Overview
overview
10Static
static
10The-MALWAR...ot.exe
windows10-ltsc 2021-x64
10The-MALWAR...ll.exe
windows10-ltsc 2021-x64
10The-MALWAR...BS.exe
windows10-ltsc 2021-x64
10The-MALWAR...in.exe
windows10-ltsc 2021-x64
7The-MALWAR....A.exe
windows10-ltsc 2021-x64
7The-MALWAR....A.exe
windows10-ltsc 2021-x64
10The-MALWAR...us.exe
windows10-ltsc 2021-x64
6The-MALWAR....a.exe
windows10-ltsc 2021-x64
3The-MALWAR....a.exe
windows10-ltsc 2021-x64
7The-MALWAR...ok.exe
windows10-ltsc 2021-x64
1The-MALWAR...ft.exe
windows10-ltsc 2021-x64
4The-MALWAR...en.exe
windows10-ltsc 2021-x64
6The-MALWAR...ul.exe
windows10-ltsc 2021-x64
3The-MALWAR....a.exe
windows10-ltsc 2021-x64
7The-MALWAR...99.exe
windows10-ltsc 2021-x64
5The-MALWAR...ay.exe
windows10-ltsc 2021-x64
7The-MALWAR....e.exe
windows10-ltsc 2021-x64
7The-MALWAR...on.exe
windows10-ltsc 2021-x64
7The-MALWAR....d.exe
windows10-ltsc 2021-x64
7The-MALWAR...tr.exe
windows10-ltsc 2021-x64
3The-MALWAR....a.exe
windows10-ltsc 2021-x64
5The-MALWAR...ri.exe
windows10-ltsc 2021-x64
3The-MALWAR...en.exe
windows10-ltsc 2021-x64
3The-MALWAR...ur.exe
windows10-ltsc 2021-x64
5The-MALWAR...ld.exe
windows10-ltsc 2021-x64
3The-MALWAR....A.exe
windows10-ltsc 2021-x64
10The-MALWAR....a.exe
windows10-ltsc 2021-x64
3The-MALWAR...fe.exe
windows10-ltsc 2021-x64
3The-MALWAR....E.exe
windows10-ltsc 2021-x64
5The-MALWAR...hu.exe
windows10-ltsc 2021-x64
3The-MALWAR...in.exe
windows10-ltsc 2021-x64
4The-MALWAR...mo.exe
windows10-ltsc 2021-x64
6Analysis
- max time kernel
146s - max time network
166s - platform
windows10-ltsc 2021_x64 - resource
win10ltsc2021-20241211-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system - submitted
04/01/2025, 01:04
Static task
static1
Behavioral task
behavioral1
Sample
The-MALWARE-Repo-master/Banking-Malware/DanaBot.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral2
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Dridex.JhiSharp.dll.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral3
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexDroppedVBS.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral4
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexLoader.bin.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral5
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral6
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral7
Sample
The-MALWARE-Repo-master/Email-Worm/Amus.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral8
Sample
The-MALWARE-Repo-master/Email-Worm/Anap.a.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral9
Sample
The-MALWARE-Repo-master/Email-Worm/Axam.a.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral10
Sample
The-MALWARE-Repo-master/Email-Worm/Brontok.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral11
Sample
The-MALWARE-Repo-master/Email-Worm/Bugsoft.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral12
Sample
The-MALWARE-Repo-master/Email-Worm/Duksten.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral13
Sample
The-MALWARE-Repo-master/Email-Worm/Funsoul.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral14
Sample
The-MALWARE-Repo-master/Email-Worm/Gruel.a.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral15
Sample
The-MALWARE-Repo-master/Email-Worm/Happy99.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral16
Sample
The-MALWARE-Repo-master/Email-Worm/Kiray.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral17
Sample
The-MALWARE-Repo-master/Email-Worm/Klez.e.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral18
Sample
The-MALWARE-Repo-master/Email-Worm/Lacon.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral19
Sample
The-MALWARE-Repo-master/Email-Worm/Lentin/Lentin.d.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral20
Sample
The-MALWARE-Repo-master/Email-Worm/Magistr.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral21
Sample
The-MALWARE-Repo-master/Email-Worm/Maldal.a.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral22
Sample
The-MALWARE-Repo-master/Email-Worm/Mari.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral23
Sample
The-MALWARE-Repo-master/Email-Worm/MeltingScreen.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral24
Sample
The-MALWARE-Repo-master/Email-Worm/Merkur.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral25
Sample
The-MALWARE-Repo-master/Email-Worm/MsWorld.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral26
Sample
The-MALWARE-Repo-master/Email-Worm/MyDoom.A.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral27
Sample
The-MALWARE-Repo-master/Email-Worm/MyPics.a.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral28
Sample
The-MALWARE-Repo-master/Email-Worm/NakedWife.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral29
Sample
The-MALWARE-Repo-master/Email-Worm/Nyxem.E.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral30
Sample
The-MALWARE-Repo-master/Email-Worm/Pikachu.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral31
Sample
The-MALWARE-Repo-master/Email-Worm/Prolin.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral32
Sample
The-MALWARE-Repo-master/Email-Worm/Quamo.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
General
- Target The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexLoader.bin.exe
- Size 212KB
- Sample250104-bfacxavpgr
- SHA256 7b8fc6e62ef39770587a056af9709cb38f052aad5d815f808346494b7a3d00c5
- MD5 c26203af4b3e9c81a9e634178b603601
- SHA1 5e41cbc4d7a1afdf05f441086c2caf45a44bac9e
- SHA512 bb5aeb995d7b9b2b532812be0da4644db5f3d22635c37d7154ba39691f3561da574597618e7359b9a45b3bb906ec0b8b0104cbc05689455c952e995759e188b6
- SSDEEP 3072:Te8LOIa22GwayjbzJ4xgAW8NeN00w7Aoalm2HdTStgjuPaMe+H9tJA:iUOIa2sZjPJJQiw4igjAL
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1200 svchost.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language whoami.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DridexLoader.bin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe - Discovers systems in the same network 1 TTPs 1 IoCs
pid Process 1204 net.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2984 DridexLoader.bin.exe 2984 DridexLoader.bin.exe 2984 DridexLoader.bin.exe 2984 DridexLoader.bin.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe - Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeRestorePrivilege 2984 DridexLoader.bin.exe Token: SeDebugPrivilege 4228 whoami.exe Token: SeDebugPrivilege 4228 whoami.exe Token: SeDebugPrivilege 4228 whoami.exe Token: SeDebugPrivilege 4228 whoami.exe Token: SeDebugPrivilege 4228 whoami.exe Token: SeDebugPrivilege 4228 whoami.exe Token: SeDebugPrivilege 4228 whoami.exe Token: SeDebugPrivilege 4228 whoami.exe Token: SeDebugPrivilege 4228 whoami.exe Token: SeDebugPrivilege 4228 whoami.exe Token: SeDebugPrivilege 4228 whoami.exe Token: SeDebugPrivilege 4228 whoami.exe Token: SeDebugPrivilege 4228 whoami.exe Token: SeDebugPrivilege 4228 whoami.exe Token: SeDebugPrivilege 4228 whoami.exe Token: SeDebugPrivilege 4228 whoami.exe Token: SeDebugPrivilege 4228 whoami.exe Token: SeDebugPrivilege 4228 whoami.exe Token: SeDebugPrivilege 4228 whoami.exe Token: SeDebugPrivilege 4228 whoami.exe Token: SeDebugPrivilege 4228 whoami.exe Token: SeDebugPrivilege 4228 whoami.exe Token: SeDebugPrivilege 4228 whoami.exe Token: SeDebugPrivilege 4228 whoami.exe Token: SeDebugPrivilege 4228 whoami.exe Token: SeDebugPrivilege 4228 whoami.exe Token: SeDebugPrivilege 4228 whoami.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2984 wrote to memory of 1200 2984 DridexLoader.bin.exe 81 PID 2984 wrote to memory of 1200 2984 DridexLoader.bin.exe 81 PID 2984 wrote to memory of 1200 2984 DridexLoader.bin.exe 81 PID 2984 wrote to memory of 1200 2984 DridexLoader.bin.exe 81 PID 1200 wrote to memory of 4228 1200 svchost.exe 87 PID 1200 wrote to memory of 4228 1200 svchost.exe 87 PID 1200 wrote to memory of 4228 1200 svchost.exe 87 PID 1200 wrote to memory of 1204 1200 svchost.exe 89 PID 1200 wrote to memory of 1204 1200 svchost.exe 89 PID 1200 wrote to memory of 1204 1200 svchost.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Banking-Malware\Dridex\DridexLoader.bin.exe"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Banking-Malware\Dridex\DridexLoader.bin.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe "C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Banking-Malware\Dridex\DridexLoader.bin.exe"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\whoami.exeC:\Windows\system32\whoami.exe /all3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4228
-
-
C:\Windows\SysWOW64\net.exeC:\Windows\system32\net.exe view3⤵
- System Location Discovery: System Language Discovery
- Discovers systems in the same network
PID:1204
-
-