Analysis
-
max time kernel
160s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01-01-2024 09:54
Behavioral task
behavioral1
Sample
1e1616ac16e7015b0a14e174b2dfe94e.dll
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
General
-
Target
1e1616ac16e7015b0a14e174b2dfe94e.dll
-
Size
1.3MB
-
MD5
1e1616ac16e7015b0a14e174b2dfe94e
-
SHA1
3b640c7df4eec6c1711b36a60dffe575be0b9a79
-
SHA256
f301dfbb7b19c488f8457733d8cce8403814fd518984a0470e963a060bd86b17
-
SHA512
58ed9d585037bd48446336a1d60f29bee5acf02a5cdac791e102f6178664fdef6c16abb658a46cecc9fb93b8ae020864ad7f043f7892ebc9c738cf10f6af3470
-
SSDEEP
24576:RcF2ddLBEH/yuGeb3+yPbduheDDx0OJ1nTPWi+D:SQ3yhugD7Tu5D
Malware Config
Extracted
Family
danabot
Botnet
4
C2
104.168.148.6:443
5.9.224.204:443
192.210.222.81:443
23.229.29.48:443
Attributes
-
embedded_hash
0E1A7A1479C37094441FA911262B322A
-
type
loader
rsa_pubkey.plain
rsa_privkey.plain
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 49 2684 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2576 wrote to memory of 2684 2576 rundll32.exe 91 PID 2576 wrote to memory of 2684 2576 rundll32.exe 91 PID 2576 wrote to memory of 2684 2576 rundll32.exe 91
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1e1616ac16e7015b0a14e174b2dfe94e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1e1616ac16e7015b0a14e174b2dfe94e.dll,#12⤵
- Blocklisted process makes network request
PID:2684
-