Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/10/2022, 13:51
Static task
static1
Behavioral task
behavioral1
Sample
malware_smoke_1190770884.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
General
-
Target
malware_smoke_1190770884.exe
-
Size
1.0MB
-
MD5
5b64b4c975ff001a2d99bf9b65b4b8bb
-
SHA1
a234b171340ca47f2a2fba0705911c61416e8985
-
SHA256
2650817e2703b15c7e6fbf4d4caace2066f50db88fc96862190c4daf32d186e7
-
SHA512
7a923c06534c9d29d9911760ad3b3ebd685806ff2cb157a055616532cf7aeabe362005e6ab38d669087b076840d70f77bbd6f14500fc98b56c4f2cbe6856cd5d
-
SSDEEP
24576:vbahsA6iHbGRj+x7UkpFU/UzPkgSSML3xitJwDSmAESmB:OhsTibGRjM7UkpFRMxqwM
Malware Config
Extracted
Family
danabot
Botnet
5
C2
23.254.129.180:443
23.254.133.7:443
213.227.155.102:443
Attributes
-
embedded_hash
5C4A9996E213E13DC6AC3BC28C895A29
-
type
loader
Signatures
-
Blocklisted process makes network request 64 IoCs
flow pid Process 2 1788 rundll32.exe 4 1788 rundll32.exe 6 1788 rundll32.exe 7 1788 rundll32.exe 8 1788 rundll32.exe 9 1788 rundll32.exe 10 1788 rundll32.exe 11 1788 rundll32.exe 12 1788 rundll32.exe 13 1788 rundll32.exe 14 1788 rundll32.exe 15 1788 rundll32.exe 17 1788 rundll32.exe 18 1788 rundll32.exe 19 1788 rundll32.exe 20 1788 rundll32.exe 21 1788 rundll32.exe 22 1788 rundll32.exe 23 1788 rundll32.exe 24 1788 rundll32.exe 25 1788 rundll32.exe 26 1788 rundll32.exe 27 1788 rundll32.exe 28 1788 rundll32.exe 29 1788 rundll32.exe 30 1788 rundll32.exe 31 1788 rundll32.exe 32 1788 rundll32.exe 33 1788 rundll32.exe 34 1788 rundll32.exe 35 1788 rundll32.exe 36 1788 rundll32.exe 37 1788 rundll32.exe 38 1788 rundll32.exe 39 1788 rundll32.exe 40 1788 rundll32.exe 41 1788 rundll32.exe 42 1788 rundll32.exe 43 1788 rundll32.exe 44 1788 rundll32.exe 45 1788 rundll32.exe 46 1788 rundll32.exe 47 1788 rundll32.exe 48 1788 rundll32.exe 49 1788 rundll32.exe 50 1788 rundll32.exe 51 1788 rundll32.exe 52 1788 rundll32.exe 53 1788 rundll32.exe 54 1788 rundll32.exe 55 1788 rundll32.exe 56 1788 rundll32.exe 57 1788 rundll32.exe 58 1788 rundll32.exe 59 1788 rundll32.exe 60 1788 rundll32.exe 61 1788 rundll32.exe 62 1788 rundll32.exe 63 1788 rundll32.exe 64 1788 rundll32.exe 65 1788 rundll32.exe 67 1788 rundll32.exe 68 1788 rundll32.exe 69 1788 rundll32.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26 PID 1720 wrote to memory of 1788 1720 malware_smoke_1190770884.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\malware_smoke_1190770884.exe"C:\Users\Admin\AppData\Local\Temp\malware_smoke_1190770884.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\syswow64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
PID:1788
-