Analysis
-
max time kernel
144s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26-12-2023 06:19
Static task
static1
Behavioral task
behavioral1
Sample
592b072b05d4144f9e5242c8e9a1c88c.exe
Resource
win7-20231215-en
General
-
Target
592b072b05d4144f9e5242c8e9a1c88c.exe
-
Size
1.1MB
-
MD5
592b072b05d4144f9e5242c8e9a1c88c
-
SHA1
8294c8a81684a35a9a8e155788c2ccabad8b657c
-
SHA256
745ae9caf8a38023905ad52a4e81d085cef62fc4a14aacf2536c9e54cd1845f8
-
SHA512
9ee062e1380094efed830a46df76377d446a41f88c179a13a3b09bb47a145ebc5351dd02e3374d3d19de274dd0ddfdb0c11df18bc720ff171a478386eed2619a
-
SSDEEP
24576:vv2NFRfdDf+CRwEHhjLsWLcOeb9oQvU7/9EJojbfH0vZEr:mRf+Cy65My/KeHYu
Malware Config
Extracted
danabot
4
142.11.244.124:443
142.11.206.50:443
-
embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB
-
type
loader
Signatures
-
Danabot Loader Component 12 IoCs
Processes:
resource yara_rule behavioral1/files/0x000a00000001223b-8.dat DanabotLoader2021 behavioral1/files/0x000a00000001223b-9.dat DanabotLoader2021 behavioral1/memory/2132-10-0x00000000004C0000-0x000000000061E000-memory.dmp DanabotLoader2021 behavioral1/memory/2132-11-0x00000000004C0000-0x000000000061E000-memory.dmp DanabotLoader2021 behavioral1/memory/2132-19-0x00000000004C0000-0x000000000061E000-memory.dmp DanabotLoader2021 behavioral1/memory/2132-20-0x00000000004C0000-0x000000000061E000-memory.dmp DanabotLoader2021 behavioral1/memory/2132-21-0x00000000004C0000-0x000000000061E000-memory.dmp DanabotLoader2021 behavioral1/memory/2132-22-0x00000000004C0000-0x000000000061E000-memory.dmp DanabotLoader2021 behavioral1/memory/2132-23-0x00000000004C0000-0x000000000061E000-memory.dmp DanabotLoader2021 behavioral1/memory/2132-24-0x00000000004C0000-0x000000000061E000-memory.dmp DanabotLoader2021 behavioral1/memory/2132-25-0x00000000004C0000-0x000000000061E000-memory.dmp DanabotLoader2021 behavioral1/memory/2132-26-0x00000000004C0000-0x000000000061E000-memory.dmp DanabotLoader2021 -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid Process 2 2132 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid Process 2132 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
592b072b05d4144f9e5242c8e9a1c88c.exedescription pid Process procid_target PID 2864 wrote to memory of 2132 2864 592b072b05d4144f9e5242c8e9a1c88c.exe 28 PID 2864 wrote to memory of 2132 2864 592b072b05d4144f9e5242c8e9a1c88c.exe 28 PID 2864 wrote to memory of 2132 2864 592b072b05d4144f9e5242c8e9a1c88c.exe 28 PID 2864 wrote to memory of 2132 2864 592b072b05d4144f9e5242c8e9a1c88c.exe 28 PID 2864 wrote to memory of 2132 2864 592b072b05d4144f9e5242c8e9a1c88c.exe 28 PID 2864 wrote to memory of 2132 2864 592b072b05d4144f9e5242c8e9a1c88c.exe 28 PID 2864 wrote to memory of 2132 2864 592b072b05d4144f9e5242c8e9a1c88c.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\592b072b05d4144f9e5242c8e9a1c88c.exe"C:\Users\Admin\AppData\Local\Temp\592b072b05d4144f9e5242c8e9a1c88c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\592B07~1.TMP,S C:\Users\Admin\AppData\Local\Temp\592B07~1.EXE2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2132
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5256ee6d897dbf31efd367a29065225e4
SHA1e2fd1cf28cf045baf8395c0b6ee5d28f90a2c32a
SHA256aeb3ca99e7c60a6afd897bbba518124492c5e817404dd1a7b1d9165ae15cdf54
SHA512adfe7c35e7e3e2a5a83e3a8b1b87af4913299dfc2a0eac63036a3cc410c1eaaeea17121d38e850f2e3b8fe368f03c36382cf987fef5b9d2a8a28618b2f9e04fa
-
Filesize
382KB
MD5296a1b375f2502b8e6d4d5b6944ea730
SHA17ccc398a821d07774656018208f3b3264c92c909
SHA25653b01f4992d50751c0322643bb4ab5ccddd6f8fe0a97d5fba9164ff857495e65
SHA512c1eccd3bfc72542ba98110e02210d41ba63065191409df3ccaae729a2627250382eca48546e44062442be04e064326d4b35dc87f821d5203dea59ea610dfb45a