Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Analysis

  • max time kernel
    157s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/10/2022, 09:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d7b7d7150d8282dfdfc0de64b54f2c66c82b5e21d180c2dc3566a3205186278f.exe

  • Size

    193KB

  • MD5

    056e389ed68b6441edc19c32cae3c36f

  • SHA1

    e8eca80ac1eddd46702ea1f0bda93c537f611928

  • SHA256

    d7b7d7150d8282dfdfc0de64b54f2c66c82b5e21d180c2dc3566a3205186278f

  • SHA512

    61b3054a7a1f053516cfbdc3167ed044c72f36a2b155391283d5d8030e71ebab941d6ba6dcfef8b7a439b10bdeefb9020b122d4901cda8f741151b1708decbad

  • SSDEEP

    3072:z2XOjuimzLDWEBXM05Ftyv4P8/hWQ2oOX0Kfj3:KOuimzLR5McEgkZWQ2TX0O

Score
10/10
danabotsmokeloaderbackdoorbankertrojan

Malware Config

Extracted

Family

danabot

Attributes
  • embedded_hash

    56951C922035D696BFCE443750496462

  • type

    loader

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot
  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 39 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d7b7d7150d8282dfdfc0de64b54f2c66c82b5e21d180c2dc3566a3205186278f.exe
    "C:\Users\Admin\AppData\Local\Temp\d7b7d7150d8282dfdfc0de64b54f2c66c82b5e21d180c2dc3566a3205186278f.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:5064
  • C:\Users\Admin\AppData\Local\Temp\4DAE.exe
    C:\Users\Admin\AppData\Local\Temp\4DAE.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3676
    • C:\Windows\SysWOW64\agentactivationruntimestarter.exe
      C:\Windows\system32\agentactivationruntimestarter.exe
      2⤵
        PID:2076
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:3356
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x49c 0x4f0
      1⤵
        PID:4384

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\4DAE.exe
        Filesize

        1.2MB

        MD5

        e6c9669200bcd09bc7d634ed43d23c06

        SHA1

        caa393016b0e944f6fb53424161b48b449b0f46b

        SHA256

        3d71d4985c8c7b1183fcee2a969b6267f72e6f3a99f794e52e01229d1e7e5bf0

        SHA512

        5adc06a84be2dacfd266da58d2323bfeae214e1e87ab8cfeae98d7ff6bb39c4b0796aeb0da5a23572a259702584b586cfcc8109044a3f2226e7afe32f8cfcec4

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\4DAE.exe
        Filesize

        1.2MB

        MD5

        e6c9669200bcd09bc7d634ed43d23c06

        SHA1

        caa393016b0e944f6fb53424161b48b449b0f46b

        SHA256

        3d71d4985c8c7b1183fcee2a969b6267f72e6f3a99f794e52e01229d1e7e5bf0

        SHA512

        5adc06a84be2dacfd266da58d2323bfeae214e1e87ab8cfeae98d7ff6bb39c4b0796aeb0da5a23572a259702584b586cfcc8109044a3f2226e7afe32f8cfcec4

        Download Submit

      • memory/3676-140-0x000000000235D000-0x000000000247B000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/3676-141-0x00000000024D0000-0x0000000002792000-memory.dmp

        Filesize

        2.8MB

        Download

      • memory/3676-143-0x0000000000400000-0x00000000006CE000-memory.dmp

        Filesize

        2.8MB

        Download

      • memory/3676-144-0x00000000024D0000-0x0000000002792000-memory.dmp

        Filesize

        2.8MB

        Download

      • memory/3676-145-0x0000000000400000-0x00000000006CE000-memory.dmp

        Filesize

        2.8MB

        Download

      • memory/5064-136-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

        Download

      • memory/5064-135-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

        Download

      • memory/5064-134-0x0000000002180000-0x0000000002189000-memory.dmp

        Filesize

        36KB

        Download

      • memory/5064-133-0x00000000004D0000-0x00000000005D0000-memory.dmp

        Filesize

        1024KB

        Download