Analysis
-
max time kernel
39s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-06-2022 04:10
Behavioral task
behavioral1
Sample
330230b667873603377f0802abf01af99a778330b30b6190174a13c1aa1808f5.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
330230b667873603377f0802abf01af99a778330b30b6190174a13c1aa1808f5.dll
Resource
win10v2004-20220414-en
General
-
Target
330230b667873603377f0802abf01af99a778330b30b6190174a13c1aa1808f5.dll
-
Size
1.4MB
-
MD5
ab7dbbf3b7146aea68cb674376eb61c8
-
SHA1
072c3aa96981ab83bd400151b3bcd219e8ea777a
-
SHA256
330230b667873603377f0802abf01af99a778330b30b6190174a13c1aa1808f5
-
SHA512
9801d142820f33aede76d6250f17da133e4a31d7f57defd41c92c32cfc09804cb13d7e4e6759c63a319855d57a293a13c7680ef24bed14a095854828f5e12259
Malware Config
Extracted
danabot
236.34.98.36
184.82.0.199
99.142.111.190
11.202.75.114
98.208.224.126
191.90.126.19
20.31.15.28
195.123.220.45
149.154.159.213
248.83.33.201
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1004 1728 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1864 wrote to memory of 1728 1864 rundll32.exe rundll32.exe PID 1864 wrote to memory of 1728 1864 rundll32.exe rundll32.exe PID 1864 wrote to memory of 1728 1864 rundll32.exe rundll32.exe PID 1864 wrote to memory of 1728 1864 rundll32.exe rundll32.exe PID 1864 wrote to memory of 1728 1864 rundll32.exe rundll32.exe PID 1864 wrote to memory of 1728 1864 rundll32.exe rundll32.exe PID 1864 wrote to memory of 1728 1864 rundll32.exe rundll32.exe PID 1728 wrote to memory of 1004 1728 rundll32.exe WerFault.exe PID 1728 wrote to memory of 1004 1728 rundll32.exe WerFault.exe PID 1728 wrote to memory of 1004 1728 rundll32.exe WerFault.exe PID 1728 wrote to memory of 1004 1728 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\330230b667873603377f0802abf01af99a778330b30b6190174a13c1aa1808f5.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\330230b667873603377f0802abf01af99a778330b30b6190174a13c1aa1808f5.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 3643⤵
- Program crash