Analysis
-
max time kernel
106s -
max time network
114s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
25-06-2022 10:34
Static task
static1
Behavioral task
behavioral1
Sample
ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b.exe
Resource
win7-20220414-en
General
-
Target
ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b.exe
-
Size
1003KB
-
MD5
adc70afd78869ceba3b0a65d727be858
-
SHA1
3a7d38de441152e5b69d694fbb8f53c0612d7c06
-
SHA256
ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b
-
SHA512
fa42a28b0818c47cd9903229bc49c435dd73796698934eef4b148708b057d98877af7d07810decaa3b95687219ad74e731734f98666924aff7b2a4eeddab3d85
Malware Config
Extracted
danabot
5.61.58.130
2.56.213.39
2.56.212.4
5.61.56.192
Signatures
-
Danabot x86 payload 6 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\EE5069~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\EE5069~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\EE5069~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\EE5069~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\EE5069~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\EE5069~1.DLL family_danabot -
Blocklisted process makes network request 10 IoCs
Processes:
rundll32.exeflow pid process 1 2024 rundll32.exe 3 2024 rundll32.exe 4 2024 rundll32.exe 5 2024 rundll32.exe 6 2024 rundll32.exe 7 2024 rundll32.exe 8 2024 rundll32.exe 9 2024 rundll32.exe 10 2024 rundll32.exe 11 2024 rundll32.exe -
Loads dropped DLL 5 IoCs
Processes:
regsvr32.exerundll32.exepid process 1316 regsvr32.exe 2024 rundll32.exe 2024 rundll32.exe 2024 rundll32.exe 2024 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b.exeregsvr32.exedescription pid process target process PID 1420 wrote to memory of 1316 1420 ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b.exe regsvr32.exe PID 1420 wrote to memory of 1316 1420 ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b.exe regsvr32.exe PID 1420 wrote to memory of 1316 1420 ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b.exe regsvr32.exe PID 1420 wrote to memory of 1316 1420 ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b.exe regsvr32.exe PID 1420 wrote to memory of 1316 1420 ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b.exe regsvr32.exe PID 1420 wrote to memory of 1316 1420 ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b.exe regsvr32.exe PID 1420 wrote to memory of 1316 1420 ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b.exe regsvr32.exe PID 1316 wrote to memory of 2024 1316 regsvr32.exe rundll32.exe PID 1316 wrote to memory of 2024 1316 regsvr32.exe rundll32.exe PID 1316 wrote to memory of 2024 1316 regsvr32.exe rundll32.exe PID 1316 wrote to memory of 2024 1316 regsvr32.exe rundll32.exe PID 1316 wrote to memory of 2024 1316 regsvr32.exe rundll32.exe PID 1316 wrote to memory of 2024 1316 regsvr32.exe rundll32.exe PID 1316 wrote to memory of 2024 1316 regsvr32.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b.exe"C:\Users\Admin\AppData\Local\Temp\ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\EE5069~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\EE5069~1.EXE@14202⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\EE5069~1.DLL,f03⤵
- Blocklisted process makes network request
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\EE5069~1.DLLFilesize
725KB
MD58dcdfd72fd6e33ec7d7d03466b06fcad
SHA1f2589526876aea35da17af31e15b3d3f66158e6a
SHA256df80e4bf59b1751482aa28225f435c48c7e4c239b522049bb8f835947cb37fba
SHA51271b2f84cd5be2af0f92bfc34c4ae0912b4cc607f3bcf88d69e60c394f94b21904b7fd0baee2e3572e000eb8774fc9aad2c3b818120300498458ecf7e7613fde2
-
\Users\Admin\AppData\Local\Temp\EE5069~1.DLLFilesize
725KB
MD58dcdfd72fd6e33ec7d7d03466b06fcad
SHA1f2589526876aea35da17af31e15b3d3f66158e6a
SHA256df80e4bf59b1751482aa28225f435c48c7e4c239b522049bb8f835947cb37fba
SHA51271b2f84cd5be2af0f92bfc34c4ae0912b4cc607f3bcf88d69e60c394f94b21904b7fd0baee2e3572e000eb8774fc9aad2c3b818120300498458ecf7e7613fde2
-
\Users\Admin\AppData\Local\Temp\EE5069~1.DLLFilesize
725KB
MD58dcdfd72fd6e33ec7d7d03466b06fcad
SHA1f2589526876aea35da17af31e15b3d3f66158e6a
SHA256df80e4bf59b1751482aa28225f435c48c7e4c239b522049bb8f835947cb37fba
SHA51271b2f84cd5be2af0f92bfc34c4ae0912b4cc607f3bcf88d69e60c394f94b21904b7fd0baee2e3572e000eb8774fc9aad2c3b818120300498458ecf7e7613fde2
-
\Users\Admin\AppData\Local\Temp\EE5069~1.DLLFilesize
725KB
MD58dcdfd72fd6e33ec7d7d03466b06fcad
SHA1f2589526876aea35da17af31e15b3d3f66158e6a
SHA256df80e4bf59b1751482aa28225f435c48c7e4c239b522049bb8f835947cb37fba
SHA51271b2f84cd5be2af0f92bfc34c4ae0912b4cc607f3bcf88d69e60c394f94b21904b7fd0baee2e3572e000eb8774fc9aad2c3b818120300498458ecf7e7613fde2
-
\Users\Admin\AppData\Local\Temp\EE5069~1.DLLFilesize
725KB
MD58dcdfd72fd6e33ec7d7d03466b06fcad
SHA1f2589526876aea35da17af31e15b3d3f66158e6a
SHA256df80e4bf59b1751482aa28225f435c48c7e4c239b522049bb8f835947cb37fba
SHA51271b2f84cd5be2af0f92bfc34c4ae0912b4cc607f3bcf88d69e60c394f94b21904b7fd0baee2e3572e000eb8774fc9aad2c3b818120300498458ecf7e7613fde2
-
\Users\Admin\AppData\Local\Temp\EE5069~1.DLLFilesize
725KB
MD58dcdfd72fd6e33ec7d7d03466b06fcad
SHA1f2589526876aea35da17af31e15b3d3f66158e6a
SHA256df80e4bf59b1751482aa28225f435c48c7e4c239b522049bb8f835947cb37fba
SHA51271b2f84cd5be2af0f92bfc34c4ae0912b4cc607f3bcf88d69e60c394f94b21904b7fd0baee2e3572e000eb8774fc9aad2c3b818120300498458ecf7e7613fde2
-
memory/1316-60-0x00000000752B1000-0x00000000752B3000-memory.dmpFilesize
8KB
-
memory/1316-58-0x0000000000000000-mapping.dmp
-
memory/1316-63-0x0000000000AE0000-0x0000000000BA3000-memory.dmpFilesize
780KB
-
memory/1420-59-0x0000000000400000-0x0000000000567000-memory.dmpFilesize
1.4MB
-
memory/1420-57-0x0000000000400000-0x0000000000567000-memory.dmpFilesize
1.4MB
-
memory/1420-56-0x0000000000570000-0x0000000000650000-memory.dmpFilesize
896KB
-
memory/1420-54-0x0000000000330000-0x00000000003FB000-memory.dmpFilesize
812KB
-
memory/1420-55-0x0000000000330000-0x00000000003FB000-memory.dmpFilesize
812KB
-
memory/2024-64-0x0000000000000000-mapping.dmp
-
memory/2024-70-0x00000000002D0000-0x0000000000393000-memory.dmpFilesize
780KB