Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
24-01-2024 01:46
Behavioral task
behavioral1
Sample
711dbf9882ffb3ab958893b6f3380399.dll
Resource
win7-20231129-en
4 signatures
150 seconds
General
-
Target
711dbf9882ffb3ab958893b6f3380399.dll
-
Size
1.3MB
-
MD5
711dbf9882ffb3ab958893b6f3380399
-
SHA1
c7c196855a233cde7d25d5af1e143d56925fe5af
-
SHA256
4dd4f0b43a7b527a9ceb51742331ebbc9248d6b782d7db610c10e157b1e4bd08
-
SHA512
0d2c692986e4824fa88e5cc80d3480bbd6536b0335b4f38db5e2a5df19753071ca8f1fed790f04c0d8fb02d91e622e9d97caad9e537a047b4eee203ccb417e81
-
SSDEEP
24576:g8FG1zWtt288dOwB2R6PWv3C9nOHTNaj4e:TdctuvS9aTY
Malware Config
Extracted
Family
danabot
Botnet
4
C2
23.229.29.48:443
5.9.224.204:443
192.210.222.81:443
Attributes
-
embedded_hash
0E1A7A1479C37094441FA911262B322A
-
type
loader
rsa_pubkey.plain
rsa_privkey.plain
Signatures
-
Danabot Loader Component 15 IoCs
Processes:
resource yara_rule behavioral1/memory/2376-0-0x0000000001FD0000-0x0000000002130000-memory.dmp DanabotLoader2021 behavioral1/memory/2376-1-0x0000000001FD0000-0x0000000002130000-memory.dmp DanabotLoader2021 behavioral1/memory/2376-2-0x0000000001FD0000-0x0000000002130000-memory.dmp DanabotLoader2021 behavioral1/memory/2376-3-0x0000000001FD0000-0x0000000002130000-memory.dmp DanabotLoader2021 behavioral1/memory/2376-4-0x0000000001FD0000-0x0000000002130000-memory.dmp DanabotLoader2021 behavioral1/memory/2376-5-0x0000000001FD0000-0x0000000002130000-memory.dmp DanabotLoader2021 behavioral1/memory/2376-6-0x0000000001FD0000-0x0000000002130000-memory.dmp DanabotLoader2021 behavioral1/memory/2376-7-0x0000000001FD0000-0x0000000002130000-memory.dmp DanabotLoader2021 behavioral1/memory/2376-8-0x0000000001FD0000-0x0000000002130000-memory.dmp DanabotLoader2021 behavioral1/memory/2376-9-0x0000000001FD0000-0x0000000002130000-memory.dmp DanabotLoader2021 behavioral1/memory/2376-10-0x0000000001FD0000-0x0000000002130000-memory.dmp DanabotLoader2021 behavioral1/memory/2376-11-0x0000000001FD0000-0x0000000002130000-memory.dmp DanabotLoader2021 behavioral1/memory/2376-12-0x0000000001FD0000-0x0000000002130000-memory.dmp DanabotLoader2021 behavioral1/memory/2376-13-0x0000000001FD0000-0x0000000002130000-memory.dmp DanabotLoader2021 behavioral1/memory/2376-14-0x0000000001FD0000-0x0000000002130000-memory.dmp DanabotLoader2021 -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 2 2376 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1704 wrote to memory of 2376 1704 rundll32.exe rundll32.exe PID 1704 wrote to memory of 2376 1704 rundll32.exe rundll32.exe PID 1704 wrote to memory of 2376 1704 rundll32.exe rundll32.exe PID 1704 wrote to memory of 2376 1704 rundll32.exe rundll32.exe PID 1704 wrote to memory of 2376 1704 rundll32.exe rundll32.exe PID 1704 wrote to memory of 2376 1704 rundll32.exe rundll32.exe PID 1704 wrote to memory of 2376 1704 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\711dbf9882ffb3ab958893b6f3380399.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\711dbf9882ffb3ab958893b6f3380399.dll,#12⤵
- Blocklisted process makes network request
PID:2376
-