Analysis
-
max time kernel
107s -
max time network
123s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
25-11-2021 16:26
Static task
static1
General
-
Target
f37ed3859c32357cecb9dc74905a1c402a29dbc8d2d2b53472b168ca26ab7814.dll
-
Size
1.9MB
-
MD5
fe87670bcb604ce78273292793f50129
-
SHA1
2e4d5d16ca026995c0862c755ad93d54488f695d
-
SHA256
f37ed3859c32357cecb9dc74905a1c402a29dbc8d2d2b53472b168ca26ab7814
-
SHA512
12cee37c4b40eacdba313680284108cb4a6ed030f86e9afb32d17283d1d23b1440127729dcf3ffc5160f26020f3d1da7abacfabe768d4f5f94598a95a276433e
Malware Config
Extracted
Family
danabot
C2
185.117.90.36:443
193.42.36.59:443
193.56.146.53:443
185.106.123.228:443
Attributes
-
embedded_hash
07284E2A3AB3C2E1FFFBD425849BE150
-
type
loader
rsa_pubkey.plain
rsa_privkey.plain
Signatures
-
Danabot Loader Component 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3816-117-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral1/memory/3816-118-0x0000000000400000-0x00000000005F4000-memory.dmp DanabotLoader2021 -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 21 3816 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3056 wrote to memory of 3816 3056 rundll32.exe rundll32.exe PID 3056 wrote to memory of 3816 3056 rundll32.exe rundll32.exe PID 3056 wrote to memory of 3816 3056 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f37ed3859c32357cecb9dc74905a1c402a29dbc8d2d2b53472b168ca26ab7814.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f37ed3859c32357cecb9dc74905a1c402a29dbc8d2d2b53472b168ca26ab7814.dll,#12⤵
- Blocklisted process makes network request
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3816-115-0x0000000000000000-mapping.dmp
-
memory/3816-116-0x0000000000400000-0x00000000005F4000-memory.dmpFilesize
2.0MB
-
memory/3816-117-0x0000000000400000-0x0000000000560000-memory.dmpFilesize
1.4MB
-
memory/3816-118-0x0000000000400000-0x00000000005F4000-memory.dmpFilesize
2.0MB
-
memory/3816-120-0x00000000031D0000-0x00000000031D1000-memory.dmpFilesize
4KB