Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/12/2022, 20:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    1de2b42c0729af10d2f0762591e4b4d6c6a2461214b29263799f4234800aa818.exe

  • Size

    215KB

  • MD5

    74f8cd9fcfd6ce91d2d909d195d5b7e3

  • SHA1

    0f4d1c2fb9359cf196d7c50b7348d79f07d9b100

  • SHA256

    1de2b42c0729af10d2f0762591e4b4d6c6a2461214b29263799f4234800aa818

  • SHA512

    eeaff658ef13cb097d4541978a7af57fbb34ce767897925dc5dcf6420c09571cb9aced3c176d11a860caa6e7484356ea81cf50a9b9d8b8bb2bc9e7e82a961643

  • SSDEEP

    3072:rFtwLvlPTCV57kAwK97s1qFvml2aKTohcWo7b/rXq0NHCDml:hWLvxIGqdn7scWYmGCa

Score
10/10
danabotsmokeloaderbackdoorbankertrojan

Malware Config

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot
  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 26 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 30 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1de2b42c0729af10d2f0762591e4b4d6c6a2461214b29263799f4234800aa818.exe
    "C:\Users\Admin\AppData\Local\Temp\1de2b42c0729af10d2f0762591e4b4d6c6a2461214b29263799f4234800aa818.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:5116
  • C:\Users\Admin\AppData\Local\Temp\8CDE.exe
    C:\Users\Admin\AppData\Local\Temp\8CDE.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4356
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp",Wufaiiuuye
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Checks processor information in registry
      • Suspicious use of WriteProcessMemory
      PID:3628
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 14144
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:2924
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 528
      2⤵
      • Program crash
      PID:1996
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4356 -ip 4356
    1⤵
      PID:3660
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4996

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\8CDE.exe
              Filesize

              1.1MB

              MD5

              4c218215518e8bb6e9b02894ea2f3e46

              SHA1

              b8c23cf7863abcc30bc79191f609c9ee4f9f33d2

              SHA256

              03ac48aee2955b42f75b62c563887341a4157e910925e89e6fd6aed32595e1cb

              SHA512

              9d58653c1c6338bf5323ecf6db0f7c362e60c820ab84d3483b324179588d3261c6479a60cc9bcc1f5d5875e7a7fa1e061a69f9a26b61f358f8d576f5db457b61

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\8CDE.exe
              Filesize

              1.1MB

              MD5

              4c218215518e8bb6e9b02894ea2f3e46

              SHA1

              b8c23cf7863abcc30bc79191f609c9ee4f9f33d2

              SHA256

              03ac48aee2955b42f75b62c563887341a4157e910925e89e6fd6aed32595e1cb

              SHA512

              9d58653c1c6338bf5323ecf6db0f7c362e60c820ab84d3483b324179588d3261c6479a60cc9bcc1f5d5875e7a7fa1e061a69f9a26b61f358f8d576f5db457b61

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp
              Filesize

              797KB

              MD5

              24925b25552a7d8f1d3292071e545920

              SHA1

              f786e1d40df30f6fed0301d60c823b655f2d6eac

              SHA256

              9931503a3ab908d2840dae6a7cb77a5abc5e77cc67af405d1329b7dfc3fe800b

              SHA512

              242dbf94b06e67fdf0aac29b2f38ce4929d156c42e2413565f203cda1fdb6458e34b26eeb0151fe4f1914432be28b16d648affa63f20c7b480c54e2d9360fb26

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Qsedeqtedeooeo.tmp
              Filesize

              797KB

              MD5

              24925b25552a7d8f1d3292071e545920

              SHA1

              f786e1d40df30f6fed0301d60c823b655f2d6eac

              SHA256

              9931503a3ab908d2840dae6a7cb77a5abc5e77cc67af405d1329b7dfc3fe800b

              SHA512

              242dbf94b06e67fdf0aac29b2f38ce4929d156c42e2413565f203cda1fdb6458e34b26eeb0151fe4f1914432be28b16d648affa63f20c7b480c54e2d9360fb26

              Download Submit

            • memory/2924-158-0x000001BCCF280000-0x000001BCCF4AA000-memory.dmp

              Filesize

              2.2MB

              Download

            • memory/2924-157-0x0000000000FA0000-0x00000000011B9000-memory.dmp

              Filesize

              2.1MB

              Download

            • memory/2924-155-0x000001BCD0C50000-0x000001BCD0D90000-memory.dmp

              Filesize

              1.2MB

              Download

            • memory/2924-154-0x000001BCD0C50000-0x000001BCD0D90000-memory.dmp

              Filesize

              1.2MB

              Download

            • memory/3628-150-0x0000000005310000-0x0000000005450000-memory.dmp

              Filesize

              1.2MB

              Download

            • memory/3628-159-0x00000000061A0000-0x00000000068C5000-memory.dmp

              Filesize

              7.1MB

              Download

            • memory/3628-156-0x0000000005389000-0x000000000538B000-memory.dmp

              Filesize

              8KB

              Download

            • memory/3628-145-0x00000000061A0000-0x00000000068C5000-memory.dmp

              Filesize

              7.1MB

              Download

            • memory/3628-146-0x00000000061A0000-0x00000000068C5000-memory.dmp

              Filesize

              7.1MB

              Download

            • memory/3628-148-0x0000000005310000-0x0000000005450000-memory.dmp

              Filesize

              1.2MB

              Download

            • memory/3628-147-0x0000000005310000-0x0000000005450000-memory.dmp

              Filesize

              1.2MB

              Download

            • memory/3628-149-0x0000000005310000-0x0000000005450000-memory.dmp

              Filesize

              1.2MB

              Download

            • memory/3628-152-0x0000000005310000-0x0000000005450000-memory.dmp

              Filesize

              1.2MB

              Download

            • memory/3628-151-0x0000000005310000-0x0000000005450000-memory.dmp

              Filesize

              1.2MB

              Download

            • memory/4356-142-0x00000000007F0000-0x00000000008DE000-memory.dmp

              Filesize

              952KB

              Download

            • memory/4356-144-0x0000000000400000-0x000000000053E000-memory.dmp

              Filesize

              1.2MB

              Download

            • memory/4356-143-0x0000000002290000-0x00000000023C0000-memory.dmp

              Filesize

              1.2MB

              Download

            • memory/5116-132-0x00000000007C2000-0x00000000007D2000-memory.dmp

              Filesize

              64KB

              Download

            • memory/5116-135-0x0000000000400000-0x000000000045F000-memory.dmp

              Filesize

              380KB

              Download

            • memory/5116-134-0x0000000000400000-0x000000000045F000-memory.dmp

              Filesize

              380KB

              Download

            • memory/5116-133-0x00000000001F0000-0x00000000001F9000-memory.dmp

              Filesize

              36KB

              Download