Overview

overview

10

Static

static

dridex

windows10_x64

10

Analysis

  • max time kernel
    137s
  • max time network
    139s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    31-12-2021 13:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    46a4d3889acd9e2e596deeccb7df2dc5a7ad93452768ba960d1a7d0796a3a839.exe

  • Size

    1.8MB

  • MD5

    f36abafaf91c9d271e23b37324ebab3f

  • SHA1

    1bfbd5cf8eebf6b351b99e1186853e1c94aacc30

  • SHA256

    46a4d3889acd9e2e596deeccb7df2dc5a7ad93452768ba960d1a7d0796a3a839

  • SHA512

    aa4eb4cae2cd7faa20b682087a366725d6220c56ee9384cbcac7e4297b76afd339665e4d62dec00fa295068ab6ac71fe40387951441a6c62b23b41554148f529

Score
10/10
danabot4bankertrojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.244.223:443

192.236.194.72:443
Attributes
  • embedded_hash

    0FA95F120D6EB149A5D48E36BC76879D

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot
  • Danabot Loader Component 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\46a4d3889acd9e2e596deeccb7df2dc5a7ad93452768ba960d1a7d0796a3a839.exe
    "C:\Users\Admin\AppData\Local\Temp\46a4d3889acd9e2e596deeccb7df2dc5a7ad93452768ba960d1a7d0796a3a839.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3672
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\46A4D3~1.DLL,s C:\Users\Admin\AppData\Local\Temp\46A4D3~1.EXE
      2⤵
      • Loads dropped DLL
      PID:4408
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 580
      2⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\46A4D3~1.DLL
    MD5

    b3471a2b5a440d4b87ab1a2ec364666f

    SHA1

    210d72b130256af8149dea7c4b817fb25ca718c3

    SHA256

    0311313be78ca8074281e33557a8c99d23e5079e78a9ed032a6d9a130138cae1

    SHA512

    33823ed1efaf760d2c843a56b8922b948a211ef6f024c69e943c778de7f1ba80114e01cd58b71724bc19956e3de00e868d6dbf83dc2e38c9f1cbaeeb1caf736e

    Download Submit
  • \Users\Admin\AppData\Local\Temp\46A4D3~1.DLL
    MD5

    b3471a2b5a440d4b87ab1a2ec364666f

    SHA1

    210d72b130256af8149dea7c4b817fb25ca718c3

    SHA256

    0311313be78ca8074281e33557a8c99d23e5079e78a9ed032a6d9a130138cae1

    SHA512

    33823ed1efaf760d2c843a56b8922b948a211ef6f024c69e943c778de7f1ba80114e01cd58b71724bc19956e3de00e868d6dbf83dc2e38c9f1cbaeeb1caf736e

    Download Submit
  • memory/3672-115-0x0000000000CAE000-0x0000000000E3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3672-116-0x0000000000E40000-0x0000000000FE7000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/3672-117-0x0000000000400000-0x0000000000903000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/4408-118-0x0000000000000000-mapping.dmp
    Download