Analysis
-
max time kernel
165s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2023 20:58
Static task
static1
Behavioral task
behavioral1
Sample
03d23020b94565d3a02bde11482ed62b.exe
Resource
win7-20231215-en
General
-
Target
03d23020b94565d3a02bde11482ed62b.exe
-
Size
1.2MB
-
MD5
03d23020b94565d3a02bde11482ed62b
-
SHA1
7cc54dc55bead3adf2d3edd624c7a5b1025fc12d
-
SHA256
750e38bbaba907ed33434c5a10119773f1d73dba4d6c624d16bc1bc2dfacac46
-
SHA512
b007e40d0c02a1997274bc3153250a26b59cac088a23e5c099924ecd2fc2cc233d3debc99630262e3b101b4d6e6f6fd197a60ed4f22a9aef1e14e77a010f71f4
-
SSDEEP
24576:Vdx2SrvqQhaER4cffei4zHkOuBpElF1GBGVn5yX8/a7/68O:kaqkaQB4zHkdEdGBGVYXc4w
Malware Config
Extracted
danabot
4
142.11.206.50:443
142.11.244.124:443
-
embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB
-
type
loader
Signatures
-
Danabot Loader Component 10 IoCs
Processes:
resource yara_rule behavioral2/files/0x0009000000022480-6.dat DanabotLoader2021 behavioral2/memory/2480-10-0x0000000000400000-0x000000000055E000-memory.dmp DanabotLoader2021 behavioral2/memory/2480-20-0x0000000000400000-0x000000000055E000-memory.dmp DanabotLoader2021 behavioral2/memory/2480-21-0x0000000000400000-0x000000000055E000-memory.dmp DanabotLoader2021 behavioral2/memory/2480-22-0x0000000000400000-0x000000000055E000-memory.dmp DanabotLoader2021 behavioral2/memory/2480-23-0x0000000000400000-0x000000000055E000-memory.dmp DanabotLoader2021 behavioral2/memory/2480-24-0x0000000000400000-0x000000000055E000-memory.dmp DanabotLoader2021 behavioral2/memory/2480-25-0x0000000000400000-0x000000000055E000-memory.dmp DanabotLoader2021 behavioral2/memory/2480-26-0x0000000000400000-0x000000000055E000-memory.dmp DanabotLoader2021 behavioral2/memory/2480-27-0x0000000000400000-0x000000000055E000-memory.dmp DanabotLoader2021 -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid Process 63 2480 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid Process 2480 rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 3668 4696 WerFault.exe 88 -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
03d23020b94565d3a02bde11482ed62b.exedescription pid Process procid_target PID 4696 wrote to memory of 2480 4696 03d23020b94565d3a02bde11482ed62b.exe 91 PID 4696 wrote to memory of 2480 4696 03d23020b94565d3a02bde11482ed62b.exe 91 PID 4696 wrote to memory of 2480 4696 03d23020b94565d3a02bde11482ed62b.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\03d23020b94565d3a02bde11482ed62b.exe"C:\Users\Admin\AppData\Local\Temp\03d23020b94565d3a02bde11482ed62b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\03D230~1.TMP,S C:\Users\Admin\AppData\Local\Temp\03D230~1.EXE2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2480
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 5202⤵
- Program crash
PID:3668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4696 -ip 46961⤵PID:3076
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD51d5fb88496f8c54153637c6358202524
SHA1e9cb6de55a7a8310cc7c19dac51f963473df5f79
SHA2564862830e93a4663607952a6e361781afda4c2aa53deb12362c3e86fc2bc082c2
SHA512b5a77950a2e3335799d233baf7433b7420c6cba73963734632d47c352a7c51b1537f8a380b69d3e69d3ed34c8176a193e768f3992077a7e5bded47bb71c0903c