Overview
overview
10Static
static
10The-MALWAR...er.zip
windows7-x64
1The-MALWAR...er.zip
windows10-2004-x64
1The-MALWAR...ot.exe
windows7-x64
10The-MALWAR...ot.exe
windows10-2004-x64
10The-MALWAR...ll.exe
windows7-x64
10The-MALWAR...ll.exe
windows10-2004-x64
10The-MALWAR...BS.exe
windows7-x64
10The-MALWAR...BS.exe
windows10-2004-x64
10The-MALWAR...in.exe
windows7-x64
7The-MALWAR...in.exe
windows10-2004-x64
7The-MALWAR....A.exe
windows7-x64
7The-MALWAR....A.exe
windows10-2004-x64
7The-MALWAR....A.exe
windows7-x64
10The-MALWAR....A.exe
windows10-2004-x64
10The-MALWAR....A.dll
windows7-x64
7The-MALWAR....A.dll
windows10-2004-x64
6The-MALWAR...et.zip
windows7-x64
1The-MALWAR...et.zip
windows10-2004-x64
1The-MALWAR...r.xlsm
windows7-x64
10The-MALWAR...r.xlsm
windows10-2004-x64
10The-MALWAR...36c859
ubuntu-24.04-amd64
8The-MALWAR...caa742
ubuntu-22.04-amd64
8The-MALWAR...c1a732
ubuntu-22.04-amd64
8The-MALWAR...57c046
ubuntu-24.04-amd64
8The-MALWAR...4cde86
ubuntu-24.04-amd64
8The-MALWAR...460a01
ubuntu-24.04-amd64
8The-MALWAR...ece0c5
ubuntu-24.04-amd64
8The-MALWAR...257619
ubuntu-22.04-amd64
8The-MALWAR...fbcc59
ubuntu-22.04-amd64
8The-MALWAR...54f69c
ubuntu-22.04-amd64
8The-MALWAR...d539a6
ubuntu-22.04-amd64
8The-MALWAR...4996dd
ubuntu-24.04-amd64
8Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-09-2024 20:01
Static task
static1
Behavioral task
behavioral1
Sample
The-MALWARE-Repo-master.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
The-MALWARE-Repo-master.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
The-MALWARE-Repo-master/Banking-Malware/DanaBot.exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
The-MALWARE-Repo-master/Banking-Malware/DanaBot.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Dridex.JhiSharp.dll.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Dridex.JhiSharp.dll.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexDroppedVBS.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexDroppedVBS.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexLoader.bin.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexLoader.bin.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.exe
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
The-MALWARE-Repo-master/Banking-Malware/Emotet.zip
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
The-MALWARE-Repo-master/Banking-Malware/Emotet.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
The-MALWARE-Repo-master/Banking-Malware/Zloader.xlsm
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
The-MALWARE-Repo-master/Banking-Malware/Zloader.xlsm
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/001eb377f0452060012124cb214f658754c7488ccb82e23ec56b2f45a636c859
Resource
ubuntu2404-amd64-20240729-en
Behavioral task
behavioral22
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/041bc20ca8ac3161098cbc976e67e3c0f1b672ad36ecbe22fd21cbd53bcaa742
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral23
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
Resource
ubuntu2204-amd64-20240522.1-en
Behavioral task
behavioral24
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral25
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/2378e76aba1ad6e0c937fb39989217bf0de616fdad4726c0f4233bf5414cde86
Resource
ubuntu2404-amd64-20240729-en
Behavioral task
behavioral26
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral27
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/3205603282a636979a55aa1e1be518cd3adcbbe491745d996ceb4b5a4dece0c5
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral28
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/453468b86856665f2cc0e0e71668c0b6aac8b14326c623995ba5963f22257619
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral29
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral30
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral31
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/7745b070943e910e8807e3521ac7b7a01401d131bf6c18a63433f8177ed539a6
Resource
ubuntu2204-amd64-20240522.1-en
Behavioral task
behavioral32
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
Resource
ubuntu2404-amd64-20240729-en
General
-
Target
The-MALWARE-Repo-master/Banking-Malware/Zloader.xlsm
-
Size
93KB
-
MD5
b36a0543b28f4ad61d0f64b729b2511b
-
SHA1
bf62dc338b1dd50a3f7410371bc3f2206350ebea
-
SHA256
90c03a8ca35c33aad5e77488625598da6deeb08794e6efc9f1ddbe486df33e0c
-
SHA512
cf691e088f9852a3850ee458ef56406ead4aea539a46f8f90eb8e300bc06612a66dfa6c9dee8dcb801e7edf7fb4ed35226a5684f4164eaad073b9511189af037
-
SSDEEP
1536:0sqG3SkDNIVXnR8TeYSSkCXgN+Uu+j6XJaRqWD/0ACKNONUhfy:0sNrxWXnCjiubXKD/EQA
Malware Config
Extracted
https://erpoweredent.at/3/zte.dll
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1704 1820 rundll32.exe EXCEL.EXE -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
EXCEL.EXEdescription ioc process File opened (read-only) \??\X: EXCEL.EXE File opened (read-only) \??\B: EXCEL.EXE File opened (read-only) \??\H: EXCEL.EXE File opened (read-only) \??\N: EXCEL.EXE File opened (read-only) \??\Q: EXCEL.EXE File opened (read-only) \??\U: EXCEL.EXE File opened (read-only) \??\V: EXCEL.EXE File opened (read-only) \??\W: EXCEL.EXE File opened (read-only) \??\Z: EXCEL.EXE File opened (read-only) \??\E: EXCEL.EXE File opened (read-only) \??\L: EXCEL.EXE File opened (read-only) \??\O: EXCEL.EXE File opened (read-only) \??\A: EXCEL.EXE File opened (read-only) \??\J: EXCEL.EXE File opened (read-only) \??\T: EXCEL.EXE File opened (read-only) \??\M: EXCEL.EXE File opened (read-only) \??\P: EXCEL.EXE File opened (read-only) \??\R: EXCEL.EXE File opened (read-only) \??\S: EXCEL.EXE File opened (read-only) \??\Y: EXCEL.EXE File opened (read-only) \??\G: EXCEL.EXE File opened (read-only) \??\I: EXCEL.EXE File opened (read-only) \??\K: EXCEL.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1820 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 1820 EXCEL.EXE 1820 EXCEL.EXE 1820 EXCEL.EXE 1820 EXCEL.EXE 1820 EXCEL.EXE 1820 EXCEL.EXE 1820 EXCEL.EXE 1820 EXCEL.EXE 1820 EXCEL.EXE 1820 EXCEL.EXE 1820 EXCEL.EXE 1820 EXCEL.EXE 1820 EXCEL.EXE 1820 EXCEL.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 1820 wrote to memory of 1704 1820 EXCEL.EXE rundll32.exe PID 1820 wrote to memory of 1704 1820 EXCEL.EXE rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Banking-Malware\Zloader.xlsm"1⤵
- Enumerates connected drives
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\nxTgTGh\ECeMdPT\EnVYsVZ.dll,DllRegisterServer2⤵
- Process spawned unexpected child process
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-msFilesize
2KB
MD506af2cee6bd761b25777e228372add1b
SHA18c4684d5d3f532b8aa1dc077d82edb13319ad78f
SHA256aab41c2f639a632dcc5534407d2300b756ea588dcbb6c7bed1738488e359c5c4
SHA5122d90db706dbb4ec9b355b9ce99121e3cb8cca833a919e6f75e0c6cdb3d6f1fd1886a52ebeddfd6ff961181b12cdb38e1bd684edc90effb8f1f256d5d996426d9
-
memory/1820-14-0x00007FFC29270000-0x00007FFC29465000-memory.dmpFilesize
2.0MB
-
memory/1820-35-0x00007FFC29270000-0x00007FFC29465000-memory.dmpFilesize
2.0MB
-
memory/1820-2-0x00007FFBE92F0000-0x00007FFBE9300000-memory.dmpFilesize
64KB
-
memory/1820-4-0x00007FFBE92F0000-0x00007FFBE9300000-memory.dmpFilesize
64KB
-
memory/1820-5-0x00007FFBE92F0000-0x00007FFBE9300000-memory.dmpFilesize
64KB
-
memory/1820-6-0x00007FFC29270000-0x00007FFC29465000-memory.dmpFilesize
2.0MB
-
memory/1820-7-0x00007FFC29270000-0x00007FFC29465000-memory.dmpFilesize
2.0MB
-
memory/1820-8-0x00007FFC29270000-0x00007FFC29465000-memory.dmpFilesize
2.0MB
-
memory/1820-10-0x00007FFC29270000-0x00007FFC29465000-memory.dmpFilesize
2.0MB
-
memory/1820-11-0x00007FFC29270000-0x00007FFC29465000-memory.dmpFilesize
2.0MB
-
memory/1820-12-0x00007FFC29270000-0x00007FFC29465000-memory.dmpFilesize
2.0MB
-
memory/1820-9-0x00007FFC29270000-0x00007FFC29465000-memory.dmpFilesize
2.0MB
-
memory/1820-0-0x00007FFC2930D000-0x00007FFC2930E000-memory.dmpFilesize
4KB
-
memory/1820-3-0x00007FFBE92F0000-0x00007FFBE9300000-memory.dmpFilesize
64KB
-
memory/1820-18-0x00007FFBE69F0000-0x00007FFBE6A00000-memory.dmpFilesize
64KB
-
memory/1820-16-0x00007FFC29270000-0x00007FFC29465000-memory.dmpFilesize
2.0MB
-
memory/1820-17-0x00007FFC29270000-0x00007FFC29465000-memory.dmpFilesize
2.0MB
-
memory/1820-19-0x00007FFC29270000-0x00007FFC29465000-memory.dmpFilesize
2.0MB
-
memory/1820-15-0x00007FFC29270000-0x00007FFC29465000-memory.dmpFilesize
2.0MB
-
memory/1820-23-0x00007FFC29270000-0x00007FFC29465000-memory.dmpFilesize
2.0MB
-
memory/1820-22-0x00007FFC29270000-0x00007FFC29465000-memory.dmpFilesize
2.0MB
-
memory/1820-21-0x00007FFC29270000-0x00007FFC29465000-memory.dmpFilesize
2.0MB
-
memory/1820-20-0x00007FFC29270000-0x00007FFC29465000-memory.dmpFilesize
2.0MB
-
memory/1820-33-0x00007FFC2930D000-0x00007FFC2930E000-memory.dmpFilesize
4KB
-
memory/1820-34-0x00007FFC29270000-0x00007FFC29465000-memory.dmpFilesize
2.0MB
-
memory/1820-1-0x00007FFBE92F0000-0x00007FFBE9300000-memory.dmpFilesize
64KB
-
memory/1820-36-0x00007FFC29270000-0x00007FFC29465000-memory.dmpFilesize
2.0MB
-
memory/1820-13-0x00007FFBE69F0000-0x00007FFBE6A00000-memory.dmpFilesize
64KB