danabot | ed30da424dc43e62e30ae480f41e237d0a8d7dbdd526d466cdc61f6303750051 | Triage

Submit
Reports

Overview

overview

Static

static

dridex

windows10-2004-x64

Sharing

General

Target

ed30da424dc43e62e30ae480f41e237d0a8d7dbdd526d466cdc61f6303750051
Size

306KB
Sample

221219-hqe5gaed65
MD5

8ba89cb6de7e41ec69404990443a97ba
SHA1

af55bcc1d185f3e820d2a5a7eeb10170cf10011c
SHA256

ed30da424dc43e62e30ae480f41e237d0a8d7dbdd526d466cdc61f6303750051
SHA512

a9eeef96356bcdaa5a5ed8db9d4196bbe854f5ed11a7dc1c8e55fa5ee9ac3b50625f9b0851ebc6e29ddac8b23d019c47b55d4d48be0001664cc2b1cfd328c11a
SSDEEP

6144:feRrbPL/QsQk7H4p0HakV/S0iPvzpQ6rFiaI:fALQspo0z6xnzpQ6rF

Score

10^/10

danabot smokeloader backdoor banker discovery persistence trojan

Static task

static1

Behavioral task

behavioral1

Sample

ed30da424dc43e62e30ae480f41e237d0a8d7dbdd526d466cdc61f6303750051.exe

Resource

win10v2004-20221111-en

danabot smokeloader backdoor banker discovery persistence trojan

windows10-2004-x64

26 signatures

150 seconds

Malware Config

Targets

- Target
  
  ed30da424dc43e62e30ae480f41e237d0a8d7dbdd526d466cdc61f6303750051
- Size
  
  306KB
- MD5
  
  8ba89cb6de7e41ec69404990443a97ba
- SHA1
  
  af55bcc1d185f3e820d2a5a7eeb10170cf10011c
- SHA256
  
  ed30da424dc43e62e30ae480f41e237d0a8d7dbdd526d466cdc61f6303750051
- SHA512
  
  a9eeef96356bcdaa5a5ed8db9d4196bbe854f5ed11a7dc1c8e55fa5ee9ac3b50625f9b0851ebc6e29ddac8b23d019c47b55d4d48be0001664cc2b1cfd328c11a
- SSDEEP
  
  6144:feRrbPL/QsQk7H4p0HakV/S0iPvzpQ6rFiaI:fALQspo0z6xnzpQ6rF
Score

10^/10

danabot smokeloader backdoor banker discovery persistence trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Sets DLL path for service in the registry
  persistence
- Sets service image path in registry
  persistence
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

danabotsmokeloaderbackdoorbankerdiscoverypersistencetrojan

© 2018-2024

Terms | Privacy