Overview
overview
10Static
static
10The-MALWAR...ot.exe
windows7-x64
10The-MALWAR...ot.exe
windows10-2004-x64
10The-MALWAR...ll.exe
windows7-x64
10The-MALWAR...ll.exe
windows10-2004-x64
10The-MALWAR...BS.exe
windows7-x64
10The-MALWAR...BS.exe
windows10-2004-x64
10The-MALWAR...in.exe
windows7-x64
7The-MALWAR...in.exe
windows10-2004-x64
7The-MALWAR....A.exe
windows7-x64
7The-MALWAR....A.exe
windows10-2004-x64
7The-MALWAR....A.exe
windows7-x64
10The-MALWAR....A.exe
windows10-2004-x64
10The-MALWAR....A.dll
windows7-x64
7The-MALWAR....A.dll
windows10-2004-x64
6The-MALWAR...r.xlsm
windows7-x64
10The-MALWAR...r.xlsm
windows10-2004-x64
10The-MALWAR...36c859
ubuntu-20.04-amd64
8The-MALWAR...caa742
ubuntu-20.04-amd64
8The-MALWAR...c1a732
ubuntu-20.04-amd64
8The-MALWAR...57c046
ubuntu-20.04-amd64
8The-MALWAR...4cde86
ubuntu-20.04-amd64
8The-MALWAR...460a01
ubuntu-20.04-amd64
8The-MALWAR...ece0c5
ubuntu-20.04-amd64
8The-MALWAR...257619
ubuntu-20.04-amd64
8The-MALWAR...fbcc59
ubuntu-20.04-amd64
8The-MALWAR...54f69c
ubuntu-20.04-amd64
8The-MALWAR...d539a6
ubuntu-18.04-amd64
8The-MALWAR...4996dd
ubuntu-20.04-amd64
8The-MALWAR...8232d5
ubuntu-18.04-amd64
8The-MALWAR...66b948
ubuntu-20.04-amd64
8The-MALWAR...f9db86
ubuntu-20.04-amd64
8The-MALWAR...ea2485
ubuntu-20.04-amd64
8Analysis
-
max time kernel
180s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
01-03-2024 21:28
Static task
static1
Behavioral task
behavioral1
Sample
The-MALWARE-Repo-master/Banking-Malware/DanaBot.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
The-MALWARE-Repo-master/Banking-Malware/DanaBot.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Dridex.JhiSharp.dll.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Dridex.JhiSharp.dll.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexDroppedVBS.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexDroppedVBS.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexLoader.bin.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexLoader.bin.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.dll
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
The-MALWARE-Repo-master/Banking-Malware/Zloader.xlsm
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
The-MALWARE-Repo-master/Banking-Malware/Zloader.xlsm
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/001eb377f0452060012124cb214f658754c7488ccb82e23ec56b2f45a636c859
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral18
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/041bc20ca8ac3161098cbc976e67e3c0f1b672ad36ecbe22fd21cbd53bcaa742
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral19
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral20
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral21
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/2378e76aba1ad6e0c937fb39989217bf0de616fdad4726c0f4233bf5414cde86
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral22
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral23
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/3205603282a636979a55aa1e1be518cd3adcbbe491745d996ceb4b5a4dece0c5
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral24
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/453468b86856665f2cc0e0e71668c0b6aac8b14326c623995ba5963f22257619
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral25
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral26
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral27
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/7745b070943e910e8807e3521ac7b7a01401d131bf6c18a63433f8177ed539a6
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral28
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral29
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral30
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral31
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral32
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/d1e82d4a37959a9e6b661e31b8c8c6d2813c93ac92508a2771b2491b04ea2485
Resource
ubuntu2004-amd64-20240221-en
General
-
Target
The-MALWARE-Repo-master/Banking-Malware/Zloader.xlsm
-
Size
93KB
-
MD5
b36a0543b28f4ad61d0f64b729b2511b
-
SHA1
bf62dc338b1dd50a3f7410371bc3f2206350ebea
-
SHA256
90c03a8ca35c33aad5e77488625598da6deeb08794e6efc9f1ddbe486df33e0c
-
SHA512
cf691e088f9852a3850ee458ef56406ead4aea539a46f8f90eb8e300bc06612a66dfa6c9dee8dcb801e7edf7fb4ed35226a5684f4164eaad073b9511189af037
-
SSDEEP
1536:0sqG3SkDNIVXnR8TeYSSkCXgN+Uu+j6XJaRqWD/0ACKNONUhfy:0sNrxWXnCjiubXKD/EQA
Malware Config
Extracted
https://erpoweredent.at/3/zte.dll
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4776 3144 rundll32.exe EXCEL.EXE -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
EXCEL.EXEdescription ioc process File opened (read-only) \??\B: EXCEL.EXE File opened (read-only) \??\J: EXCEL.EXE File opened (read-only) \??\L: EXCEL.EXE File opened (read-only) \??\R: EXCEL.EXE File opened (read-only) \??\U: EXCEL.EXE File opened (read-only) \??\I: EXCEL.EXE File opened (read-only) \??\M: EXCEL.EXE File opened (read-only) \??\T: EXCEL.EXE File opened (read-only) \??\W: EXCEL.EXE File opened (read-only) \??\X: EXCEL.EXE File opened (read-only) \??\Z: EXCEL.EXE File opened (read-only) \??\E: EXCEL.EXE File opened (read-only) \??\H: EXCEL.EXE File opened (read-only) \??\O: EXCEL.EXE File opened (read-only) \??\P: EXCEL.EXE File opened (read-only) \??\Y: EXCEL.EXE File opened (read-only) \??\A: EXCEL.EXE File opened (read-only) \??\G: EXCEL.EXE File opened (read-only) \??\K: EXCEL.EXE File opened (read-only) \??\N: EXCEL.EXE File opened (read-only) \??\Q: EXCEL.EXE File opened (read-only) \??\S: EXCEL.EXE File opened (read-only) \??\V: EXCEL.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3144 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 3144 EXCEL.EXE 3144 EXCEL.EXE 3144 EXCEL.EXE 3144 EXCEL.EXE 3144 EXCEL.EXE 3144 EXCEL.EXE 3144 EXCEL.EXE 3144 EXCEL.EXE 3144 EXCEL.EXE 3144 EXCEL.EXE 3144 EXCEL.EXE 3144 EXCEL.EXE 3144 EXCEL.EXE 3144 EXCEL.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 3144 wrote to memory of 4776 3144 EXCEL.EXE rundll32.exe PID 3144 wrote to memory of 4776 3144 EXCEL.EXE rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Banking-Malware\Zloader.xlsm"1⤵
- Enumerates connected drives
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\nxTgTGh\ECeMdPT\EnVYsVZ.dll,DllRegisterServer2⤵
- Process spawned unexpected child process
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=760 --field-trial-handle=3488,i,1267426273081718772,6254127258555406296,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3144-1-0x00007FFF24FD0000-0x00007FFF251C5000-memory.dmpFilesize
2.0MB
-
memory/3144-0-0x00007FFEE5050000-0x00007FFEE5060000-memory.dmpFilesize
64KB
-
memory/3144-2-0x00007FFEE5050000-0x00007FFEE5060000-memory.dmpFilesize
64KB
-
memory/3144-3-0x00007FFF24FD0000-0x00007FFF251C5000-memory.dmpFilesize
2.0MB
-
memory/3144-4-0x00007FFEE5050000-0x00007FFEE5060000-memory.dmpFilesize
64KB
-
memory/3144-5-0x00007FFF24FD0000-0x00007FFF251C5000-memory.dmpFilesize
2.0MB
-
memory/3144-6-0x00007FFEE5050000-0x00007FFEE5060000-memory.dmpFilesize
64KB
-
memory/3144-8-0x00007FFEE5050000-0x00007FFEE5060000-memory.dmpFilesize
64KB
-
memory/3144-7-0x00007FFF24FD0000-0x00007FFF251C5000-memory.dmpFilesize
2.0MB
-
memory/3144-9-0x00007FFF24FD0000-0x00007FFF251C5000-memory.dmpFilesize
2.0MB
-
memory/3144-10-0x00007FFF24FD0000-0x00007FFF251C5000-memory.dmpFilesize
2.0MB
-
memory/3144-11-0x00007FFF24FD0000-0x00007FFF251C5000-memory.dmpFilesize
2.0MB
-
memory/3144-12-0x00007FFF24FD0000-0x00007FFF251C5000-memory.dmpFilesize
2.0MB
-
memory/3144-13-0x00007FFF24FD0000-0x00007FFF251C5000-memory.dmpFilesize
2.0MB
-
memory/3144-14-0x00007FFEE2F50000-0x00007FFEE2F60000-memory.dmpFilesize
64KB
-
memory/3144-15-0x00007FFF24FD0000-0x00007FFF251C5000-memory.dmpFilesize
2.0MB
-
memory/3144-16-0x00007FFF24FD0000-0x00007FFF251C5000-memory.dmpFilesize
2.0MB
-
memory/3144-17-0x00007FFEE2F50000-0x00007FFEE2F60000-memory.dmpFilesize
64KB
-
memory/3144-27-0x00007FFF24FD0000-0x00007FFF251C5000-memory.dmpFilesize
2.0MB
-
memory/3144-28-0x00007FFF24FD0000-0x00007FFF251C5000-memory.dmpFilesize
2.0MB
-
memory/3144-29-0x00007FFF24FD0000-0x00007FFF251C5000-memory.dmpFilesize
2.0MB