Analysis
-
max time kernel
142s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2023 05:17
Behavioral task
behavioral1
Sample
0fcc4763a20cb1ccf916ea84354c4e83.dll
Resource
win7-20231215-en
0 signatures
150 seconds
General
-
Target
0fcc4763a20cb1ccf916ea84354c4e83.dll
-
Size
1.3MB
-
MD5
0fcc4763a20cb1ccf916ea84354c4e83
-
SHA1
14b0f142ec9d13ca3355b6fd80ecfdd95c5fc34c
-
SHA256
349af157ac826dbc7c354a25d592d9eed06eb6d60e270c1f40102b55c90797dd
-
SHA512
2604e433c44bc67b478197d1460db3122e1dccfceb38eba4b91d68bff75580c06168c9b464c1134467ea4d1f458161eabc0a4f161e5cd6d58ba08c9b2ad2c348
-
SSDEEP
24576:L8pWEmDXswcrLEEcQ1fObM5HqTgNmsBdBTWnrO:QtSzeTBdBTq
Malware Config
Extracted
Family
danabot
Botnet
4
C2
23.229.29.48:443
5.9.224.204:443
192.210.222.81:443
Attributes
-
embedded_hash
0E1A7A1479C37094441FA911262B322A
-
type
loader
rsa_pubkey.plain
rsa_privkey.plain
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid Process 5 456 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid Process procid_target PID 3324 wrote to memory of 456 3324 rundll32.exe 89 PID 3324 wrote to memory of 456 3324 rundll32.exe 89 PID 3324 wrote to memory of 456 3324 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0fcc4763a20cb1ccf916ea84354c4e83.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0fcc4763a20cb1ccf916ea84354c4e83.dll,#12⤵
- Blocklisted process makes network request
PID:456
-