Analysis
-
max time kernel
136s -
max time network
145s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
12-01-2022 08:20
Static task
static1
General
-
Target
79783e2f75c717e96a5c31474604a186aae487261879c494325a2b3a1d34192c.exe
-
Size
1.1MB
-
MD5
05f6de5eee3877edd3112f421e069c4b
-
SHA1
32999efa3e0333f0bd91a0ac800dcc9fcfc706ef
-
SHA256
79783e2f75c717e96a5c31474604a186aae487261879c494325a2b3a1d34192c
-
SHA512
811657673af1a100785aa2e8372334c4c470598fc587b1f58b706164d512ec57b6490b4a3afc8e246967550eeefa91d3be6b25d275a22995a0bdfb4d03c50cb8
Malware Config
Extracted
danabot
4
209.127.27.22:443
103.175.16.114:443
103.175.16.113:443
-
embedded_hash
422236FD601D11EE82825A484D26DD6F
-
type
loader
Signatures
-
Danabot Loader Component 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\79783e2f75c717e96a5c31474604a186aae487261879c494325a2b3a1d34192c.exe.dll DanabotLoader2021 \Users\Admin\AppData\Local\Temp\79783e2f75c717e96a5c31474604a186aae487261879c494325a2b3a1d34192c.exe.dll DanabotLoader2021 -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 2852 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
79783e2f75c717e96a5c31474604a186aae487261879c494325a2b3a1d34192c.exedescription pid process target process PID 2308 wrote to memory of 2852 2308 79783e2f75c717e96a5c31474604a186aae487261879c494325a2b3a1d34192c.exe rundll32.exe PID 2308 wrote to memory of 2852 2308 79783e2f75c717e96a5c31474604a186aae487261879c494325a2b3a1d34192c.exe rundll32.exe PID 2308 wrote to memory of 2852 2308 79783e2f75c717e96a5c31474604a186aae487261879c494325a2b3a1d34192c.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\79783e2f75c717e96a5c31474604a186aae487261879c494325a2b3a1d34192c.exe"C:\Users\Admin\AppData\Local\Temp\79783e2f75c717e96a5c31474604a186aae487261879c494325a2b3a1d34192c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\79783e2f75c717e96a5c31474604a186aae487261879c494325a2b3a1d34192c.exe.dll,z C:\Users\Admin\AppData\Local\Temp\79783e2f75c717e96a5c31474604a186aae487261879c494325a2b3a1d34192c.exe2⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\79783e2f75c717e96a5c31474604a186aae487261879c494325a2b3a1d34192c.exe.dllMD5
36c7c76ffac6c1d8a478e02009294b46
SHA1de663e7ff24247e3b339cb5a416752d8fa2efc34
SHA2564d2075454107ed3602f0f259a54d6a9164f59f46f55b0cc0dd7625d94cbbd71e
SHA5122bfda464032ce49eb07dd14a363e81020168bff72ef7fc500c96a0e9ad4ddab166ce867e981d0b2b7a40f0bb0ed5a3a96ff368c0fc0d04aa17e1d96723a95fad
-
\Users\Admin\AppData\Local\Temp\79783e2f75c717e96a5c31474604a186aae487261879c494325a2b3a1d34192c.exe.dllMD5
36c7c76ffac6c1d8a478e02009294b46
SHA1de663e7ff24247e3b339cb5a416752d8fa2efc34
SHA2564d2075454107ed3602f0f259a54d6a9164f59f46f55b0cc0dd7625d94cbbd71e
SHA5122bfda464032ce49eb07dd14a363e81020168bff72ef7fc500c96a0e9ad4ddab166ce867e981d0b2b7a40f0bb0ed5a3a96ff368c0fc0d04aa17e1d96723a95fad
-
memory/2308-115-0x00000000008B3000-0x0000000000998000-memory.dmpFilesize
916KB
-
memory/2308-117-0x0000000000400000-0x000000000063F000-memory.dmpFilesize
2.2MB
-
memory/2308-116-0x00000000009A0000-0x0000000000A9C000-memory.dmpFilesize
1008KB
-
memory/2852-118-0x0000000000000000-mapping.dmp