Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    156s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2023, 15:22

General

  • Target

    JC_454f76ecaea8080ab5a9216ba319db0a58b015ed6497be6ac55b3b770236c43c.dll

  • Size

    1.3MB

  • MD5

    03ef9962144e8b824a974b5fc2d6b370

  • SHA1

    c8cc15a1991559a7281078495b055fc6e766a45f

  • SHA256

    454f76ecaea8080ab5a9216ba319db0a58b015ed6497be6ac55b3b770236c43c

  • SHA512

    b21fbcc07468bd9e6c5316225ab4dd354d09e31059db6d78be4d7620ab9bed42a1d9f39cc229c0cb2e9d28998e0d149b26b0c2141b44b03c6c97662b243ffe1f

  • SSDEEP

    24576:pcF24kalewp+N/U1s4LHu1zG6T63YAkI4gTMdzf:Kv251K6W3J9Tq

Score
10/10

Malware Config

Extracted

Family

danabot

Botnet

4

C2

23.254.144.209:443

23.254.227.74:443

192.255.166.212:443

Attributes
  • embedded_hash

    0E1A7A1479C37094441FA911262B322A

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Danabot Loader Component 2 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\JC_454f76ecaea8080ab5a9216ba319db0a58b015ed6497be6ac55b3b770236c43c.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\JC_454f76ecaea8080ab5a9216ba319db0a58b015ed6497be6ac55b3b770236c43c.dll,#1
      2⤵
      • Blocklisted process makes network request
      PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1720-0-0x0000000001E20000-0x0000000001F81000-memory.dmp

    Filesize

    1.4MB

  • memory/1720-1-0x0000000001E20000-0x0000000001F81000-memory.dmp

    Filesize

    1.4MB