Resubmissions
17-06-2022 20:32
220617-zbrndsdcbm 1021-04-2022 11:13
220421-nbs1nsafcm 804-03-2022 09:30
220304-lgv14sebh5 303-03-2022 14:25
220303-rrg5wsdbej 10Analysis
-
max time kernel
136s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
17-06-2022 20:32
Static task
static1
Behavioral task
behavioral1
Sample
7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe
Resource
win7-20220414-en
General
-
Target
7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe
-
Size
2.3MB
-
MD5
daaefbd8d541235a00593af2bb5a3e27
-
SHA1
428bb7e395f87070d55ef7fa08fe8296d640c20f
-
SHA256
7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513
-
SHA512
ed59e719c3de251c456e1a5e8805bdae302440b03e31959ec16088f0a6a725d1f374d6fa6a7b61ecd0f83e7da4e818ea83d32d48374981b94e3071c1c0a10669
Malware Config
Extracted
danabot
5
23.106.122.14:443
5.9.224.217:443
192.236.161.4:443
-
embedded_hash
93390DEC2D9EB6E43445264DBEDDE13F
-
type
loader
Signatures
-
Blocklisted process makes network request 7 IoCs
Processes:
rundll32.exeflow pid process 5 5008 rundll32.exe 18 5008 rundll32.exe 27 5008 rundll32.exe 35 5008 rundll32.exe 38 5008 rundll32.exe 39 5008 rundll32.exe 41 5008 rundll32.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exedescription pid process target process PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe PID 4676 wrote to memory of 5008 4676 7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe"C:\Users\Admin\AppData\Local\Temp\7ea65c1cb2687be42f427571e3223e425d602d043c39f690d0c3c42309aff513.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4676-130-0x0000000000400000-0x0000000000655000-memory.dmpFilesize
2.3MB
-
memory/4676-149-0x0000000000400000-0x0000000000655000-memory.dmpFilesize
2.3MB
-
memory/5008-140-0x0000000000330000-0x0000000000333000-memory.dmpFilesize
12KB
-
memory/5008-141-0x0000000000340000-0x0000000000343000-memory.dmpFilesize
12KB
-
memory/5008-134-0x00000000002D0000-0x00000000002D3000-memory.dmpFilesize
12KB
-
memory/5008-135-0x00000000002E0000-0x00000000002E3000-memory.dmpFilesize
12KB
-
memory/5008-136-0x00000000002F0000-0x00000000002F3000-memory.dmpFilesize
12KB
-
memory/5008-137-0x0000000000300000-0x0000000000303000-memory.dmpFilesize
12KB
-
memory/5008-138-0x0000000000310000-0x0000000000313000-memory.dmpFilesize
12KB
-
memory/5008-139-0x0000000000320000-0x0000000000323000-memory.dmpFilesize
12KB
-
memory/5008-132-0x00000000002B0000-0x00000000002B3000-memory.dmpFilesize
12KB
-
memory/5008-133-0x00000000002C0000-0x00000000002C3000-memory.dmpFilesize
12KB
-
memory/5008-142-0x0000000000350000-0x0000000000353000-memory.dmpFilesize
12KB
-
memory/5008-143-0x0000000000360000-0x0000000000363000-memory.dmpFilesize
12KB
-
memory/5008-144-0x0000000000370000-0x0000000000373000-memory.dmpFilesize
12KB
-
memory/5008-146-0x0000000000390000-0x0000000000393000-memory.dmpFilesize
12KB
-
memory/5008-147-0x00000000003A0000-0x00000000003A3000-memory.dmpFilesize
12KB
-
memory/5008-145-0x0000000000380000-0x0000000000383000-memory.dmpFilesize
12KB
-
memory/5008-148-0x00000000003B0000-0x00000000003B3000-memory.dmpFilesize
12KB
-
memory/5008-131-0x0000000000000000-mapping.dmp