Analysis
-
max time kernel
63s -
max time network
68s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
25-06-2022 10:34
Static task
static1
Behavioral task
behavioral1
Sample
6f6a2ab9d85173b049ed2654e9efda2332b215ba4480618177a789ff0af1d0f9.exe
Resource
win7-20220414-en
General
-
Target
6f6a2ab9d85173b049ed2654e9efda2332b215ba4480618177a789ff0af1d0f9.exe
-
Size
998KB
-
MD5
695a4122879652c1a3d32bddb0957b35
-
SHA1
6375f5a1a70fc999dc760734cca1ce248e9b53fa
-
SHA256
6f6a2ab9d85173b049ed2654e9efda2332b215ba4480618177a789ff0af1d0f9
-
SHA512
db8ae2b5b1af341dc040a16719753d833914b9737d37fa9237b62f8023e0e8f6f35089b3072822e28b02a4a84dc109ddf49d4daef4ad6c7e72ec7b48d1c6fd84
Malware Config
Extracted
danabot
5.61.58.130
2.56.213.39
2.56.212.4
5.61.56.192
Signatures
-
Danabot x86 payload 6 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\6F6A2A~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\6F6A2A~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\6F6A2A~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\6F6A2A~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\6F6A2A~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\6F6A2A~1.DLL family_danabot -
Blocklisted process makes network request 10 IoCs
Processes:
rundll32.exeflow pid process 1 1928 rundll32.exe 2 1928 rundll32.exe 3 1928 rundll32.exe 4 1928 rundll32.exe 5 1928 rundll32.exe 6 1928 rundll32.exe 7 1928 rundll32.exe 8 1928 rundll32.exe 10 1928 rundll32.exe 11 1928 rundll32.exe -
Loads dropped DLL 5 IoCs
Processes:
regsvr32.exerundll32.exepid process 1460 regsvr32.exe 1928 rundll32.exe 1928 rundll32.exe 1928 rundll32.exe 1928 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
6f6a2ab9d85173b049ed2654e9efda2332b215ba4480618177a789ff0af1d0f9.exeregsvr32.exedescription pid process target process PID 1672 wrote to memory of 1460 1672 6f6a2ab9d85173b049ed2654e9efda2332b215ba4480618177a789ff0af1d0f9.exe regsvr32.exe PID 1672 wrote to memory of 1460 1672 6f6a2ab9d85173b049ed2654e9efda2332b215ba4480618177a789ff0af1d0f9.exe regsvr32.exe PID 1672 wrote to memory of 1460 1672 6f6a2ab9d85173b049ed2654e9efda2332b215ba4480618177a789ff0af1d0f9.exe regsvr32.exe PID 1672 wrote to memory of 1460 1672 6f6a2ab9d85173b049ed2654e9efda2332b215ba4480618177a789ff0af1d0f9.exe regsvr32.exe PID 1672 wrote to memory of 1460 1672 6f6a2ab9d85173b049ed2654e9efda2332b215ba4480618177a789ff0af1d0f9.exe regsvr32.exe PID 1672 wrote to memory of 1460 1672 6f6a2ab9d85173b049ed2654e9efda2332b215ba4480618177a789ff0af1d0f9.exe regsvr32.exe PID 1672 wrote to memory of 1460 1672 6f6a2ab9d85173b049ed2654e9efda2332b215ba4480618177a789ff0af1d0f9.exe regsvr32.exe PID 1460 wrote to memory of 1928 1460 regsvr32.exe rundll32.exe PID 1460 wrote to memory of 1928 1460 regsvr32.exe rundll32.exe PID 1460 wrote to memory of 1928 1460 regsvr32.exe rundll32.exe PID 1460 wrote to memory of 1928 1460 regsvr32.exe rundll32.exe PID 1460 wrote to memory of 1928 1460 regsvr32.exe rundll32.exe PID 1460 wrote to memory of 1928 1460 regsvr32.exe rundll32.exe PID 1460 wrote to memory of 1928 1460 regsvr32.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f6a2ab9d85173b049ed2654e9efda2332b215ba4480618177a789ff0af1d0f9.exe"C:\Users\Admin\AppData\Local\Temp\6f6a2ab9d85173b049ed2654e9efda2332b215ba4480618177a789ff0af1d0f9.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\6F6A2A~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\6F6A2A~1.EXE@16722⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\6F6A2A~1.DLL,f03⤵
- Blocklisted process makes network request
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\6F6A2A~1.DLLFilesize
725KB
MD58dcdfd72fd6e33ec7d7d03466b06fcad
SHA1f2589526876aea35da17af31e15b3d3f66158e6a
SHA256df80e4bf59b1751482aa28225f435c48c7e4c239b522049bb8f835947cb37fba
SHA51271b2f84cd5be2af0f92bfc34c4ae0912b4cc607f3bcf88d69e60c394f94b21904b7fd0baee2e3572e000eb8774fc9aad2c3b818120300498458ecf7e7613fde2
-
\Users\Admin\AppData\Local\Temp\6F6A2A~1.DLLFilesize
725KB
MD58dcdfd72fd6e33ec7d7d03466b06fcad
SHA1f2589526876aea35da17af31e15b3d3f66158e6a
SHA256df80e4bf59b1751482aa28225f435c48c7e4c239b522049bb8f835947cb37fba
SHA51271b2f84cd5be2af0f92bfc34c4ae0912b4cc607f3bcf88d69e60c394f94b21904b7fd0baee2e3572e000eb8774fc9aad2c3b818120300498458ecf7e7613fde2
-
\Users\Admin\AppData\Local\Temp\6F6A2A~1.DLLFilesize
725KB
MD58dcdfd72fd6e33ec7d7d03466b06fcad
SHA1f2589526876aea35da17af31e15b3d3f66158e6a
SHA256df80e4bf59b1751482aa28225f435c48c7e4c239b522049bb8f835947cb37fba
SHA51271b2f84cd5be2af0f92bfc34c4ae0912b4cc607f3bcf88d69e60c394f94b21904b7fd0baee2e3572e000eb8774fc9aad2c3b818120300498458ecf7e7613fde2
-
\Users\Admin\AppData\Local\Temp\6F6A2A~1.DLLFilesize
725KB
MD58dcdfd72fd6e33ec7d7d03466b06fcad
SHA1f2589526876aea35da17af31e15b3d3f66158e6a
SHA256df80e4bf59b1751482aa28225f435c48c7e4c239b522049bb8f835947cb37fba
SHA51271b2f84cd5be2af0f92bfc34c4ae0912b4cc607f3bcf88d69e60c394f94b21904b7fd0baee2e3572e000eb8774fc9aad2c3b818120300498458ecf7e7613fde2
-
\Users\Admin\AppData\Local\Temp\6F6A2A~1.DLLFilesize
725KB
MD58dcdfd72fd6e33ec7d7d03466b06fcad
SHA1f2589526876aea35da17af31e15b3d3f66158e6a
SHA256df80e4bf59b1751482aa28225f435c48c7e4c239b522049bb8f835947cb37fba
SHA51271b2f84cd5be2af0f92bfc34c4ae0912b4cc607f3bcf88d69e60c394f94b21904b7fd0baee2e3572e000eb8774fc9aad2c3b818120300498458ecf7e7613fde2
-
\Users\Admin\AppData\Local\Temp\6F6A2A~1.DLLFilesize
725KB
MD58dcdfd72fd6e33ec7d7d03466b06fcad
SHA1f2589526876aea35da17af31e15b3d3f66158e6a
SHA256df80e4bf59b1751482aa28225f435c48c7e4c239b522049bb8f835947cb37fba
SHA51271b2f84cd5be2af0f92bfc34c4ae0912b4cc607f3bcf88d69e60c394f94b21904b7fd0baee2e3572e000eb8774fc9aad2c3b818120300498458ecf7e7613fde2
-
memory/1460-58-0x0000000000000000-mapping.dmp
-
memory/1460-60-0x00000000763C1000-0x00000000763C3000-memory.dmpFilesize
8KB
-
memory/1460-63-0x0000000000A00000-0x0000000000AC3000-memory.dmpFilesize
780KB
-
memory/1672-59-0x0000000000400000-0x0000000000566000-memory.dmpFilesize
1.4MB
-
memory/1672-54-0x0000000000250000-0x000000000031C000-memory.dmpFilesize
816KB
-
memory/1672-57-0x0000000000400000-0x0000000000566000-memory.dmpFilesize
1.4MB
-
memory/1672-56-0x0000000001E20000-0x0000000001F00000-memory.dmpFilesize
896KB
-
memory/1672-55-0x0000000000250000-0x000000000031C000-memory.dmpFilesize
816KB
-
memory/1928-64-0x0000000000000000-mapping.dmp
-
memory/1928-70-0x0000000000210000-0x00000000002D3000-memory.dmpFilesize
780KB