Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
10-01-2022 07:58
Static task
static1
Behavioral task
behavioral1
Sample
3b2e2b369895d2fd94a07ef3c66978c5.exe
Resource
win7-en-20211208
General
-
Target
3b2e2b369895d2fd94a07ef3c66978c5.exe
-
Size
1.1MB
-
MD5
3b2e2b369895d2fd94a07ef3c66978c5
-
SHA1
91a09480fad625eae27f4df3e6de3e7e2cfec949
-
SHA256
220952caf42db06de1b1b80c1f95884419ebd90a667a07fa8da6792db1404316
-
SHA512
1be44c64c59b7c7c1236e30aa88c989263f763511615022c0f4e5ff8e898a8e6a9a19dcd5ac5311af3b9438983b09ee301496ba78df774de154b410209104734
Malware Config
Extracted
danabot
4
192.119.110.4:443
103.175.16.113:443
-
embedded_hash
422236FD601D11EE82825A484D26DD6F
-
type
loader
Signatures
-
Danabot Loader Component 6 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\3b2e2b369895d2fd94a07ef3c66978c5.exe.dll DanabotLoader2021 C:\Users\Admin\AppData\Local\Temp\3b2e2b369895d2fd94a07ef3c66978c5.exe.dll DanabotLoader2021 \Users\Admin\AppData\Local\Temp\3b2e2b369895d2fd94a07ef3c66978c5.exe.dll DanabotLoader2021 \Users\Admin\AppData\Local\Temp\3b2e2b369895d2fd94a07ef3c66978c5.exe.dll DanabotLoader2021 \Users\Admin\AppData\Local\Temp\3b2e2b369895d2fd94a07ef3c66978c5.exe.dll DanabotLoader2021 behavioral1/memory/1288-64-0x0000000000790000-0x00000000008DE000-memory.dmp DanabotLoader2021 -
Loads dropped DLL 4 IoCs
Processes:
rundll32.exepid process 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
3b2e2b369895d2fd94a07ef3c66978c5.exedescription pid process target process PID 1688 wrote to memory of 1288 1688 3b2e2b369895d2fd94a07ef3c66978c5.exe rundll32.exe PID 1688 wrote to memory of 1288 1688 3b2e2b369895d2fd94a07ef3c66978c5.exe rundll32.exe PID 1688 wrote to memory of 1288 1688 3b2e2b369895d2fd94a07ef3c66978c5.exe rundll32.exe PID 1688 wrote to memory of 1288 1688 3b2e2b369895d2fd94a07ef3c66978c5.exe rundll32.exe PID 1688 wrote to memory of 1288 1688 3b2e2b369895d2fd94a07ef3c66978c5.exe rundll32.exe PID 1688 wrote to memory of 1288 1688 3b2e2b369895d2fd94a07ef3c66978c5.exe rundll32.exe PID 1688 wrote to memory of 1288 1688 3b2e2b369895d2fd94a07ef3c66978c5.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b2e2b369895d2fd94a07ef3c66978c5.exe"C:\Users\Admin\AppData\Local\Temp\3b2e2b369895d2fd94a07ef3c66978c5.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b2e2b369895d2fd94a07ef3c66978c5.exe.dll,z C:\Users\Admin\AppData\Local\Temp\3b2e2b369895d2fd94a07ef3c66978c5.exe2⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3b2e2b369895d2fd94a07ef3c66978c5.exe.dllMD5
86bb9440a483e122e40cba72f6790ac1
SHA1f9f87936259c4439e97fb07eac5c0e18915d0d7f
SHA256d461c7b2b7659541facb628577479a7e117e8a4d191b6e778615de9418ae871c
SHA512d6e56a721babea9ef63036e441158de025be20f3ce5ab69b6a7915a8012a072f882a266ff4566e30002a41ba7b6bc41ba7ee91ba0a21d5f7c5d6041afbeceb27
-
\Users\Admin\AppData\Local\Temp\3b2e2b369895d2fd94a07ef3c66978c5.exe.dllMD5
86bb9440a483e122e40cba72f6790ac1
SHA1f9f87936259c4439e97fb07eac5c0e18915d0d7f
SHA256d461c7b2b7659541facb628577479a7e117e8a4d191b6e778615de9418ae871c
SHA512d6e56a721babea9ef63036e441158de025be20f3ce5ab69b6a7915a8012a072f882a266ff4566e30002a41ba7b6bc41ba7ee91ba0a21d5f7c5d6041afbeceb27
-
\Users\Admin\AppData\Local\Temp\3b2e2b369895d2fd94a07ef3c66978c5.exe.dllMD5
86bb9440a483e122e40cba72f6790ac1
SHA1f9f87936259c4439e97fb07eac5c0e18915d0d7f
SHA256d461c7b2b7659541facb628577479a7e117e8a4d191b6e778615de9418ae871c
SHA512d6e56a721babea9ef63036e441158de025be20f3ce5ab69b6a7915a8012a072f882a266ff4566e30002a41ba7b6bc41ba7ee91ba0a21d5f7c5d6041afbeceb27
-
\Users\Admin\AppData\Local\Temp\3b2e2b369895d2fd94a07ef3c66978c5.exe.dllMD5
86bb9440a483e122e40cba72f6790ac1
SHA1f9f87936259c4439e97fb07eac5c0e18915d0d7f
SHA256d461c7b2b7659541facb628577479a7e117e8a4d191b6e778615de9418ae871c
SHA512d6e56a721babea9ef63036e441158de025be20f3ce5ab69b6a7915a8012a072f882a266ff4566e30002a41ba7b6bc41ba7ee91ba0a21d5f7c5d6041afbeceb27
-
\Users\Admin\AppData\Local\Temp\3b2e2b369895d2fd94a07ef3c66978c5.exe.dllMD5
86bb9440a483e122e40cba72f6790ac1
SHA1f9f87936259c4439e97fb07eac5c0e18915d0d7f
SHA256d461c7b2b7659541facb628577479a7e117e8a4d191b6e778615de9418ae871c
SHA512d6e56a721babea9ef63036e441158de025be20f3ce5ab69b6a7915a8012a072f882a266ff4566e30002a41ba7b6bc41ba7ee91ba0a21d5f7c5d6041afbeceb27
-
memory/1288-57-0x0000000000000000-mapping.dmp
-
memory/1288-64-0x0000000000790000-0x00000000008DE000-memory.dmpFilesize
1.3MB
-
memory/1688-54-0x00000000045D0000-0x00000000046CA000-memory.dmpFilesize
1000KB
-
memory/1688-53-0x00000000044E0000-0x00000000045C3000-memory.dmpFilesize
908KB
-
memory/1688-55-0x0000000075AB1000-0x0000000075AB3000-memory.dmpFilesize
8KB
-
memory/1688-56-0x0000000000400000-0x0000000002C59000-memory.dmpFilesize
40.3MB