Analysis
-
max time kernel
165s -
max time network
184s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
11-05-2022 13:54
Static task
static1
Behavioral task
behavioral1
Sample
a856585c094aebd0869ba130ac9a3e5eea6768e2da1086c733abef57c5a4ec06.exe
Resource
win7-20220414-en
General
-
Target
a856585c094aebd0869ba130ac9a3e5eea6768e2da1086c733abef57c5a4ec06.exe
-
Size
2.2MB
-
MD5
73c81633573ad5f1d30f16bbace78256
-
SHA1
075c68a77646235b5e3972207fe8766a13b47f9c
-
SHA256
a856585c094aebd0869ba130ac9a3e5eea6768e2da1086c733abef57c5a4ec06
-
SHA512
0524aa6a83f67d3478ea46cf2d9f27878d1fa0377408eb045c1726c3ade60050e5d37390f8dbad8b898290b6298523681d6d63699116f40bddf1cdb0d6cffd93
Malware Config
Extracted
danabot
89.44.9.132
64.188.23.70
179.43.133.35
45.147.231.218
89.45.4.126
Signatures
-
Danabot x86 payload 6 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\A85658~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\A85658~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\A85658~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\A85658~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\A85658~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\A85658~1.DLL family_danabot -
Blocklisted process makes network request 7 IoCs
Processes:
rundll32.exeflow pid process 2 1684 rundll32.exe 3 1684 rundll32.exe 4 1684 rundll32.exe 5 1684 rundll32.exe 8 1684 rundll32.exe 11 1684 rundll32.exe 12 1684 rundll32.exe -
Loads dropped DLL 5 IoCs
Processes:
regsvr32.exerundll32.exepid process 1820 regsvr32.exe 1684 rundll32.exe 1684 rundll32.exe 1684 rundll32.exe 1684 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
a856585c094aebd0869ba130ac9a3e5eea6768e2da1086c733abef57c5a4ec06.exeregsvr32.exedescription pid process target process PID 1504 wrote to memory of 1820 1504 a856585c094aebd0869ba130ac9a3e5eea6768e2da1086c733abef57c5a4ec06.exe regsvr32.exe PID 1504 wrote to memory of 1820 1504 a856585c094aebd0869ba130ac9a3e5eea6768e2da1086c733abef57c5a4ec06.exe regsvr32.exe PID 1504 wrote to memory of 1820 1504 a856585c094aebd0869ba130ac9a3e5eea6768e2da1086c733abef57c5a4ec06.exe regsvr32.exe PID 1504 wrote to memory of 1820 1504 a856585c094aebd0869ba130ac9a3e5eea6768e2da1086c733abef57c5a4ec06.exe regsvr32.exe PID 1504 wrote to memory of 1820 1504 a856585c094aebd0869ba130ac9a3e5eea6768e2da1086c733abef57c5a4ec06.exe regsvr32.exe PID 1504 wrote to memory of 1820 1504 a856585c094aebd0869ba130ac9a3e5eea6768e2da1086c733abef57c5a4ec06.exe regsvr32.exe PID 1504 wrote to memory of 1820 1504 a856585c094aebd0869ba130ac9a3e5eea6768e2da1086c733abef57c5a4ec06.exe regsvr32.exe PID 1820 wrote to memory of 1684 1820 regsvr32.exe rundll32.exe PID 1820 wrote to memory of 1684 1820 regsvr32.exe rundll32.exe PID 1820 wrote to memory of 1684 1820 regsvr32.exe rundll32.exe PID 1820 wrote to memory of 1684 1820 regsvr32.exe rundll32.exe PID 1820 wrote to memory of 1684 1820 regsvr32.exe rundll32.exe PID 1820 wrote to memory of 1684 1820 regsvr32.exe rundll32.exe PID 1820 wrote to memory of 1684 1820 regsvr32.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a856585c094aebd0869ba130ac9a3e5eea6768e2da1086c733abef57c5a4ec06.exe"C:\Users\Admin\AppData\Local\Temp\a856585c094aebd0869ba130ac9a3e5eea6768e2da1086c733abef57c5a4ec06.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\A85658~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\A85658~1.EXE@15042⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\A85658~1.DLL,f03⤵
- Blocklisted process makes network request
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\A85658~1.DLLFilesize
2.0MB
MD507119b1790f56250fff9f87e81b96fc2
SHA1400e345b7566f4d7b8c5bd460b271864a934172d
SHA256fd9fd627f781017c2e5b375a3ac6b7f3f6e2c081d0ea093f281043d83ef04f09
SHA51226f852057938563c10c2289706b582c86622055041b47aae29a395947a1a457649b719630ec3c995d5edf4fd9a2c581ce4a52698fa3f7e1b9ce27b8728c87dfd
-
\Users\Admin\AppData\Local\Temp\A85658~1.DLLFilesize
2.0MB
MD507119b1790f56250fff9f87e81b96fc2
SHA1400e345b7566f4d7b8c5bd460b271864a934172d
SHA256fd9fd627f781017c2e5b375a3ac6b7f3f6e2c081d0ea093f281043d83ef04f09
SHA51226f852057938563c10c2289706b582c86622055041b47aae29a395947a1a457649b719630ec3c995d5edf4fd9a2c581ce4a52698fa3f7e1b9ce27b8728c87dfd
-
\Users\Admin\AppData\Local\Temp\A85658~1.DLLFilesize
2.0MB
MD507119b1790f56250fff9f87e81b96fc2
SHA1400e345b7566f4d7b8c5bd460b271864a934172d
SHA256fd9fd627f781017c2e5b375a3ac6b7f3f6e2c081d0ea093f281043d83ef04f09
SHA51226f852057938563c10c2289706b582c86622055041b47aae29a395947a1a457649b719630ec3c995d5edf4fd9a2c581ce4a52698fa3f7e1b9ce27b8728c87dfd
-
\Users\Admin\AppData\Local\Temp\A85658~1.DLLFilesize
2.0MB
MD507119b1790f56250fff9f87e81b96fc2
SHA1400e345b7566f4d7b8c5bd460b271864a934172d
SHA256fd9fd627f781017c2e5b375a3ac6b7f3f6e2c081d0ea093f281043d83ef04f09
SHA51226f852057938563c10c2289706b582c86622055041b47aae29a395947a1a457649b719630ec3c995d5edf4fd9a2c581ce4a52698fa3f7e1b9ce27b8728c87dfd
-
\Users\Admin\AppData\Local\Temp\A85658~1.DLLFilesize
2.0MB
MD507119b1790f56250fff9f87e81b96fc2
SHA1400e345b7566f4d7b8c5bd460b271864a934172d
SHA256fd9fd627f781017c2e5b375a3ac6b7f3f6e2c081d0ea093f281043d83ef04f09
SHA51226f852057938563c10c2289706b582c86622055041b47aae29a395947a1a457649b719630ec3c995d5edf4fd9a2c581ce4a52698fa3f7e1b9ce27b8728c87dfd
-
\Users\Admin\AppData\Local\Temp\A85658~1.DLLFilesize
2.0MB
MD507119b1790f56250fff9f87e81b96fc2
SHA1400e345b7566f4d7b8c5bd460b271864a934172d
SHA256fd9fd627f781017c2e5b375a3ac6b7f3f6e2c081d0ea093f281043d83ef04f09
SHA51226f852057938563c10c2289706b582c86622055041b47aae29a395947a1a457649b719630ec3c995d5edf4fd9a2c581ce4a52698fa3f7e1b9ce27b8728c87dfd
-
memory/1504-57-0x0000000000400000-0x000000000098B000-memory.dmpFilesize
5.5MB
-
memory/1504-54-0x0000000002270000-0x0000000002491000-memory.dmpFilesize
2.1MB
-
memory/1504-56-0x00000000024A0000-0x00000000026D6000-memory.dmpFilesize
2.2MB
-
memory/1504-55-0x0000000002270000-0x0000000002491000-memory.dmpFilesize
2.1MB
-
memory/1684-63-0x0000000000000000-mapping.dmp
-
memory/1684-69-0x00000000009B0000-0x0000000000BC6000-memory.dmpFilesize
2.1MB
-
memory/1820-59-0x0000000075EF1000-0x0000000075EF3000-memory.dmpFilesize
8KB
-
memory/1820-62-0x0000000000C40000-0x0000000000E56000-memory.dmpFilesize
2.1MB
-
memory/1820-58-0x0000000000000000-mapping.dmp