Analysis
-
max time kernel
133s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-06-2022 10:34
Static task
static1
Behavioral task
behavioral1
Sample
ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b.exe
Resource
win7-20220414-en
General
-
Target
ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b.exe
-
Size
1003KB
-
MD5
adc70afd78869ceba3b0a65d727be858
-
SHA1
3a7d38de441152e5b69d694fbb8f53c0612d7c06
-
SHA256
ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b
-
SHA512
fa42a28b0818c47cd9903229bc49c435dd73796698934eef4b148708b057d98877af7d07810decaa3b95687219ad74e731734f98666924aff7b2a4eeddab3d85
Malware Config
Extracted
danabot
5.61.58.130
2.56.213.39
2.56.212.4
5.61.56.192
Signatures
-
Danabot x86 payload 4 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\EE5069~1.DLL family_danabot C:\Users\Admin\AppData\Local\Temp\ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b.dll family_danabot C:\Users\Admin\AppData\Local\Temp\ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b.dll family_danabot C:\Users\Admin\AppData\Local\Temp\ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b.dll family_danabot -
Blocklisted process makes network request 10 IoCs
Processes:
rundll32.exeflow pid process 7 4404 rundll32.exe 19 4404 rundll32.exe 20 4404 rundll32.exe 22 4404 rundll32.exe 36 4404 rundll32.exe 40 4404 rundll32.exe 46 4404 rundll32.exe 50 4404 rundll32.exe 51 4404 rundll32.exe 56 4404 rundll32.exe -
Loads dropped DLL 3 IoCs
Processes:
regsvr32.exerundll32.exepid process 2920 regsvr32.exe 4404 rundll32.exe 4404 rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3416 1372 WerFault.exe ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b.exeregsvr32.exedescription pid process target process PID 1372 wrote to memory of 2920 1372 ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b.exe regsvr32.exe PID 1372 wrote to memory of 2920 1372 ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b.exe regsvr32.exe PID 1372 wrote to memory of 2920 1372 ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b.exe regsvr32.exe PID 2920 wrote to memory of 4404 2920 regsvr32.exe rundll32.exe PID 2920 wrote to memory of 4404 2920 regsvr32.exe rundll32.exe PID 2920 wrote to memory of 4404 2920 regsvr32.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b.exe"C:\Users\Admin\AppData\Local\Temp\ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\EE5069~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\EE5069~1.EXE@13722⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\EE5069~1.DLL,f03⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 4882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1372 -ip 13721⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\EE5069~1.DLLFilesize
725KB
MD531c151abf0e267dcbf59687f5eaea977
SHA1504c905865348144068a2b7bf3249e8c1d3ce8d7
SHA256e6b99e7a0925e5b5c1ac08f9af988dd4682f47dbf6fa698decf1285a1ee062f3
SHA512473c968fd7507b708cb7a4357f0655b8fc9e139548048dee9201db1ef7900a0a8f393cc20a34c9d6a2c2ec346651a1bd676de5fdd0da7473f6b4106f221b11d5
-
C:\Users\Admin\AppData\Local\Temp\ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b.dllFilesize
725KB
MD531c151abf0e267dcbf59687f5eaea977
SHA1504c905865348144068a2b7bf3249e8c1d3ce8d7
SHA256e6b99e7a0925e5b5c1ac08f9af988dd4682f47dbf6fa698decf1285a1ee062f3
SHA512473c968fd7507b708cb7a4357f0655b8fc9e139548048dee9201db1ef7900a0a8f393cc20a34c9d6a2c2ec346651a1bd676de5fdd0da7473f6b4106f221b11d5
-
C:\Users\Admin\AppData\Local\Temp\ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b.dllFilesize
725KB
MD531c151abf0e267dcbf59687f5eaea977
SHA1504c905865348144068a2b7bf3249e8c1d3ce8d7
SHA256e6b99e7a0925e5b5c1ac08f9af988dd4682f47dbf6fa698decf1285a1ee062f3
SHA512473c968fd7507b708cb7a4357f0655b8fc9e139548048dee9201db1ef7900a0a8f393cc20a34c9d6a2c2ec346651a1bd676de5fdd0da7473f6b4106f221b11d5
-
C:\Users\Admin\AppData\Local\Temp\ee5069d5035c72cbb00f372e6032718b22d1bfbe75b4be3ca59e402aa68d450b.dllFilesize
725KB
MD531c151abf0e267dcbf59687f5eaea977
SHA1504c905865348144068a2b7bf3249e8c1d3ce8d7
SHA256e6b99e7a0925e5b5c1ac08f9af988dd4682f47dbf6fa698decf1285a1ee062f3
SHA512473c968fd7507b708cb7a4357f0655b8fc9e139548048dee9201db1ef7900a0a8f393cc20a34c9d6a2c2ec346651a1bd676de5fdd0da7473f6b4106f221b11d5
-
memory/1372-130-0x000000000224D000-0x0000000002318000-memory.dmpFilesize
812KB
-
memory/1372-131-0x0000000002320000-0x0000000002400000-memory.dmpFilesize
896KB
-
memory/1372-132-0x0000000000400000-0x0000000000567000-memory.dmpFilesize
1.4MB
-
memory/1372-136-0x0000000000400000-0x0000000000567000-memory.dmpFilesize
1.4MB
-
memory/2920-133-0x0000000000000000-mapping.dmp
-
memory/4404-137-0x0000000000000000-mapping.dmp
-
memory/4404-140-0x0000000002260000-0x0000000002323000-memory.dmpFilesize
780KB