Analysis
-
max time kernel
141s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
27-12-2023 13:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b19b5a3a677dfb6eb3c6c88bc14328f0.exe
Resource
win7-20231215-en
5 signatures
150 seconds
General
-
Target
b19b5a3a677dfb6eb3c6c88bc14328f0.exe
-
Size
1.1MB
-
MD5
b19b5a3a677dfb6eb3c6c88bc14328f0
-
SHA1
4157b1958b28e24e58cd614c2aa53c20f61d3001
-
SHA256
a4b1ad9683d5208a4cef9cd3aa5a055007e88d9f712163ea599feb23f6f43e0c
-
SHA512
3aae34b63f475a412a3d322cbcbc7da3255079000b6e84a76dbacd8b10d850667e735a45030e839e711b0e5585103814c223bddf70c50c85cac1fdd6c86be09e
-
SSDEEP
24576:5Gsv7UJ0yshakeJYM69TU93f3PaCSMtvBWoLnbrac:JZysBeGPlU9v3PaFMt0+nb
Malware Config
Extracted
Family
danabot
Botnet
4
C2
142.11.244.124:443
142.11.206.50:443
Attributes
-
embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB
-
type
loader
rsa_pubkey.plain
rsa_privkey.plain
Signatures
-
Danabot Loader Component 10 IoCs
Processes:
resource yara_rule behavioral1/memory/2036-10-0x0000000000990000-0x0000000000AEF000-memory.dmp DanabotLoader2021 behavioral1/memory/2036-11-0x0000000000990000-0x0000000000AEF000-memory.dmp DanabotLoader2021 behavioral1/memory/2036-19-0x0000000000990000-0x0000000000AEF000-memory.dmp DanabotLoader2021 behavioral1/memory/2036-20-0x0000000000990000-0x0000000000AEF000-memory.dmp DanabotLoader2021 behavioral1/memory/2036-21-0x0000000000990000-0x0000000000AEF000-memory.dmp DanabotLoader2021 behavioral1/memory/2036-22-0x0000000000990000-0x0000000000AEF000-memory.dmp DanabotLoader2021 behavioral1/memory/2036-23-0x0000000000990000-0x0000000000AEF000-memory.dmp DanabotLoader2021 behavioral1/memory/2036-24-0x0000000000990000-0x0000000000AEF000-memory.dmp DanabotLoader2021 behavioral1/memory/2036-25-0x0000000000990000-0x0000000000AEF000-memory.dmp DanabotLoader2021 behavioral1/memory/2036-26-0x0000000000990000-0x0000000000AEF000-memory.dmp DanabotLoader2021 -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid Process 2 2036 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid Process 2036 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
b19b5a3a677dfb6eb3c6c88bc14328f0.exedescription pid Process procid_target PID 2688 wrote to memory of 2036 2688 b19b5a3a677dfb6eb3c6c88bc14328f0.exe 28 PID 2688 wrote to memory of 2036 2688 b19b5a3a677dfb6eb3c6c88bc14328f0.exe 28 PID 2688 wrote to memory of 2036 2688 b19b5a3a677dfb6eb3c6c88bc14328f0.exe 28 PID 2688 wrote to memory of 2036 2688 b19b5a3a677dfb6eb3c6c88bc14328f0.exe 28 PID 2688 wrote to memory of 2036 2688 b19b5a3a677dfb6eb3c6c88bc14328f0.exe 28 PID 2688 wrote to memory of 2036 2688 b19b5a3a677dfb6eb3c6c88bc14328f0.exe 28 PID 2688 wrote to memory of 2036 2688 b19b5a3a677dfb6eb3c6c88bc14328f0.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\b19b5a3a677dfb6eb3c6c88bc14328f0.exe"C:\Users\Admin\AppData\Local\Temp\b19b5a3a677dfb6eb3c6c88bc14328f0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\B19B5A~1.TMP,S C:\Users\Admin\AppData\Local\Temp\B19B5A~1.EXE2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2036
-