Analysis
-
max time kernel
168s -
max time network
184s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
16-06-2022 02:42
Static task
static1
Behavioral task
behavioral1
Sample
27fa51e57d4513601e36b0dc90332c86de7d31579db13c8b75f0152ab5fcaa2d.exe
Resource
win7-20220414-en
General
-
Target
27fa51e57d4513601e36b0dc90332c86de7d31579db13c8b75f0152ab5fcaa2d.exe
-
Size
667KB
-
MD5
65e534d2434340f6c491dafbf6517d6c
-
SHA1
e4807e55870dedc767eae94ba435eaf0a69bd489
-
SHA256
27fa51e57d4513601e36b0dc90332c86de7d31579db13c8b75f0152ab5fcaa2d
-
SHA512
ed4d2404cdd32bd3b746668a9790370972bf40c0cad5b3bb0ad34989c30e88bfeddf031afff004ef766dbe74a80da7f1d87b9cf70e1e5ae31186300411f825af
Malware Config
Extracted
danabot
5.61.56.192
5.61.58.130
2.56.212.4
32.99.84.84
152.195.32.21
49.126.36.10
93.165.23.189
22.55.172.123
113.104.135.195
2.56.213.39
Signatures
-
Danabot x86 payload 6 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\27FA51~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\27FA51~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\27FA51~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\27FA51~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\27FA51~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\27FA51~1.DLL family_danabot -
Blocklisted process makes network request 8 IoCs
Processes:
rundll32.exeflow pid process 1 1980 rundll32.exe 3 1980 rundll32.exe 4 1980 rundll32.exe 7 1980 rundll32.exe 10 1980 rundll32.exe 11 1980 rundll32.exe 12 1980 rundll32.exe 15 1980 rundll32.exe -
Loads dropped DLL 5 IoCs
Processes:
regsvr32.exerundll32.exepid process 2012 regsvr32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
27fa51e57d4513601e36b0dc90332c86de7d31579db13c8b75f0152ab5fcaa2d.exeregsvr32.exedescription pid process target process PID 872 wrote to memory of 2012 872 27fa51e57d4513601e36b0dc90332c86de7d31579db13c8b75f0152ab5fcaa2d.exe regsvr32.exe PID 872 wrote to memory of 2012 872 27fa51e57d4513601e36b0dc90332c86de7d31579db13c8b75f0152ab5fcaa2d.exe regsvr32.exe PID 872 wrote to memory of 2012 872 27fa51e57d4513601e36b0dc90332c86de7d31579db13c8b75f0152ab5fcaa2d.exe regsvr32.exe PID 872 wrote to memory of 2012 872 27fa51e57d4513601e36b0dc90332c86de7d31579db13c8b75f0152ab5fcaa2d.exe regsvr32.exe PID 872 wrote to memory of 2012 872 27fa51e57d4513601e36b0dc90332c86de7d31579db13c8b75f0152ab5fcaa2d.exe regsvr32.exe PID 872 wrote to memory of 2012 872 27fa51e57d4513601e36b0dc90332c86de7d31579db13c8b75f0152ab5fcaa2d.exe regsvr32.exe PID 872 wrote to memory of 2012 872 27fa51e57d4513601e36b0dc90332c86de7d31579db13c8b75f0152ab5fcaa2d.exe regsvr32.exe PID 2012 wrote to memory of 1980 2012 regsvr32.exe rundll32.exe PID 2012 wrote to memory of 1980 2012 regsvr32.exe rundll32.exe PID 2012 wrote to memory of 1980 2012 regsvr32.exe rundll32.exe PID 2012 wrote to memory of 1980 2012 regsvr32.exe rundll32.exe PID 2012 wrote to memory of 1980 2012 regsvr32.exe rundll32.exe PID 2012 wrote to memory of 1980 2012 regsvr32.exe rundll32.exe PID 2012 wrote to memory of 1980 2012 regsvr32.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\27fa51e57d4513601e36b0dc90332c86de7d31579db13c8b75f0152ab5fcaa2d.exe"C:\Users\Admin\AppData\Local\Temp\27fa51e57d4513601e36b0dc90332c86de7d31579db13c8b75f0152ab5fcaa2d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\27FA51~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\27FA51~1.EXE@8722⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\27FA51~1.DLL,f03⤵
- Blocklisted process makes network request
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\27FA51~1.DLLFilesize
354KB
MD5618b97f914f4f10f1d635c7c1898a518
SHA15e0737fdc93ab90b154e0d815c3185416893c384
SHA25622e4fd5e6c28c05932e6d487da8bacfedf7a89e7f90e192dd87852aa3929c641
SHA512d426f6e0b09b212a69b217b8435ea97be63eb0fd948a91bc709521964e898e869a7446a867cbf3a0226fef6f6ae0159b92eff5960625b89ea80a98268e6ede40
-
\Users\Admin\AppData\Local\Temp\27FA51~1.DLLFilesize
354KB
MD5618b97f914f4f10f1d635c7c1898a518
SHA15e0737fdc93ab90b154e0d815c3185416893c384
SHA25622e4fd5e6c28c05932e6d487da8bacfedf7a89e7f90e192dd87852aa3929c641
SHA512d426f6e0b09b212a69b217b8435ea97be63eb0fd948a91bc709521964e898e869a7446a867cbf3a0226fef6f6ae0159b92eff5960625b89ea80a98268e6ede40
-
\Users\Admin\AppData\Local\Temp\27FA51~1.DLLFilesize
354KB
MD5618b97f914f4f10f1d635c7c1898a518
SHA15e0737fdc93ab90b154e0d815c3185416893c384
SHA25622e4fd5e6c28c05932e6d487da8bacfedf7a89e7f90e192dd87852aa3929c641
SHA512d426f6e0b09b212a69b217b8435ea97be63eb0fd948a91bc709521964e898e869a7446a867cbf3a0226fef6f6ae0159b92eff5960625b89ea80a98268e6ede40
-
\Users\Admin\AppData\Local\Temp\27FA51~1.DLLFilesize
354KB
MD5618b97f914f4f10f1d635c7c1898a518
SHA15e0737fdc93ab90b154e0d815c3185416893c384
SHA25622e4fd5e6c28c05932e6d487da8bacfedf7a89e7f90e192dd87852aa3929c641
SHA512d426f6e0b09b212a69b217b8435ea97be63eb0fd948a91bc709521964e898e869a7446a867cbf3a0226fef6f6ae0159b92eff5960625b89ea80a98268e6ede40
-
\Users\Admin\AppData\Local\Temp\27FA51~1.DLLFilesize
354KB
MD5618b97f914f4f10f1d635c7c1898a518
SHA15e0737fdc93ab90b154e0d815c3185416893c384
SHA25622e4fd5e6c28c05932e6d487da8bacfedf7a89e7f90e192dd87852aa3929c641
SHA512d426f6e0b09b212a69b217b8435ea97be63eb0fd948a91bc709521964e898e869a7446a867cbf3a0226fef6f6ae0159b92eff5960625b89ea80a98268e6ede40
-
\Users\Admin\AppData\Local\Temp\27FA51~1.DLLFilesize
354KB
MD5618b97f914f4f10f1d635c7c1898a518
SHA15e0737fdc93ab90b154e0d815c3185416893c384
SHA25622e4fd5e6c28c05932e6d487da8bacfedf7a89e7f90e192dd87852aa3929c641
SHA512d426f6e0b09b212a69b217b8435ea97be63eb0fd948a91bc709521964e898e869a7446a867cbf3a0226fef6f6ae0159b92eff5960625b89ea80a98268e6ede40
-
memory/872-55-0x0000000000230000-0x00000000002B4000-memory.dmpFilesize
528KB
-
memory/872-56-0x0000000000400000-0x0000000000557000-memory.dmpFilesize
1.3MB
-
memory/872-58-0x000000000073B000-0x00000000007AA000-memory.dmpFilesize
444KB
-
memory/872-59-0x0000000000400000-0x0000000000557000-memory.dmpFilesize
1.3MB
-
memory/872-54-0x000000000073B000-0x00000000007AA000-memory.dmpFilesize
444KB
-
memory/1980-64-0x0000000000000000-mapping.dmp
-
memory/2012-60-0x00000000763E1000-0x00000000763E3000-memory.dmpFilesize
8KB
-
memory/2012-63-0x0000000000170000-0x00000000001D6000-memory.dmpFilesize
408KB
-
memory/2012-57-0x0000000000000000-mapping.dmp