General
-
Target
7a9ccd371d5fb68f1ab44f1082866eb6.exe
-
Size
2.6MB
-
Sample
200624-t5pz767qwj
-
MD5
7a9ccd371d5fb68f1ab44f1082866eb6
-
SHA1
dbaa4a48013bb069b07158c44cd6d63f3baace07
-
SHA256
a2e04f470118a346babd55225d373f935ace92670668cc50538e668a5be144ec
-
SHA512
f59237816e95236d38987de207bef174743faa7f35b448e026d36749a6f7abc3d515e464e8f90f7771dba7066c2db26f87621c679df03d0d8ccb8b8128a9a0a7
Static task
static1
Behavioral task
behavioral1
Sample
7a9ccd371d5fb68f1ab44f1082866eb6.exe
Resource
win7
Malware Config
Extracted
danabot
92.204.160.126
193.34.166.26
93.115.22.159
93.115.22.165
185.227.138.52
37.120.145.243
195.133.147.230
Targets
-
-
Target
7a9ccd371d5fb68f1ab44f1082866eb6.exe
-
Size
2.6MB
-
MD5
7a9ccd371d5fb68f1ab44f1082866eb6
-
SHA1
dbaa4a48013bb069b07158c44cd6d63f3baace07
-
SHA256
a2e04f470118a346babd55225d373f935ace92670668cc50538e668a5be144ec
-
SHA512
f59237816e95236d38987de207bef174743faa7f35b448e026d36749a6f7abc3d515e464e8f90f7771dba7066c2db26f87621c679df03d0d8ccb8b8128a9a0a7
-
Danabot x86 payload
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Sets DLL path for service in the registry
-
Sets service image path in registry
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-