Analysis
-
max time kernel
144s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29-12-2023 20:58
Static task
static1
Behavioral task
behavioral1
Sample
03d23020b94565d3a02bde11482ed62b.exe
Resource
win7-20231215-en
General
-
Target
03d23020b94565d3a02bde11482ed62b.exe
-
Size
1.2MB
-
MD5
03d23020b94565d3a02bde11482ed62b
-
SHA1
7cc54dc55bead3adf2d3edd624c7a5b1025fc12d
-
SHA256
750e38bbaba907ed33434c5a10119773f1d73dba4d6c624d16bc1bc2dfacac46
-
SHA512
b007e40d0c02a1997274bc3153250a26b59cac088a23e5c099924ecd2fc2cc233d3debc99630262e3b101b4d6e6f6fd197a60ed4f22a9aef1e14e77a010f71f4
-
SSDEEP
24576:Vdx2SrvqQhaER4cffei4zHkOuBpElF1GBGVn5yX8/a7/68O:kaqkaQB4zHkdEdGBGVYXc4w
Malware Config
Extracted
danabot
4
142.11.206.50:443
142.11.244.124:443
-
embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB
-
type
loader
Extracted
danabot
142.11.206.50:443
142.11.244.124:443
-
type
loader
Signatures
-
Danabot Loader Component 11 IoCs
Processes:
resource yara_rule behavioral1/files/0x000a000000012243-6.dat DanabotLoader2021 behavioral1/memory/2280-10-0x00000000007F0000-0x000000000094E000-memory.dmp DanabotLoader2021 behavioral1/files/0x000a000000012243-7.dat DanabotLoader2021 behavioral1/memory/2280-11-0x00000000007F0000-0x000000000094E000-memory.dmp DanabotLoader2021 behavioral1/memory/2280-19-0x00000000007F0000-0x000000000094E000-memory.dmp DanabotLoader2021 behavioral1/memory/2280-20-0x00000000007F0000-0x000000000094E000-memory.dmp DanabotLoader2021 behavioral1/memory/2280-21-0x00000000007F0000-0x000000000094E000-memory.dmp DanabotLoader2021 behavioral1/memory/2280-22-0x00000000007F0000-0x000000000094E000-memory.dmp DanabotLoader2021 behavioral1/memory/2280-23-0x00000000007F0000-0x000000000094E000-memory.dmp DanabotLoader2021 behavioral1/memory/2280-24-0x00000000007F0000-0x000000000094E000-memory.dmp DanabotLoader2021 behavioral1/memory/2280-26-0x00000000007F0000-0x000000000094E000-memory.dmp DanabotLoader2021 -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid Process 2 2280 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid Process 2280 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
03d23020b94565d3a02bde11482ed62b.exedescription pid Process procid_target PID 2008 wrote to memory of 2280 2008 03d23020b94565d3a02bde11482ed62b.exe 28 PID 2008 wrote to memory of 2280 2008 03d23020b94565d3a02bde11482ed62b.exe 28 PID 2008 wrote to memory of 2280 2008 03d23020b94565d3a02bde11482ed62b.exe 28 PID 2008 wrote to memory of 2280 2008 03d23020b94565d3a02bde11482ed62b.exe 28 PID 2008 wrote to memory of 2280 2008 03d23020b94565d3a02bde11482ed62b.exe 28 PID 2008 wrote to memory of 2280 2008 03d23020b94565d3a02bde11482ed62b.exe 28 PID 2008 wrote to memory of 2280 2008 03d23020b94565d3a02bde11482ed62b.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\03d23020b94565d3a02bde11482ed62b.exe"C:\Users\Admin\AppData\Local\Temp\03d23020b94565d3a02bde11482ed62b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\03D230~1.TMP,S C:\Users\Admin\AppData\Local\Temp\03D230~1.EXE2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2280
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD51d5fb88496f8c54153637c6358202524
SHA1e9cb6de55a7a8310cc7c19dac51f963473df5f79
SHA2564862830e93a4663607952a6e361781afda4c2aa53deb12362c3e86fc2bc082c2
SHA512b5a77950a2e3335799d233baf7433b7420c6cba73963734632d47c352a7c51b1537f8a380b69d3e69d3ed34c8176a193e768f3992077a7e5bded47bb71c0903c
-
Filesize
891KB
MD5b4f3e3c7acb52abeb3952bba697ea3d4
SHA10bd4a3090f8951fa0d583f20fe0a8ff2b35dd319
SHA2561774d31ac43c5e021849d9d5a842a176d801d6770b72a6583e6bc43e07437eac
SHA512a254c2e90b22cc07f209412f2a3d08de477814905cc91e28c691fcdb75e3a0ac94121de76ea78644f6ac24b83b551f03dddbc97402a15b770cac9545780e3eb9