Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    730b14f0cd762e802dc62748965715c79094ba8c6a417adedb901dec47f0f0ef

  • Size

    1.1MB

  • Sample

    221220-wytvgsdf7t

  • MD5

    12c551d95262d265f771692612607054

  • SHA1

    0b78e8322b95d989ba8e8a8c1e62da7e482c5284

  • SHA256

    730b14f0cd762e802dc62748965715c79094ba8c6a417adedb901dec47f0f0ef

  • SHA512

    45a0a37358909e3bac7f4afac1ae4f24573e0158350cfcbc6902385ed19560014c98978b633cf0f3a6cfacfd1f2214de67db1e7fed9b5009d92a9f105552732e

  • SSDEEP

    24576:zawiDKAi6DmnL6nCFgTqKdjh0a8+brTc3DS9Vfo20+:efKf6KL6vTqo8sIDE4+

Score
10/10
danabotbankerdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      730b14f0cd762e802dc62748965715c79094ba8c6a417adedb901dec47f0f0ef

    • Size

      1.1MB

    • MD5

      12c551d95262d265f771692612607054

    • SHA1

      0b78e8322b95d989ba8e8a8c1e62da7e482c5284

    • SHA256

      730b14f0cd762e802dc62748965715c79094ba8c6a417adedb901dec47f0f0ef

    • SHA512

      45a0a37358909e3bac7f4afac1ae4f24573e0158350cfcbc6902385ed19560014c98978b633cf0f3a6cfacfd1f2214de67db1e7fed9b5009d92a9f105552732e

    • SSDEEP

      24576:zawiDKAi6DmnL6nCFgTqKdjh0a8+brTc3DS9Vfo20+:efKf6KL6vTqo8sIDE4+

    Score
    10/10
    danabotbankerdiscoverypersistencetrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Blocklisted process makes network request

    • Sets DLL path for service in the registry

      persistence

    • Sets service image path in registry

      persistence

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks