Analysis Overview
SHA256
f5fe7311025d620bccb08dcfb69f03c71620351b35ea8635b798ffc62374423a
Threat Level: Known bad
The file 10f49a80de7e85fa33959da15d393f29 was found to be: Known bad.
Malicious Activity Summary
Danabot
Blocklisted process makes network request
Loads dropped DLL
Program crash
Unsigned PE
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2023-12-30 06:22
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-12-30 06:22
Reported
2023-12-31 03:17
Platform
win7-20231215-en
Max time kernel
141s
Max time network
121s
Command Line
Signatures
Danabot
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\10f49a80de7e85fa33959da15d393f29.exe
"C:\Users\Admin\AppData\Local\Temp\10f49a80de7e85fa33959da15d393f29.exe"
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\10F49A~1.TMP,S C:\Users\Admin\AppData\Local\Temp\10F49A~1.EXE
Network
| Country | Destination | Domain | Proto |
| US | 142.11.244.124:443 | tcp |
Files
memory/2128-0-0x0000000002E10000-0x0000000002EF9000-memory.dmp
memory/2128-2-0x0000000002F30000-0x000000000302E000-memory.dmp
memory/2368-9-0x0000000000B00000-0x0000000000C5C000-memory.dmp
memory/2128-7-0x0000000000400000-0x00000000014F1000-memory.dmp
memory/2128-5-0x0000000000400000-0x00000000014F1000-memory.dmp
memory/2128-1-0x0000000002E10000-0x0000000002EF9000-memory.dmp
memory/2368-10-0x0000000000B00000-0x0000000000C5C000-memory.dmp
memory/2368-18-0x0000000000B00000-0x0000000000C5C000-memory.dmp
memory/2368-19-0x0000000000B00000-0x0000000000C5C000-memory.dmp
memory/2368-20-0x0000000000B00000-0x0000000000C5C000-memory.dmp
memory/2368-21-0x0000000000B00000-0x0000000000C5C000-memory.dmp
memory/2368-22-0x0000000000B00000-0x0000000000C5C000-memory.dmp
memory/2368-23-0x0000000000B00000-0x0000000000C5C000-memory.dmp
memory/2368-24-0x0000000000B00000-0x0000000000C5C000-memory.dmp
memory/2368-25-0x0000000000B00000-0x0000000000C5C000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-12-30 06:22
Reported
2023-12-31 03:17
Platform
win10v2004-20231222-en
Max time kernel
147s
Max time network
149s
Command Line
Signatures
Danabot
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\10f49a80de7e85fa33959da15d393f29.exe |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1036 wrote to memory of 4404 | N/A | C:\Users\Admin\AppData\Local\Temp\10f49a80de7e85fa33959da15d393f29.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 1036 wrote to memory of 4404 | N/A | C:\Users\Admin\AppData\Local\Temp\10f49a80de7e85fa33959da15d393f29.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 1036 wrote to memory of 4404 | N/A | C:\Users\Admin\AppData\Local\Temp\10f49a80de7e85fa33959da15d393f29.exe | C:\Windows\SysWOW64\rundll32.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\10f49a80de7e85fa33959da15d393f29.exe
"C:\Users\Admin\AppData\Local\Temp\10f49a80de7e85fa33959da15d393f29.exe"
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\10F49A~1.TMP,S C:\Users\Admin\AppData\Local\Temp\10F49A~1.EXE
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1036 -ip 1036
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 500
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.200:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 146.78.124.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.181.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| GB | 88.221.134.50:80 | tcp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 20.12.23.50:443 | tcp | |
| N/A | 20.12.23.50:443 | tcp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 13.85.23.206:443 | tcp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 20.82.228.9:443 | tcp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 20.12.23.50:443 | tcp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 20.12.23.50:443 | tcp | |
| N/A | 20.231.121.79:80 | tcp | |
| N/A | 20.190.181.5:443 | tcp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 51.104.136.2:443 | tcp | |
| N/A | 88.221.134.18:80 | tcp | |
| N/A | 51.104.136.2:443 | tcp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 20.123.104.105:443 | tcp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 96.16.110.41:443 | tcp | |
| US | 192.229.221.95:80 | tcp | |
| N/A | 20.123.104.105:443 | tcp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 20.82.228.9:443 | tcp | |
| N/A | 20.12.23.50:443 | tcp | |
| N/A | 20.12.23.50:443 | tcp | |
| N/A | 13.85.23.206:443 | tcp | |
| US | 93.184.221.240:80 | tcp | |
| US | 93.184.221.240:80 | tcp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 142.11.244.124:443 | tcp | |
| N/A | 92.123.241.104:80 | tcp | |
| N/A | 92.123.241.104:80 | tcp | |
| N/A | 20.123.104.105:443 | tcp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 20.54.110.119:443 | tcp | |
| N/A | 13.85.23.206:443 | tcp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 20.223.36.55:443 | tcp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| GB | 88.221.135.217:80 | tcp | |
| GB | 88.221.135.217:80 | tcp | |
| GB | 88.221.135.217:80 | tcp | |
| GB | 88.221.135.217:80 | tcp | |
| US | 8.8.8.8:53 | udp | |
| US | 93.184.221.240:80 | tcp | |
| US | 93.184.221.240:80 | tcp | |
| US | 93.184.221.240:80 | tcp | |
| US | 93.184.221.240:80 | tcp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| GB | 88.221.135.217:80 | tcp | |
| GB | 88.221.135.217:80 | tcp | |
| US | 93.184.221.240:80 | tcp | |
| US | 93.184.221.240:80 | tcp | |
| GB | 88.221.134.50:80 | tcp | |
| GB | 88.221.135.217:80 | tcp | |
| GB | 88.221.135.217:80 | tcp | |
| US | 93.184.221.240:80 | tcp | |
| US | 93.184.221.240:80 | tcp | |
| US | 8.8.8.8:53 | udp | |
| GB | 88.221.134.50:80 | tcp | |
| GB | 88.221.135.217:80 | tcp | |
| GB | 88.221.135.217:80 | tcp | |
| US | 8.8.8.8:53 | udp | |
| US | 93.184.221.240:80 | tcp | |
| IE | 52.111.236.23:443 | tcp | |
| US | 93.184.221.240:80 | tcp | |
| GB | 88.221.134.50:80 | tcp | |
| US | 8.8.8.8:53 | 23.236.111.52.in-addr.arpa | udp |
| GB | 88.221.134.50:80 | tcp | |
| GB | 88.221.134.50:80 | tcp | |
| GB | 88.221.134.50:80 | tcp | |
| GB | 88.221.134.50:80 | tcp | |
| GB | 88.221.134.50:80 | tcp | |
| GB | 88.221.134.50:80 | tcp | |
| GB | 88.221.134.50:80 | tcp | |
| GB | 88.221.134.50:80 | tcp | |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| GB | 88.221.134.50:80 | tcp | |
| GB | 88.221.134.50:80 | tcp | |
| GB | 88.221.134.50:80 | tcp | |
| GB | 88.221.134.50:80 | tcp | |
| GB | 88.221.134.50:80 | tcp | |
| GB | 88.221.134.50:80 | tcp | |
| GB | 88.221.134.50:80 | tcp | |
| GB | 88.221.134.50:80 | tcp | |
| GB | 88.221.134.50:80 | tcp | |
| GB | 88.221.135.217:80 | tcp | |
| US | 93.184.221.240:80 | tcp |
Files
memory/1036-2-0x0000000003390000-0x000000000348E000-memory.dmp
memory/1036-9-0x0000000000400000-0x00000000014F1000-memory.dmp
memory/4404-8-0x0000000002890000-0x00000000029EC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\10F49A~1.TMP
| MD5 | 7518820dd5c42075f95a0a499591a134 |
| SHA1 | cbb0656d169e70053e1348ba00ef9ccc88df15bf |
| SHA256 | 4c9ccc43c24ff66cbc2ce73b48aa709895518317e00aeca806890f3fb674a078 |
| SHA512 | cdd01869fea5102873ff72ae0de45037ce8bbfc662dc892c13da4ffd06a99602802f7d2e98d12c64501e73fbd28b050f048ec82f0a37a9d334a240825781b8b8 |
memory/1036-1-0x0000000003290000-0x0000000003385000-memory.dmp
memory/1036-11-0x0000000003390000-0x000000000348E000-memory.dmp
memory/1036-10-0x0000000000400000-0x00000000014F1000-memory.dmp
memory/4404-12-0x0000000002890000-0x00000000029EC000-memory.dmp
memory/4404-20-0x0000000002890000-0x00000000029EC000-memory.dmp
memory/4404-21-0x0000000002890000-0x00000000029EC000-memory.dmp
memory/4404-22-0x0000000002890000-0x00000000029EC000-memory.dmp
memory/4404-23-0x0000000002890000-0x00000000029EC000-memory.dmp
memory/4404-24-0x0000000002890000-0x00000000029EC000-memory.dmp
memory/4404-25-0x0000000002890000-0x00000000029EC000-memory.dmp
memory/4404-26-0x0000000002890000-0x00000000029EC000-memory.dmp
memory/4404-27-0x0000000002890000-0x00000000029EC000-memory.dmp