General
-
Target
57e9894749242755d8b3620e1ae3a6137f63ebdc1b951cd0fe197a97d13dde05
-
Size
14.9MB
-
Sample
220111-szqyfagba2
-
MD5
cbac8f0600345f5fdc38a4c9f41e21f3
-
SHA1
606f627a922e4a22cc139474866559dabea1f0d5
-
SHA256
57e9894749242755d8b3620e1ae3a6137f63ebdc1b951cd0fe197a97d13dde05
-
SHA512
54a7dcf07f2cc56bb6c0c69472a5d24cc3338650b93af959261f8b878ef9729ab2dbdebf654506271ab0d2d3dc88742e9039b97a607d4060702d17b978f7b109
Behavioral task
behavioral1
Sample
57e9894749242755d8b3620e1ae3a6137f63ebdc1b951cd0fe197a97d13dde05.dll
Resource
win7-en-20211208
Malware Config
Extracted
danabot
2108
4
192.119.110.4:443
103.175.16.113:443
-
embedded_hash
422236FD601D11EE82825A484D26DD6F
-
type
main
Targets
-
-
Target
57e9894749242755d8b3620e1ae3a6137f63ebdc1b951cd0fe197a97d13dde05
-
Size
14.9MB
-
MD5
cbac8f0600345f5fdc38a4c9f41e21f3
-
SHA1
606f627a922e4a22cc139474866559dabea1f0d5
-
SHA256
57e9894749242755d8b3620e1ae3a6137f63ebdc1b951cd0fe197a97d13dde05
-
SHA512
54a7dcf07f2cc56bb6c0c69472a5d24cc3338650b93af959261f8b878ef9729ab2dbdebf654506271ab0d2d3dc88742e9039b97a607d4060702d17b978f7b109
-
Blocklisted process makes network request
-
Sets DLL path for service in the registry
-
Sets service image path in registry
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-