Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
24-10-2021 06:27
Static task
static1
Behavioral task
behavioral1
Sample
sdd.dll
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
General
-
Target
sdd.dll
-
Size
2.5MB
-
MD5
de8b54a938ac18f15cad804d79a0e19d
-
SHA1
b6004c62e2d9dbad9cfd5f7e18647ac983788766
-
SHA256
2a3acdcd76575762b18c18c644a745125f55ce121f742d2aad962521bc7f25fd
-
SHA512
7b64a99baafc8e692a47b9856f96b6bafa3cae22bd293c0e8faf148bdfe3f1401d5c316017b5c2f778d02ebc87edd2474e525b225ddc00685bb14da4c484e776
Malware Config
Extracted
Family
danabot
C2
185.158.250.216:443
194.76.225.46:443
45.11.180.153:443
194.76.225.61:443
Attributes
-
embedded_hash
AD14EA44261341E3690FA8CC1E236523
-
type
loader
rsa_pubkey.plain
rsa_privkey.plain
Signatures
-
Danabot Loader Component 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1340-58-0x0000000074D80000-0x0000000074EE3000-memory.dmp DanabotLoader2021 behavioral1/memory/1340-59-0x0000000074D80000-0x000000007500E000-memory.dmp DanabotLoader2021 -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 2 1340 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1664 wrote to memory of 1340 1664 rundll32.exe rundll32.exe PID 1664 wrote to memory of 1340 1664 rundll32.exe rundll32.exe PID 1664 wrote to memory of 1340 1664 rundll32.exe rundll32.exe PID 1664 wrote to memory of 1340 1664 rundll32.exe rundll32.exe PID 1664 wrote to memory of 1340 1664 rundll32.exe rundll32.exe PID 1664 wrote to memory of 1340 1664 rundll32.exe rundll32.exe PID 1664 wrote to memory of 1340 1664 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\sdd.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\sdd.dll,#12⤵
- Blocklisted process makes network request
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1340-55-0x0000000000000000-mapping.dmp
-
memory/1340-56-0x0000000075D31000-0x0000000075D33000-memory.dmpFilesize
8KB
-
memory/1340-57-0x0000000074D80000-0x000000007500E000-memory.dmpFilesize
2.6MB
-
memory/1340-58-0x0000000074D80000-0x0000000074EE3000-memory.dmpFilesize
1.4MB
-
memory/1340-59-0x0000000074D80000-0x000000007500E000-memory.dmpFilesize
2.6MB
-
memory/1340-61-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB