Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25-12-2023 08:25
Static task
static1
Behavioral task
behavioral1
Sample
11e11143ef5713077396f32f3fafd109.exe
Resource
win7-20231129-en
General
-
Target
11e11143ef5713077396f32f3fafd109.exe
-
Size
1.2MB
-
MD5
11e11143ef5713077396f32f3fafd109
-
SHA1
d2d8950d848129ab460439d3e4a0615f5f2d10c3
-
SHA256
0d6b46f8c96f69555ad79d7fdfd91c2eb24e3baa5b89dea1b3a024f28cb40be7
-
SHA512
92afb5046efb98ea7d930132481226eb8ad6250b363d670450c0e972e1253a59d958df7a4fffb99d20017bae4246b5a86fa03bf9865a2da155e1d03e9bbb3fc9
-
SSDEEP
24576:NLmxtn8xbSdKS1c6x62DAHzisGqQLlrwAta5Hsr8Ft5M6:Nw8xbEdx6sH9LlUAtaRnn
Malware Config
Extracted
danabot
4
142.11.244.124:443
142.11.206.50:443
-
embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB
-
type
loader
Signatures
-
Danabot Loader Component 12 IoCs
Processes:
resource yara_rule behavioral1/memory/2928-10-0x0000000001EE0000-0x000000000203F000-memory.dmp DanabotLoader2021 behavioral1/files/0x000b0000000133a9-9.dat DanabotLoader2021 behavioral1/files/0x000b0000000133a9-8.dat DanabotLoader2021 behavioral1/memory/2928-11-0x0000000001EE0000-0x000000000203F000-memory.dmp DanabotLoader2021 behavioral1/memory/2928-19-0x0000000001EE0000-0x000000000203F000-memory.dmp DanabotLoader2021 behavioral1/memory/2928-20-0x0000000001EE0000-0x000000000203F000-memory.dmp DanabotLoader2021 behavioral1/memory/2928-21-0x0000000001EE0000-0x000000000203F000-memory.dmp DanabotLoader2021 behavioral1/memory/2928-22-0x0000000001EE0000-0x000000000203F000-memory.dmp DanabotLoader2021 behavioral1/memory/2928-23-0x0000000001EE0000-0x000000000203F000-memory.dmp DanabotLoader2021 behavioral1/memory/2928-24-0x0000000001EE0000-0x000000000203F000-memory.dmp DanabotLoader2021 behavioral1/memory/2928-25-0x0000000001EE0000-0x000000000203F000-memory.dmp DanabotLoader2021 behavioral1/memory/2928-26-0x0000000001EE0000-0x000000000203F000-memory.dmp DanabotLoader2021 -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid Process 2 2928 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid Process 2928 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
11e11143ef5713077396f32f3fafd109.exedescription pid Process procid_target PID 2540 wrote to memory of 2928 2540 11e11143ef5713077396f32f3fafd109.exe 28 PID 2540 wrote to memory of 2928 2540 11e11143ef5713077396f32f3fafd109.exe 28 PID 2540 wrote to memory of 2928 2540 11e11143ef5713077396f32f3fafd109.exe 28 PID 2540 wrote to memory of 2928 2540 11e11143ef5713077396f32f3fafd109.exe 28 PID 2540 wrote to memory of 2928 2540 11e11143ef5713077396f32f3fafd109.exe 28 PID 2540 wrote to memory of 2928 2540 11e11143ef5713077396f32f3fafd109.exe 28 PID 2540 wrote to memory of 2928 2540 11e11143ef5713077396f32f3fafd109.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\11e11143ef5713077396f32f3fafd109.exe"C:\Users\Admin\AppData\Local\Temp\11e11143ef5713077396f32f3fafd109.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\11E111~1.TMP,S C:\Users\Admin\AppData\Local\Temp\11E111~1.EXE2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2928
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
513KB
MD521bc951bb3622f95cebf80464c71286b
SHA12c8f207f0df9e5a32674d17af1a2ae1be0dfba80
SHA256bb9993ce772f7c807badecb9603888e2132802b921fc2b891e33b8681bf7b77e
SHA5121f7e63047afb6f92168bd8af4df758964900f47ab85766fbbe0cb94331acbada571eac203aebca4a9af58ae738fc67f9b8ec15d5f14a8dd6903c96502a7363a4
-
Filesize
557KB
MD57d61f2ca230c1ff71df9e821546f7d44
SHA1b094384aa29941f3bade73c47448010811244292
SHA2561ac78f25475a8bc00296359c6cb0aff557c635a73d974071b4c7df4669c2de53
SHA512ec0cadf68476b4d53d2f45ee302210d7dfbf35b7e6bbb61cd48c18b59933340b22725e26d4cf1cb532036620160b6d47d551ae60b33e9b9d7b87de9997854cac