Filesize

            11.3MB

            Download

          • memory/4696-153-0x0000000005240000-0x0000000005380000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/4696-148-0x0000000003C10000-0x000000000475D000-memory.dmp

            Filesize

            11.3MB

            Download

          • memory/4696-151-0x0000000004820000-0x0000000004960000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/4696-150-0x0000000004820000-0x0000000004960000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/4696-162-0x0000000003C10000-0x000000000475D000-memory.dmp

            Filesize

            11.3MB

            Download

          • memory/4696-149-0x0000000003C10000-0x000000000475D000-memory.dmp

            Filesize

            11.3MB

            Download