Analysis
-
max time kernel
294s -
max time network
97s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-05-2022 13:27
Static task
static1
Behavioral task
behavioral1
Sample
341d69cf4f5d9be493ebe9913f4150cf.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
341d69cf4f5d9be493ebe9913f4150cf.exe
-
Size
1.1MB
-
MD5
341d69cf4f5d9be493ebe9913f4150cf
-
SHA1
b043c610bf6b1fea68701910870d439501d8f832
-
SHA256
ea315e9e65af9d1d95ac0636abde389107bb131f99e9eeac2dd16821be1ba888
-
SHA512
50534e155760d2dde64e0737f90b63d35c1b0e3136007476d9e62b8eaf0bfb42225a57dc340c12e45a7346cdf56a857e403b4230d561b32991f1155f4d8294ab
Malware Config
Extracted
Family
danabot
Attributes
-
type
loader
Extracted
Family
danabot
Botnet
7
C2
192.236.176.108:443
23.254.209.218:443
Attributes
-
embedded_hash
F05AD7842A54466C7E7FBCE36DCCAB8C
-
type
loader
Signatures
-
Blocklisted process makes network request 5 IoCs
flow pid Process 2 1688 rundll32.exe 4 1688 rundll32.exe 6 1688 rundll32.exe 7 1688 rundll32.exe 8 1688 rundll32.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27 PID 1884 wrote to memory of 1688 1884 341d69cf4f5d9be493ebe9913f4150cf.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\341d69cf4f5d9be493ebe9913f4150cf.exe"C:\Users\Admin\AppData\Local\Temp\341d69cf4f5d9be493ebe9913f4150cf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\syswow64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
PID:1688
-