Analysis
-
max time kernel
148s -
max time network
138s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
06-01-2022 04:50
Static task
static1
General
-
Target
e23a34dd54d502d5dc84ac2c7058f286f43d8c8e88d0b2f92dbf4c11bae17674.exe
-
Size
1.8MB
-
MD5
5107c126d077612e44bea786bc084e6a
-
SHA1
3a4e070a414db63989fa94461fe4c681edfdcf11
-
SHA256
e23a34dd54d502d5dc84ac2c7058f286f43d8c8e88d0b2f92dbf4c11bae17674
-
SHA512
75237473e86e64fbb39f4946d54eaa4ba600d84426235045e45349cb6396663963448cb1aa2ace75cab2cb830013c8972b7d59bdba8bddf3dfcf7c6cc98477e7
Malware Config
Extracted
danabot
4
142.11.244.223:443
192.236.194.72:443
-
embedded_hash
0FA95F120D6EB149A5D48E36BC76879D
-
type
loader
Signatures
-
Danabot Loader Component 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\E23A34~1.DLL DanabotLoader2021 \Users\Admin\AppData\Local\Temp\E23A34~1.DLL DanabotLoader2021 -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 660 created 3880 660 WerFault.exe e23a34dd54d502d5dc84ac2c7058f286f43d8c8e88d0b2f92dbf4c11bae17674.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4364 rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 660 3880 WerFault.exe e23a34dd54d502d5dc84ac2c7058f286f43d8c8e88d0b2f92dbf4c11bae17674.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
WerFault.exepid process 660 WerFault.exe 660 WerFault.exe 660 WerFault.exe 660 WerFault.exe 660 WerFault.exe 660 WerFault.exe 660 WerFault.exe 660 WerFault.exe 660 WerFault.exe 660 WerFault.exe 660 WerFault.exe 660 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 660 WerFault.exe Token: SeBackupPrivilege 660 WerFault.exe Token: SeDebugPrivilege 660 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
e23a34dd54d502d5dc84ac2c7058f286f43d8c8e88d0b2f92dbf4c11bae17674.exedescription pid process target process PID 3880 wrote to memory of 4364 3880 e23a34dd54d502d5dc84ac2c7058f286f43d8c8e88d0b2f92dbf4c11bae17674.exe rundll32.exe PID 3880 wrote to memory of 4364 3880 e23a34dd54d502d5dc84ac2c7058f286f43d8c8e88d0b2f92dbf4c11bae17674.exe rundll32.exe PID 3880 wrote to memory of 4364 3880 e23a34dd54d502d5dc84ac2c7058f286f43d8c8e88d0b2f92dbf4c11bae17674.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e23a34dd54d502d5dc84ac2c7058f286f43d8c8e88d0b2f92dbf4c11bae17674.exe"C:\Users\Admin\AppData\Local\Temp\e23a34dd54d502d5dc84ac2c7058f286f43d8c8e88d0b2f92dbf4c11bae17674.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\E23A34~1.DLL,s C:\Users\Admin\AppData\Local\Temp\E23A34~1.EXE2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 5522⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\E23A34~1.DLLMD5
74cc7fadd0c1838ef3cbf29884246eb6
SHA1adeeffa5cc58b4ac4633d6c0ed114db2e406bcf9
SHA2560a312ec9977a055d8bc92f7912c96c23ad5bc999f960451342a1a4ee379d54a5
SHA512b597f2701549a79459fd2bc37aae9cb3eecc34f7430098b9c83b4362ef3d06a981687b64b1217465f6d375f2d9a106dad5b7abc919dc95364e3f4d62a4f554fe
-
\Users\Admin\AppData\Local\Temp\E23A34~1.DLLMD5
74cc7fadd0c1838ef3cbf29884246eb6
SHA1adeeffa5cc58b4ac4633d6c0ed114db2e406bcf9
SHA2560a312ec9977a055d8bc92f7912c96c23ad5bc999f960451342a1a4ee379d54a5
SHA512b597f2701549a79459fd2bc37aae9cb3eecc34f7430098b9c83b4362ef3d06a981687b64b1217465f6d375f2d9a106dad5b7abc919dc95364e3f4d62a4f554fe
-
memory/3880-115-0x0000000000ADC000-0x0000000000C6C000-memory.dmpFilesize
1.6MB
-
memory/3880-116-0x0000000000C70000-0x0000000000E16000-memory.dmpFilesize
1.6MB
-
memory/3880-117-0x0000000000400000-0x00000000005E3000-memory.dmpFilesize
1.9MB
-
memory/4364-118-0x0000000000000000-mapping.dmp