Analysis
-
max time kernel
286s -
max time network
302s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
12/10/2022, 05:25
Static task
static1
Behavioral task
behavioral1
Sample
35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
300 seconds
General
-
Target
35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe
-
Size
1.2MB
-
MD5
6c22e9ff51c52ea93902af7b8c2283c3
-
SHA1
e4afe2353cafa647916cfca70e12443dea0a6387
-
SHA256
35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92
-
SHA512
49e1345148a74a1f0e743048fcd3918c5fc06b1d09308823b95368f8bd0b8a4fba80478768f27cb341faa014fa567f19a5cef0deca10bfdd9a13811377efa7ee
-
SSDEEP
24576:uXhnBIzrRKpZv3ilD09IiYanTw75Vx6fO9qUigRnhqOGVdvbnu6/SZv:EBIMvPilDunTw73wOEysdC6/SZv
Malware Config
Extracted
Family
danabot
C2
192.236.233.188:443
23.106.124.171:443
192.119.70.159:443
Attributes
-
embedded_hash
A813CAF845B5703DA814AF785BB60B21
-
type
loader
Signatures
-
Blocklisted process makes network request 43 IoCs
flow pid Process 3 624 rundll32.exe 6 624 rundll32.exe 7 624 rundll32.exe 8 624 rundll32.exe 9 624 rundll32.exe 10 624 rundll32.exe 11 624 rundll32.exe 12 624 rundll32.exe 13 624 rundll32.exe 14 624 rundll32.exe 15 624 rundll32.exe 16 624 rundll32.exe 17 624 rundll32.exe 18 624 rundll32.exe 19 624 rundll32.exe 20 624 rundll32.exe 21 624 rundll32.exe 22 624 rundll32.exe 23 624 rundll32.exe 24 624 rundll32.exe 25 624 rundll32.exe 26 624 rundll32.exe 27 624 rundll32.exe 28 624 rundll32.exe 29 624 rundll32.exe 30 624 rundll32.exe 31 624 rundll32.exe 32 624 rundll32.exe 33 624 rundll32.exe 34 624 rundll32.exe 35 624 rundll32.exe 36 624 rundll32.exe 37 624 rundll32.exe 38 624 rundll32.exe 39 624 rundll32.exe 40 624 rundll32.exe 41 624 rundll32.exe 42 624 rundll32.exe 45 624 rundll32.exe 48 624 rundll32.exe 49 624 rundll32.exe 50 624 rundll32.exe 53 624 rundll32.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2036 wrote to memory of 1048 2036 35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe 27 PID 2036 wrote to memory of 1048 2036 35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe 27 PID 2036 wrote to memory of 1048 2036 35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe 27 PID 2036 wrote to memory of 1048 2036 35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe 27 PID 2036 wrote to memory of 624 2036 35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe 28 PID 2036 wrote to memory of 624 2036 35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe 28 PID 2036 wrote to memory of 624 2036 35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe 28 PID 2036 wrote to memory of 624 2036 35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe 28 PID 2036 wrote to memory of 624 2036 35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe 28 PID 2036 wrote to memory of 624 2036 35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe 28 PID 2036 wrote to memory of 624 2036 35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe 28 PID 2036 wrote to memory of 624 2036 35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe 28 PID 2036 wrote to memory of 624 2036 35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe 28 PID 2036 wrote to memory of 624 2036 35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe 28 PID 2036 wrote to memory of 624 2036 35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe 28 PID 2036 wrote to memory of 624 2036 35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe 28 PID 2036 wrote to memory of 624 2036 35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe 28 PID 2036 wrote to memory of 624 2036 35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe 28 PID 2036 wrote to memory of 624 2036 35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe 28 PID 2036 wrote to memory of 624 2036 35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe 28 PID 2036 wrote to memory of 624 2036 35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe 28 PID 2036 wrote to memory of 624 2036 35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe 28 PID 2036 wrote to memory of 624 2036 35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe 28 PID 2036 wrote to memory of 624 2036 35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe 28 PID 2036 wrote to memory of 624 2036 35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe 28 PID 2036 wrote to memory of 624 2036 35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe 28 PID 2036 wrote to memory of 624 2036 35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe"C:\Users\Admin\AppData\Local\Temp\35a94432b93bb87859ce8dec9a6f0725119f38d4bf0678bf645ba8b2605d9f92.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\AdapterTroubleshooter.exeC:\Windows\system32\AdapterTroubleshooter.exe2⤵PID:1048
-
-
C:\Windows\syswow64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
PID:624
-