Analysis
-
max time kernel
156s -
max time network
182s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-10-2022 13:30
Static task
static1
Behavioral task
behavioral1
Sample
malware_smoke_2586152214.exe
Resource
win7-20220812-en
3 signatures
150 seconds
General
-
Target
malware_smoke_2586152214.exe
-
Size
989KB
-
MD5
15e5ddb829c749649f99f10c90426e6c
-
SHA1
f4086a982038a0614ffa3acf7a8cbdd07c34b7d1
-
SHA256
76559476c1018ec1db4d8a692c6af3e66d394e31141f5cf47b1fdbb3ecde118c
-
SHA512
2131caa27f42dc2aca407df253a8486ef9065846043b5e5b13fd7c3f24f5a4b8ddba50ca18645f6b0f6f5a7d60b20aee49631497592bbd9383e6f3dff70f9d0f
-
SSDEEP
24576:t9JCiFuiVOFF/W7qmnYxvv0WJCC5V14y2KdZJC7:pwi4/4q3V5V1YKdv
Malware Config
Extracted
Family
danabot
Botnet
5
C2
104.168.167.51:443
23.254.129.180:443
23.254.133.7:443
213.227.155.102:443
Attributes
-
embedded_hash
38025B93DA95E52B49DBD6CF4413C95E
-
type
loader
Signatures
-
Blocklisted process makes network request 26 IoCs
Processes:
rundll32.exeflow pid process 4 780 rundll32.exe 5 780 rundll32.exe 7 780 rundll32.exe 6 780 rundll32.exe 8 780 rundll32.exe 9 780 rundll32.exe 10 780 rundll32.exe 11 780 rundll32.exe 12 780 rundll32.exe 13 780 rundll32.exe 14 780 rundll32.exe 15 780 rundll32.exe 16 780 rundll32.exe 17 780 rundll32.exe 18 780 rundll32.exe 19 780 rundll32.exe 20 780 rundll32.exe 21 780 rundll32.exe 22 780 rundll32.exe 23 780 rundll32.exe 24 780 rundll32.exe 25 780 rundll32.exe 26 780 rundll32.exe 27 780 rundll32.exe 28 780 rundll32.exe 29 780 rundll32.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
malware_smoke_2586152214.exedescription pid process target process PID 1476 wrote to memory of 780 1476 malware_smoke_2586152214.exe rundll32.exe PID 1476 wrote to memory of 780 1476 malware_smoke_2586152214.exe rundll32.exe PID 1476 wrote to memory of 780 1476 malware_smoke_2586152214.exe rundll32.exe PID 1476 wrote to memory of 780 1476 malware_smoke_2586152214.exe rundll32.exe PID 1476 wrote to memory of 780 1476 malware_smoke_2586152214.exe rundll32.exe PID 1476 wrote to memory of 780 1476 malware_smoke_2586152214.exe rundll32.exe PID 1476 wrote to memory of 780 1476 malware_smoke_2586152214.exe rundll32.exe PID 1476 wrote to memory of 780 1476 malware_smoke_2586152214.exe rundll32.exe PID 1476 wrote to memory of 780 1476 malware_smoke_2586152214.exe rundll32.exe PID 1476 wrote to memory of 780 1476 malware_smoke_2586152214.exe rundll32.exe PID 1476 wrote to memory of 780 1476 malware_smoke_2586152214.exe rundll32.exe PID 1476 wrote to memory of 780 1476 malware_smoke_2586152214.exe rundll32.exe PID 1476 wrote to memory of 780 1476 malware_smoke_2586152214.exe rundll32.exe PID 1476 wrote to memory of 780 1476 malware_smoke_2586152214.exe rundll32.exe PID 1476 wrote to memory of 780 1476 malware_smoke_2586152214.exe rundll32.exe PID 1476 wrote to memory of 780 1476 malware_smoke_2586152214.exe rundll32.exe PID 1476 wrote to memory of 780 1476 malware_smoke_2586152214.exe rundll32.exe PID 1476 wrote to memory of 780 1476 malware_smoke_2586152214.exe rundll32.exe PID 1476 wrote to memory of 780 1476 malware_smoke_2586152214.exe rundll32.exe PID 1476 wrote to memory of 780 1476 malware_smoke_2586152214.exe rundll32.exe PID 1476 wrote to memory of 780 1476 malware_smoke_2586152214.exe rundll32.exe PID 1476 wrote to memory of 780 1476 malware_smoke_2586152214.exe rundll32.exe PID 1476 wrote to memory of 780 1476 malware_smoke_2586152214.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\malware_smoke_2586152214.exe"C:\Users\Admin\AppData\Local\Temp\malware_smoke_2586152214.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/780-91-0x0000000000080000-0x0000000000083000-memory.dmpFilesize
12KB
-
memory/780-96-0x00000000000D0000-0x00000000000D3000-memory.dmpFilesize
12KB
-
memory/780-97-0x00000000000E0000-0x00000000000E3000-memory.dmpFilesize
12KB
-
memory/780-95-0x00000000000C0000-0x00000000000C3000-memory.dmpFilesize
12KB
-
memory/780-94-0x00000000000B0000-0x00000000000B3000-memory.dmpFilesize
12KB
-
memory/780-59-0x0000000000140000-0x0000000000143000-memory.dmpFilesize
12KB
-
memory/780-61-0x0000000000140000-0x0000000000143000-memory.dmpFilesize
12KB
-
memory/780-87-0x0000000000000000-mapping.dmp
-
memory/780-92-0x0000000000090000-0x0000000000093000-memory.dmpFilesize
12KB
-
memory/780-93-0x00000000000A0000-0x00000000000A3000-memory.dmpFilesize
12KB
-
memory/1476-58-0x0000000076701000-0x0000000076703000-memory.dmpFilesize
8KB
-
memory/1476-90-0x0000000000400000-0x00000000005F0000-memory.dmpFilesize
1.9MB
-
memory/1476-89-0x0000000001EE0000-0x00000000020C5000-memory.dmpFilesize
1.9MB
-
memory/1476-54-0x00000000005F0000-0x00000000006B5000-memory.dmpFilesize
788KB
-
memory/1476-57-0x0000000000400000-0x00000000005F0000-memory.dmpFilesize
1.9MB
-
memory/1476-56-0x0000000001EE0000-0x00000000020C5000-memory.dmpFilesize
1.9MB
-
memory/1476-55-0x00000000005F0000-0x00000000006B5000-memory.dmpFilesize
788KB