Overview

overview

10

Static

static

3

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d

  • Size

    15.7MB

  • Sample

    231006-hfxa1abf62

  • MD5

    3141032e3b1e4f3ee0d0a1fe68ccc6e8

  • SHA1

    37adc7f63e2c38b2ad803c49d2782be701da9b56

  • SHA256

    70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d

  • SHA512

    d063301b2c07d8722594dd2eec9fbcb100385bcaac9843c5f329537845888803c3a6ae68ac33983b9ea429bb15d74b43a189ef4bc359c80dbb19e46ae938f0e5

  • SSDEEP

    393216:g8EDE090yXtcYODN8EDE090yXtcYODCef/GyF3ibKL4BCXtU/PS:gjg09jtcYyjg09jtcYyxFSbi4StU6

Score
10/10
gluptebasmokeloaderup3backdoordiscoverydropperevasionloadertrojan

Malware Config

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/
rc4.i32
rc4.i32

Targets

    • Target

      70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d

    • Size

      15.7MB

    • MD5

      3141032e3b1e4f3ee0d0a1fe68ccc6e8

    • SHA1

      37adc7f63e2c38b2ad803c49d2782be701da9b56

    • SHA256

      70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d

    • SHA512

      d063301b2c07d8722594dd2eec9fbcb100385bcaac9843c5f329537845888803c3a6ae68ac33983b9ea429bb15d74b43a189ef4bc359c80dbb19e46ae938f0e5

    • SSDEEP

      393216:g8EDE090yXtcYODN8EDE090yXtcYODCef/GyF3ibKL4BCXtU/PS:gjg09jtcYyjg09jtcYyxFSbi4StU6

    Score
    10/10
    gluptebasmokeloaderup3backdoordiscoverydropperevasionloadertrojan

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Drops file in Drivers directory

    • Modifies Windows Firewall

      evasion

    • Stops running service(s)

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Scheduled Task/Job

1
T1053

Privilege Escalation

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Scheduled Task/Job

1
T1053

Defense Evasion

Impair Defenses

1
T1562

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Service Stop

1
T1489

Resource Development

Reconnaissance

Tasks