Analysis
-
max time kernel
140s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
21-12-2023 22:04
Behavioral task
behavioral1
Sample
0d1e6c5149c24875dd99e957d9207794.dll
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
General
-
Target
0d1e6c5149c24875dd99e957d9207794.dll
-
Size
1.3MB
-
MD5
0d1e6c5149c24875dd99e957d9207794
-
SHA1
81af6ac564bd13f82560c03563a965320b91d568
-
SHA256
247c740bf91c64bab302c0b53a1e138ebe6f951dac9c28c0be34c77ff1d35eba
-
SHA512
5b97c5db16b60cadacb02119d324fe87b71bdf165430e09283177624d4cc50fdf376d9cbe55271a2640a6d17164d760f9de076573dd0755a3f0e3e07fa994b13
-
SSDEEP
24576:hcF2ZBcDOPZA9N26e8nJZBAWOqlSKT9T3df:CYCRZBHNSCTB
Malware Config
Extracted
Family
danabot
Botnet
5
C2
192.210.222.81:443
23.229.29.48:443
5.9.224.204:443
192.255.166.212:443
Attributes
-
embedded_hash
100700D372965A717E89B8C909E1D8D4
-
type
loader
rsa_pubkey.plain
rsa_privkey.plain
Signatures
-
Danabot Loader Component 15 IoCs
Processes:
resource yara_rule behavioral1/memory/2532-0-0x0000000000A40000-0x0000000000BA1000-memory.dmp DanabotLoader2021 behavioral1/memory/2532-1-0x0000000000A40000-0x0000000000BA1000-memory.dmp DanabotLoader2021 behavioral1/memory/2532-2-0x0000000000A40000-0x0000000000BA1000-memory.dmp DanabotLoader2021 behavioral1/memory/2532-3-0x0000000000A40000-0x0000000000BA1000-memory.dmp DanabotLoader2021 behavioral1/memory/2532-4-0x0000000000A40000-0x0000000000BA1000-memory.dmp DanabotLoader2021 behavioral1/memory/2532-5-0x0000000000A40000-0x0000000000BA1000-memory.dmp DanabotLoader2021 behavioral1/memory/2532-6-0x0000000000A40000-0x0000000000BA1000-memory.dmp DanabotLoader2021 behavioral1/memory/2532-7-0x0000000000A40000-0x0000000000BA1000-memory.dmp DanabotLoader2021 behavioral1/memory/2532-8-0x0000000000A40000-0x0000000000BA1000-memory.dmp DanabotLoader2021 behavioral1/memory/2532-9-0x0000000000A40000-0x0000000000BA1000-memory.dmp DanabotLoader2021 behavioral1/memory/2532-10-0x0000000000A40000-0x0000000000BA1000-memory.dmp DanabotLoader2021 behavioral1/memory/2532-11-0x0000000000A40000-0x0000000000BA1000-memory.dmp DanabotLoader2021 behavioral1/memory/2532-12-0x0000000000A40000-0x0000000000BA1000-memory.dmp DanabotLoader2021 behavioral1/memory/2532-13-0x0000000000A40000-0x0000000000BA1000-memory.dmp DanabotLoader2021 behavioral1/memory/2532-14-0x0000000000A40000-0x0000000000BA1000-memory.dmp DanabotLoader2021 -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 2 2532 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1812 wrote to memory of 2532 1812 rundll32.exe rundll32.exe PID 1812 wrote to memory of 2532 1812 rundll32.exe rundll32.exe PID 1812 wrote to memory of 2532 1812 rundll32.exe rundll32.exe PID 1812 wrote to memory of 2532 1812 rundll32.exe rundll32.exe PID 1812 wrote to memory of 2532 1812 rundll32.exe rundll32.exe PID 1812 wrote to memory of 2532 1812 rundll32.exe rundll32.exe PID 1812 wrote to memory of 2532 1812 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0d1e6c5149c24875dd99e957d9207794.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0d1e6c5149c24875dd99e957d9207794.dll,#12⤵
- Blocklisted process makes network request
PID:2532
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2532-0-0x0000000000A40000-0x0000000000BA1000-memory.dmpFilesize
1.4MB
-
memory/2532-1-0x0000000000A40000-0x0000000000BA1000-memory.dmpFilesize
1.4MB
-
memory/2532-2-0x0000000000A40000-0x0000000000BA1000-memory.dmpFilesize
1.4MB
-
memory/2532-3-0x0000000000A40000-0x0000000000BA1000-memory.dmpFilesize
1.4MB
-
memory/2532-4-0x0000000000A40000-0x0000000000BA1000-memory.dmpFilesize
1.4MB
-
memory/2532-5-0x0000000000A40000-0x0000000000BA1000-memory.dmpFilesize
1.4MB
-
memory/2532-6-0x0000000000A40000-0x0000000000BA1000-memory.dmpFilesize
1.4MB
-
memory/2532-7-0x0000000000A40000-0x0000000000BA1000-memory.dmpFilesize
1.4MB
-
memory/2532-8-0x0000000000A40000-0x0000000000BA1000-memory.dmpFilesize
1.4MB
-
memory/2532-9-0x0000000000A40000-0x0000000000BA1000-memory.dmpFilesize
1.4MB
-
memory/2532-10-0x0000000000A40000-0x0000000000BA1000-memory.dmpFilesize
1.4MB
-
memory/2532-11-0x0000000000A40000-0x0000000000BA1000-memory.dmpFilesize
1.4MB
-
memory/2532-12-0x0000000000A40000-0x0000000000BA1000-memory.dmpFilesize
1.4MB
-
memory/2532-13-0x0000000000A40000-0x0000000000BA1000-memory.dmpFilesize
1.4MB
-
memory/2532-14-0x0000000000A40000-0x0000000000BA1000-memory.dmpFilesize
1.4MB