Analysis

  • max time kernel
    48s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    20/12/2022, 14:23

General

  • Target

    1011a741bec73841acc4c7f9c9b58492ab3a2a7a09bc2c3afeaea570d12c0ee8.dll

  • Size

    6.0MB

  • MD5

    e6ece3b3fbfd4ec6868c9d808239caae

  • SHA1

    e1af7bc31d0064f312ed489ce20ffa55dd9abeb1

  • SHA256

    1011a741bec73841acc4c7f9c9b58492ab3a2a7a09bc2c3afeaea570d12c0ee8

  • SHA512

    73a3f58a5b74bf42cd50883034156f5426918dd9ea6a8851f08204721921f042d15696c4c89f4f81b3a3703686128aa7cbae7f68e10a035888a492f7407a5c88

  • SSDEEP

    98304:Hz+i/ZUp+6iENc2cvrJvY6gQ4Qlixljx3pj3GWdF8E/vK1JVSP:Tpk+6nc2cvwZLGWD8E/S

Score
10/10

Malware Config

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 26 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\1011a741bec73841acc4c7f9c9b58492ab3a2a7a09bc2c3afeaea570d12c0ee8.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1140
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\1011a741bec73841acc4c7f9c9b58492ab3a2a7a09bc2c3afeaea570d12c0ee8.dll,#1
      2⤵
      • Checks processor information in registry
      PID:1256

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1256-55-0x0000000075091000-0x0000000075093000-memory.dmp

    Filesize

    8KB

  • memory/1256-56-0x0000000001DF0000-0x0000000002515000-memory.dmp

    Filesize

    7.1MB