Analysis
-
max time kernel
134s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:24
Static task
static1
Behavioral task
behavioral1
Sample
41c1de9a20f1e4083884825f4329dd95.exe
Resource
win7v20201028
General
-
Target
41c1de9a20f1e4083884825f4329dd95.exe
-
Size
2.7MB
-
MD5
41c1de9a20f1e4083884825f4329dd95
-
SHA1
551686ccbd2974579b788b44df091933e62afb7d
-
SHA256
866cc919f19b7c69e5df4f71e45d1fa6e29b432bc4ce5d91c3dcf7b850efa071
-
SHA512
75c150cfc72af2f493839711b2495079683e9d282b7f2a7f18369ec831697dc285b4a2d5acd5e063c1cadcdbc33630a314abe6a6f9e08bee0b12ec518b87d260
Malware Config
Extracted
danabot
185.227.138.47
38.68.50.140
2.56.212.64
38.68.50.172
172.241.27.92
193.34.167.159
179.43.133.50
Signatures
-
Danabot x86 payload 4 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\41C1DE~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\41C1DE~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\41C1DE~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\41C1DE~1.DLL family_danabot -
Blocklisted process makes network request 7 IoCs
Processes:
rundll32.exeflow pid process 11 3324 rundll32.exe 15 3324 rundll32.exe 16 3324 rundll32.exe 17 3324 rundll32.exe 18 3324 rundll32.exe 19 3324 rundll32.exe 20 3324 rundll32.exe -
Loads dropped DLL 3 IoCs
Processes:
regsvr32.exerundll32.exepid process 2816 regsvr32.exe 3324 rundll32.exe 3324 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
41c1de9a20f1e4083884825f4329dd95.exeregsvr32.exedescription pid process target process PID 4764 wrote to memory of 2816 4764 41c1de9a20f1e4083884825f4329dd95.exe regsvr32.exe PID 4764 wrote to memory of 2816 4764 41c1de9a20f1e4083884825f4329dd95.exe regsvr32.exe PID 4764 wrote to memory of 2816 4764 41c1de9a20f1e4083884825f4329dd95.exe regsvr32.exe PID 2816 wrote to memory of 3324 2816 regsvr32.exe rundll32.exe PID 2816 wrote to memory of 3324 2816 regsvr32.exe rundll32.exe PID 2816 wrote to memory of 3324 2816 regsvr32.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\41c1de9a20f1e4083884825f4329dd95.exe"C:\Users\Admin\AppData\Local\Temp\41c1de9a20f1e4083884825f4329dd95.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\41C1DE~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\41C1DE~1.EXE@47642⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\41C1DE~1.DLL,f03⤵
- Blocklisted process makes network request
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\41C1DE~1.DLLMD5
1d17df48bdb289adca9c3e77f8f74417
SHA19f4abbe075a08211e7b374292bc07190b3f74999
SHA2564f9b6310c363bc29667d6624f373a78762061fe952494a242454be6550c374da
SHA51281015c6c4453b8f29a372136a8a1b7027b461421fe6b23d1a37a4c32457bca73884fd4d90584839495796a7bf4b6ac633de39dab44d3d2cd026332e9e66fbfe2
-
\Users\Admin\AppData\Local\Temp\41C1DE~1.DLLMD5
1d17df48bdb289adca9c3e77f8f74417
SHA19f4abbe075a08211e7b374292bc07190b3f74999
SHA2564f9b6310c363bc29667d6624f373a78762061fe952494a242454be6550c374da
SHA51281015c6c4453b8f29a372136a8a1b7027b461421fe6b23d1a37a4c32457bca73884fd4d90584839495796a7bf4b6ac633de39dab44d3d2cd026332e9e66fbfe2
-
\Users\Admin\AppData\Local\Temp\41C1DE~1.DLLMD5
1d17df48bdb289adca9c3e77f8f74417
SHA19f4abbe075a08211e7b374292bc07190b3f74999
SHA2564f9b6310c363bc29667d6624f373a78762061fe952494a242454be6550c374da
SHA51281015c6c4453b8f29a372136a8a1b7027b461421fe6b23d1a37a4c32457bca73884fd4d90584839495796a7bf4b6ac633de39dab44d3d2cd026332e9e66fbfe2
-
\Users\Admin\AppData\Local\Temp\41C1DE~1.DLLMD5
1d17df48bdb289adca9c3e77f8f74417
SHA19f4abbe075a08211e7b374292bc07190b3f74999
SHA2564f9b6310c363bc29667d6624f373a78762061fe952494a242454be6550c374da
SHA51281015c6c4453b8f29a372136a8a1b7027b461421fe6b23d1a37a4c32457bca73884fd4d90584839495796a7bf4b6ac633de39dab44d3d2cd026332e9e66fbfe2
-
memory/2816-2-0x0000000000000000-mapping.dmp
-
memory/3324-5-0x0000000000000000-mapping.dmp
-
memory/4764-1-0x0000000002730000-0x0000000002731000-memory.dmpFilesize
4KB