Overview

overview

10

Static

static

dridex

windows10_x64

10

Analysis

  • max time kernel
    139s
  • max time network
    139s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    23-11-2021 08:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3e2e7ade6f01cbff7cd4cb3380ba211a4646d3e82d295037eb4bb5f85b4835f0.exe

  • Size

    1.8MB

  • MD5

    eccbe02e557ad19e5445a9f1523f1c3d

  • SHA1

    675d681f5da40f365ce2b3e8f55ed259a40a1fdd

  • SHA256

    3e2e7ade6f01cbff7cd4cb3380ba211a4646d3e82d295037eb4bb5f85b4835f0

  • SHA512

    8cbd6e5884ceb900c2755991fd145a5ce9af5ec012c1bff5a057e889b544e83aa55322ca444c36129a7e452dce364999a34828b63601564a89d3e19767affdbd

Score
10/10
danabotbankertrojan

Malware Config

Extracted

Family

danabot

C2

142.11.244.223:443

23.106.122.139:443
Attributes
  • embedded_hash

    0FA95F120D6EB149A5D48E36BC76879D

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot
  • Danabot Loader Component 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3e2e7ade6f01cbff7cd4cb3380ba211a4646d3e82d295037eb4bb5f85b4835f0.exe
    "C:\Users\Admin\AppData\Local\Temp\3e2e7ade6f01cbff7cd4cb3380ba211a4646d3e82d295037eb4bb5f85b4835f0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3368
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\3E2E7A~1.DLL,s C:\Users\Admin\AppData\Local\Temp\3E2E7A~1.EXE
      2⤵
      • Loads dropped DLL
      PID:3024
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 552
      2⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\3E2E7A~1.DLL
    MD5

    b5233c2299e8341e4ce04bb0efebb974

    SHA1

    d26be4546acedcdcc2a0273d655876eeb961866e

    SHA256

    695560ee8329bbc5b4c1e7f9f5442ea4a8258daa529cc50b3b9ca8b63b8eda26

    SHA512

    28a23b53d51f95cf204f596c555f1960bebaea18c9386db555bbd8afe026e120fd1d17e9cd64a2067932c0710afb1b8249455bb515eb8812b322f17a0fe5ae11

    Download Submit

  • \Users\Admin\AppData\Local\Temp\3E2E7A~1.DLL
    MD5

    b5233c2299e8341e4ce04bb0efebb974

    SHA1

    d26be4546acedcdcc2a0273d655876eeb961866e

    SHA256

    695560ee8329bbc5b4c1e7f9f5442ea4a8258daa529cc50b3b9ca8b63b8eda26

    SHA512

    28a23b53d51f95cf204f596c555f1960bebaea18c9386db555bbd8afe026e120fd1d17e9cd64a2067932c0710afb1b8249455bb515eb8812b322f17a0fe5ae11

    Download Submit

  • memory/3024-121-0x0000000000000000-mapping.dmp

    Download

  • memory/3368-118-0x0000000004B81000-0x0000000004D0F000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3368-119-0x0000000004D10000-0x0000000004EB5000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3368-120-0x0000000000400000-0x0000000002CBF000-memory.dmp

    Filesize

    40.7MB

    Download