Analysis
-
max time kernel
298s -
max time network
318s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
12-10-2022 05:34
Static task
static1
Behavioral task
behavioral1
Sample
9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
300 seconds
General
-
Target
9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe
-
Size
1.2MB
-
MD5
20414be8ceb675059f5fb9d2f656e7b9
-
SHA1
5dbd2930909ef93772b592a6fc3452ce173b1a63
-
SHA256
9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a
-
SHA512
15f78877242404125e50bcfc9989d1b906daea2a4f9feb4b067900fefe62e91eb74492938d06c123e37fa8ff46789216d2d6797c9ba4aa72161aee331c85b2d5
-
SSDEEP
24576:dXvVcG5KIkfbO8FuS/uWFYHLss1kLIM6VPdzMcGEcdoV8Kv:dXvVJPibx/rFYHwswInVPdIRRdhKv
Malware Config
Extracted
Family
danabot
C2
192.236.233.188:443
192.119.70.159:443
23.106.124.171:443
Attributes
-
embedded_hash
F11D3871631E16E8DE15C24B32328D98
-
type
loader
Signatures
-
Blocklisted process makes network request 42 IoCs
flow pid Process 3 1096 rundll32.exe 6 1096 rundll32.exe 7 1096 rundll32.exe 8 1096 rundll32.exe 10 1096 rundll32.exe 11 1096 rundll32.exe 12 1096 rundll32.exe 13 1096 rundll32.exe 14 1096 rundll32.exe 15 1096 rundll32.exe 16 1096 rundll32.exe 19 1096 rundll32.exe 20 1096 rundll32.exe 21 1096 rundll32.exe 22 1096 rundll32.exe 23 1096 rundll32.exe 24 1096 rundll32.exe 25 1096 rundll32.exe 26 1096 rundll32.exe 27 1096 rundll32.exe 28 1096 rundll32.exe 29 1096 rundll32.exe 30 1096 rundll32.exe 31 1096 rundll32.exe 32 1096 rundll32.exe 33 1096 rundll32.exe 34 1096 rundll32.exe 35 1096 rundll32.exe 36 1096 rundll32.exe 37 1096 rundll32.exe 38 1096 rundll32.exe 39 1096 rundll32.exe 40 1096 rundll32.exe 41 1096 rundll32.exe 42 1096 rundll32.exe 43 1096 rundll32.exe 44 1096 rundll32.exe 45 1096 rundll32.exe 46 1096 rundll32.exe 47 1096 rundll32.exe 48 1096 rundll32.exe 51 1096 rundll32.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 692 wrote to memory of 1600 692 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe 27 PID 692 wrote to memory of 1600 692 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe 27 PID 692 wrote to memory of 1600 692 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe 27 PID 692 wrote to memory of 1600 692 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe 27 PID 692 wrote to memory of 1096 692 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe 28 PID 692 wrote to memory of 1096 692 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe 28 PID 692 wrote to memory of 1096 692 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe 28 PID 692 wrote to memory of 1096 692 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe 28 PID 692 wrote to memory of 1096 692 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe 28 PID 692 wrote to memory of 1096 692 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe 28 PID 692 wrote to memory of 1096 692 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe 28 PID 692 wrote to memory of 1096 692 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe 28 PID 692 wrote to memory of 1096 692 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe 28 PID 692 wrote to memory of 1096 692 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe 28 PID 692 wrote to memory of 1096 692 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe 28 PID 692 wrote to memory of 1096 692 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe 28 PID 692 wrote to memory of 1096 692 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe 28 PID 692 wrote to memory of 1096 692 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe 28 PID 692 wrote to memory of 1096 692 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe 28 PID 692 wrote to memory of 1096 692 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe 28 PID 692 wrote to memory of 1096 692 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe 28 PID 692 wrote to memory of 1096 692 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe 28 PID 692 wrote to memory of 1096 692 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe 28 PID 692 wrote to memory of 1096 692 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe 28 PID 692 wrote to memory of 1096 692 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe 28 PID 692 wrote to memory of 1096 692 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe 28 PID 692 wrote to memory of 1096 692 9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe"C:\Users\Admin\AppData\Local\Temp\9e2e09592af42e6493216ccfa7b4c8d9e6a09249082edfdbdcd293cb5a8f1e9a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\SysWOW64\AdapterTroubleshooter.exeC:\Windows\system32\AdapterTroubleshooter.exe2⤵PID:1600
-
-
C:\Windows\syswow64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
PID:1096
-