Analysis
-
max time kernel
150s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2023 23:09
Behavioral task
behavioral1
Sample
0685f34419e39fcebed390154a3e5a4d.dll
Resource
win7-20231129-en
0 signatures
150 seconds
General
-
Target
0685f34419e39fcebed390154a3e5a4d.dll
-
Size
1.3MB
-
MD5
0685f34419e39fcebed390154a3e5a4d
-
SHA1
fffa2ebd384326c0ed877c6e76e4f39e3697815f
-
SHA256
fea581925276e9c239d0ab69f9fbf40eb8b0e5a4f9db933ac157db58420b3c25
-
SHA512
59193c497b6a89ad02a8ef6dcf11f7f2745db49c861ec9b0bcc5e65db476e81124a1334618e055a56f46d4ac1b8cc2b97df74505d874bfd558203883f9f0458a
-
SSDEEP
24576:DcF21NPB4mtmVpyQubtiP5hpVZ4289QTKDr:oLubAhx8KTO
Malware Config
Extracted
Family
danabot
Botnet
4
C2
23.229.29.48:443
5.9.224.204:443
192.210.222.81:443
Attributes
-
embedded_hash
0E1A7A1479C37094441FA911262B322A
-
type
loader
rsa_pubkey.plain
rsa_privkey.plain
Signatures
-
Danabot Loader Component 14 IoCs
Processes:
resource yara_rule behavioral2/memory/4088-0-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 behavioral2/memory/4088-1-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 behavioral2/memory/4088-2-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 behavioral2/memory/4088-3-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 behavioral2/memory/4088-4-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 behavioral2/memory/4088-5-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 behavioral2/memory/4088-6-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 behavioral2/memory/4088-7-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 behavioral2/memory/4088-8-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 behavioral2/memory/4088-9-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 behavioral2/memory/4088-10-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 behavioral2/memory/4088-11-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 behavioral2/memory/4088-12-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 behavioral2/memory/4088-13-0x0000000000400000-0x0000000000561000-memory.dmp DanabotLoader2021 -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid Process 14 4088 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid Process procid_target PID 4888 wrote to memory of 4088 4888 rundll32.exe 18 PID 4888 wrote to memory of 4088 4888 rundll32.exe 18 PID 4888 wrote to memory of 4088 4888 rundll32.exe 18
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0685f34419e39fcebed390154a3e5a4d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0685f34419e39fcebed390154a3e5a4d.dll,#12⤵
- Blocklisted process makes network request
PID:4088
-