Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/10/2022, 10:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    366980f315e59bff372304a9315308a9d4ab575404ffbfc685278a2552382d38.exe

  • Size

    261KB

  • MD5

    56078cea5046247473c4865aec804c36

  • SHA1

    b0c55c0ab1546fd2d88392d2dd911e433d7dc8f4

  • SHA256

    366980f315e59bff372304a9315308a9d4ab575404ffbfc685278a2552382d38

  • SHA512

    a4d649c5f811a196e190e25a357181cc3b1a874fce8c63ff5a4c56c770bb1ed8eb08f51930481473b91de48a5846817bdbb0e0af61bd016722e2265c74516ad5

  • SSDEEP

    3072:mX2UzUURhJ0Gl05Masp45NGI7yfYpmrStWpQFO7EQ495AEi6jvT9pb0Kx:O7/7l+Mas/I7yz2KToQ49SEHrD0S

Score
10/10
danabotsmokeloaderbackdoorbankertrojan

Malware Config

Extracted

Family

danabot

C2

172.86.120.215:443

213.227.155.103:443

103.187.26.147:443

172.86.120.138:443

49.0.50.0:57

51.0.52.0:0

53.0.54.0:1200

55.0.56.0:65535
Attributes
  • embedded_hash

    BBBB0DB8CB7E6D152424535822E445A7

  • type

    loader

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot
  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 42 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 46 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 19 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\366980f315e59bff372304a9315308a9d4ab575404ffbfc685278a2552382d38.exe
    "C:\Users\Admin\AppData\Local\Temp\366980f315e59bff372304a9315308a9d4ab575404ffbfc685278a2552382d38.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:428
  • C:\Users\Admin\AppData\Local\Temp\D825.exe
    C:\Users\Admin\AppData\Local\Temp\D825.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:556
    • C:\Windows\SysWOW64\agentactivationruntimestarter.exe
      C:\Windows\system32\agentactivationruntimestarter.exe
      2⤵
        PID:3016
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
        2⤵
        • Blocklisted process makes network request
        PID:1648
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 620
        2⤵
        • Program crash
        PID:1592
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 872
        2⤵
        • Program crash
        PID:1316
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 936
        2⤵
        • Program crash
        PID:8
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
        2⤵
        • Blocklisted process makes network request
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:3092
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 1000
        2⤵
        • Program crash
        PID:3484
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:2916
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x498 0x3c0
      1⤵
        PID:2132
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 556 -ip 556
        1⤵
          PID:932
        • C:\Users\Admin\AppData\Roaming\sdaauwu
          C:\Users\Admin\AppData\Roaming\sdaauwu
          1⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious behavior: MapViewOfSection
          PID:1904
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 556 -ip 556
          1⤵
            PID:2640
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 556 -ip 556
            1⤵
              PID:2324
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 556 -ip 556
              1⤵
                PID:3476

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\D825.exe
                Filesize

                1.3MB

                MD5

                429ab5fe9bd1db4d4ad8361875c24770

                SHA1

                94620b8a6dbdffb788f261c6e29aa7180e9ca904

                SHA256

                31f98e5ba70bc4c2d3c0fa523f07720f58644dde2f16e26c299be310fc5700df

                SHA512

                36016d3dedad4c8cd16628af4d1ddd593dfc40027d07780d96578c328d2cfaf324db5bfe5bd05eff78b6b82011713a4ae8070432f130e3f79fdb2c6f912a6cac

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\D825.exe
                Filesize

                1.3MB

                MD5

                429ab5fe9bd1db4d4ad8361875c24770

                SHA1

                94620b8a6dbdffb788f261c6e29aa7180e9ca904

                SHA256

                31f98e5ba70bc4c2d3c0fa523f07720f58644dde2f16e26c299be310fc5700df

                SHA512

                36016d3dedad4c8cd16628af4d1ddd593dfc40027d07780d96578c328d2cfaf324db5bfe5bd05eff78b6b82011713a4ae8070432f130e3f79fdb2c6f912a6cac

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Dhfteep.tmp
                Filesize

                3.3MB

                MD5

                9ee66bd586450c037b6a14eed557a159

                SHA1

                6218331454c5204349b259ea260dd2161ce41371

                SHA256

                d9cf31419401bed1796f49f2daea2f9eea468c3643ab9086ba61d24e3283db0f

                SHA512

                eabdb81f278abe54088740b4139ca6d5b8cf99c014102128b9c3ebebf51b163d6ba0b06a066de1eeb33199c2a475c0ce585c102b7684ce2d086b493f842ee8a8

                Download Submit

              • C:\Users\Admin\AppData\Roaming\sdaauwu
                Filesize

                261KB

                MD5

                56078cea5046247473c4865aec804c36

                SHA1

                b0c55c0ab1546fd2d88392d2dd911e433d7dc8f4

                SHA256

                366980f315e59bff372304a9315308a9d4ab575404ffbfc685278a2552382d38

                SHA512

                a4d649c5f811a196e190e25a357181cc3b1a874fce8c63ff5a4c56c770bb1ed8eb08f51930481473b91de48a5846817bdbb0e0af61bd016722e2265c74516ad5

                Download Submit

              • C:\Users\Admin\AppData\Roaming\sdaauwu
                Filesize

                261KB

                MD5

                56078cea5046247473c4865aec804c36

                SHA1

                b0c55c0ab1546fd2d88392d2dd911e433d7dc8f4

                SHA256

                366980f315e59bff372304a9315308a9d4ab575404ffbfc685278a2552382d38

                SHA512

                a4d649c5f811a196e190e25a357181cc3b1a874fce8c63ff5a4c56c770bb1ed8eb08f51930481473b91de48a5846817bdbb0e0af61bd016722e2265c74516ad5

                Download Submit

              • memory/428-133-0x0000000002C70000-0x0000000002C79000-memory.dmp

                Filesize

                36KB

                Download

              • memory/428-134-0x0000000000400000-0x0000000002C2E000-memory.dmp

                Filesize

                40.2MB

                Download

              • memory/428-135-0x0000000000400000-0x0000000002C2E000-memory.dmp

                Filesize

                40.2MB

                Download

              • memory/428-132-0x0000000002CB7000-0x0000000002CCD000-memory.dmp

                Filesize

                88KB

                Download

              • memory/556-152-0x0000000000400000-0x0000000002D3B000-memory.dmp

                Filesize

                41.2MB

                Download

              • memory/556-163-0x0000000006200000-0x0000000006340000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/556-143-0x0000000000400000-0x0000000002D3B000-memory.dmp

                Filesize

                41.2MB

                Download

              • memory/556-144-0x0000000000400000-0x0000000002D3B000-memory.dmp

                Filesize

                41.2MB

                Download

              • memory/556-145-0x0000000000400000-0x0000000002D3B000-memory.dmp

                Filesize

                41.2MB

                Download

              • memory/556-141-0x0000000004B60000-0x0000000004E2C000-memory.dmp

                Filesize

                2.8MB

                Download

              • memory/556-140-0x0000000003198000-0x00000000032B9000-memory.dmp

                Filesize

                1.1MB

                Download

              • memory/556-172-0x0000000005680000-0x000000000613C000-memory.dmp

                Filesize

                10.7MB

                Download

              • memory/556-164-0x0000000006200000-0x0000000006340000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/556-142-0x0000000000400000-0x0000000002D3B000-memory.dmp

                Filesize

                41.2MB

                Download

              • memory/556-162-0x0000000006200000-0x0000000006340000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/556-161-0x0000000006200000-0x0000000006340000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/556-154-0x0000000005680000-0x000000000613C000-memory.dmp

                Filesize

                10.7MB

                Download

              • memory/556-155-0x0000000005680000-0x000000000613C000-memory.dmp

                Filesize

                10.7MB

                Download

              • memory/556-156-0x0000000005680000-0x000000000613C000-memory.dmp

                Filesize

                10.7MB

                Download

              • memory/556-157-0x0000000006200000-0x0000000006340000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/556-158-0x0000000006200000-0x0000000006340000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/556-159-0x0000000006200000-0x0000000006340000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/556-160-0x0000000006200000-0x0000000006340000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/1904-151-0x0000000000400000-0x0000000002C2E000-memory.dmp

                Filesize

                40.2MB

                Download

              • memory/1904-150-0x0000000000400000-0x0000000002C2E000-memory.dmp

                Filesize

                40.2MB

                Download

              • memory/1904-149-0x0000000002D97000-0x0000000002DAC000-memory.dmp

                Filesize

                84KB

                Download

              • memory/3092-166-0x0000000003750000-0x000000000420C000-memory.dmp

                Filesize

                10.7MB

                Download

              • memory/3092-167-0x0000000004210000-0x0000000004350000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/3092-168-0x0000000004210000-0x0000000004350000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/3092-169-0x0000000001200000-0x0000000001B9C000-memory.dmp

                Filesize

                9.6MB

                Download

              • memory/3092-170-0x0000000003750000-0x000000000420C000-memory.dmp

                Filesize

                10.7MB

                Download

              • memory/3092-171-0x0000000003750000-0x000000000420C000-memory.dmp

                Filesize

                10.7MB

                Download