Analysis
-
max time kernel
143s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13/01/2024, 02:05
Static task
static1
Behavioral task
behavioral1
Sample
57b388d86cf9eeac704fc629587c82bd.exe
Resource
win7-20231129-en
General
-
Target
57b388d86cf9eeac704fc629587c82bd.exe
-
Size
1.2MB
-
MD5
57b388d86cf9eeac704fc629587c82bd
-
SHA1
75b34c11d1efdcc6763a8290880267c59f5e497c
-
SHA256
0ffddce470010278a1e5545d5c616def34d6c4b21ac1152a11de5aa48792fb77
-
SHA512
c791c6ce54d2a6d299675c5c3ad58aefd18e7bb89390d7a4997a6a0570e78f6a0fee20c2bf3f9b27c99c1abdc36a0e101238df130d3cce42425d431279c33a9a
-
SSDEEP
24576:BEXMeW1VIC29ja0qwyajfytMdDRdL8yBuSKj:u8ezrAwatMt7pBq
Malware Config
Extracted
danabot
4
142.11.244.124:443
142.11.206.50:443
-
embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB
-
type
loader
Signatures
-
Danabot Loader Component 13 IoCs
resource yara_rule behavioral2/files/0x0009000000023110-8.dat DanabotLoader2021 behavioral2/files/0x0009000000023110-7.dat DanabotLoader2021 behavioral2/memory/2916-9-0x00000000022A0000-0x00000000023FD000-memory.dmp DanabotLoader2021 behavioral2/files/0x0009000000023110-6.dat DanabotLoader2021 behavioral2/memory/2916-12-0x00000000022A0000-0x00000000023FD000-memory.dmp DanabotLoader2021 behavioral2/memory/2916-20-0x00000000022A0000-0x00000000023FD000-memory.dmp DanabotLoader2021 behavioral2/memory/2916-21-0x00000000022A0000-0x00000000023FD000-memory.dmp DanabotLoader2021 behavioral2/memory/2916-22-0x00000000022A0000-0x00000000023FD000-memory.dmp DanabotLoader2021 behavioral2/memory/2916-23-0x00000000022A0000-0x00000000023FD000-memory.dmp DanabotLoader2021 behavioral2/memory/2916-24-0x00000000022A0000-0x00000000023FD000-memory.dmp DanabotLoader2021 behavioral2/memory/2916-25-0x00000000022A0000-0x00000000023FD000-memory.dmp DanabotLoader2021 behavioral2/memory/2916-26-0x00000000022A0000-0x00000000023FD000-memory.dmp DanabotLoader2021 behavioral2/memory/2916-27-0x00000000022A0000-0x00000000023FD000-memory.dmp DanabotLoader2021 -
Blocklisted process makes network request 1 IoCs
flow pid Process 126 2916 rundll32.exe -
Loads dropped DLL 2 IoCs
pid Process 2916 rundll32.exe 2916 rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2872 4432 WerFault.exe 86 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4432 wrote to memory of 2916 4432 57b388d86cf9eeac704fc629587c82bd.exe 90 PID 4432 wrote to memory of 2916 4432 57b388d86cf9eeac704fc629587c82bd.exe 90 PID 4432 wrote to memory of 2916 4432 57b388d86cf9eeac704fc629587c82bd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\57b388d86cf9eeac704fc629587c82bd.exe"C:\Users\Admin\AppData\Local\Temp\57b388d86cf9eeac704fc629587c82bd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\57B388~1.TMP,S C:\Users\Admin\AppData\Local\Temp\57B388~1.EXE2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2916
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 4442⤵
- Program crash
PID:2872
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4432 -ip 44321⤵PID:4668
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
350KB
MD5f2d0fdbdab767884c38e3c15ae5736b6
SHA1b631a8e2e64ba57fce0bdc963ef63cec3d711442
SHA256734d92bc4d9b613b547e39a242ff618410730f2692d7cb0ec9f76fa431ee8a40
SHA5123b065a828bfde6f56295a1cdb78d7413c874ec33d9706c8cbedff9e7e40f4221a843b75202a9d15acd31457ff707d1e77f084814a6a57a182d401b0abfaf25e8
-
Filesize
269KB
MD5af08a6b94628324cd3b56a25be908f2c
SHA1560c4cb0e9bfb7b8e74780bf37cd578a82d0497c
SHA2568e512f8b421268324467095f1be77e128334fffc8fc3d259733c5955829b04cc
SHA51220105f04d5c78f23eaea8731e33c6e15f4aad78619ebbf04811ac8de11925b33a22d5de3b88b82b0ed7cd9653e2fbc33821313b7fe68d6d1f98eb85fef723721
-
Filesize
396KB
MD5c06388e5b83fc5aa83d133236129ce36
SHA18c3da4e1dd888b3f848062559691efc76682c014
SHA2563adf07abbb11dca5fb4726744b4aac4dda80cbddf2c0a937e0642e08d15396e9
SHA512e9fbd70e5e1225f1ed5989d13cb0172cb94fdc790788492cb664a59530de13f685650e180d68bdb8d652f98d95f3e489452d23b7341d4b8b3fb3fbb0fd615f0b