Analysis
-
max time kernel
143s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2023 21:15
Behavioral task
behavioral1
Sample
0434b9d361f32df5513f91db62bc006e.dll
Resource
win7-20231129-en
4 signatures
150 seconds
General
-
Target
0434b9d361f32df5513f91db62bc006e.dll
-
Size
1.3MB
-
MD5
0434b9d361f32df5513f91db62bc006e
-
SHA1
49f94407b152381365ebc70557d27bf1a78db8f0
-
SHA256
5a7d9141f874d8b518f85a38313d5c383b4673408b761cd5d2dae72002ea43ff
-
SHA512
aaa77bf043858b24028233e666929ebaf0580485cb0e8e76755045598f50ab2d8b4ce03c5802b35f7a879c96cd9ecf3abe6eda9cad430e2a55acb56ee997e3a3
-
SSDEEP
24576:I8FGzbpfUrM7FXFB4gJQcRtb7DWWzWHZv+69TSKflJ:bApJQcRJDBWHgKTf
Malware Config
Extracted
Family
danabot
Botnet
4
C2
23.229.29.48:443
5.9.224.204:443
192.210.222.81:443
Attributes
-
embedded_hash
0E1A7A1479C37094441FA911262B322A
-
type
loader
rsa_pubkey.plain
rsa_privkey.plain
Signatures
-
Danabot Loader Component 14 IoCs
Processes:
resource yara_rule behavioral2/memory/908-0-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/908-1-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/908-2-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/908-3-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/908-4-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/908-5-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/908-6-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/908-7-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/908-8-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/908-9-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/908-10-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/908-11-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/908-12-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/908-13-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid Process 9 908 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid Process procid_target PID 4956 wrote to memory of 908 4956 rundll32.exe 88 PID 4956 wrote to memory of 908 4956 rundll32.exe 88 PID 4956 wrote to memory of 908 4956 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0434b9d361f32df5513f91db62bc006e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0434b9d361f32df5513f91db62bc006e.dll,#12⤵
- Blocklisted process makes network request
PID:908
-