Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24-01-2024 01:46
Behavioral task
behavioral1
Sample
711dbf9882ffb3ab958893b6f3380399.dll
Resource
win7-20231129-en
4 signatures
150 seconds
General
-
Target
711dbf9882ffb3ab958893b6f3380399.dll
-
Size
1.3MB
-
MD5
711dbf9882ffb3ab958893b6f3380399
-
SHA1
c7c196855a233cde7d25d5af1e143d56925fe5af
-
SHA256
4dd4f0b43a7b527a9ceb51742331ebbc9248d6b782d7db610c10e157b1e4bd08
-
SHA512
0d2c692986e4824fa88e5cc80d3480bbd6536b0335b4f38db5e2a5df19753071ca8f1fed790f04c0d8fb02d91e622e9d97caad9e537a047b4eee203ccb417e81
-
SSDEEP
24576:g8FG1zWtt288dOwB2R6PWv3C9nOHTNaj4e:TdctuvS9aTY
Malware Config
Extracted
Family
danabot
Botnet
4
C2
23.229.29.48:443
5.9.224.204:443
192.210.222.81:443
Attributes
-
embedded_hash
0E1A7A1479C37094441FA911262B322A
-
type
loader
rsa_pubkey.plain
rsa_privkey.plain
Signatures
-
Danabot Loader Component 14 IoCs
Processes:
resource yara_rule behavioral2/memory/3132-0-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/3132-1-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/3132-2-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/3132-3-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/3132-4-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/3132-5-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/3132-6-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/3132-7-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/3132-8-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/3132-9-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/3132-10-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/3132-11-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/3132-12-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 behavioral2/memory/3132-13-0x0000000000400000-0x0000000000560000-memory.dmp DanabotLoader2021 -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 6 3132 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4400 wrote to memory of 3132 4400 rundll32.exe rundll32.exe PID 4400 wrote to memory of 3132 4400 rundll32.exe rundll32.exe PID 4400 wrote to memory of 3132 4400 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\711dbf9882ffb3ab958893b6f3380399.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\711dbf9882ffb3ab958893b6f3380399.dll,#12⤵
- Blocklisted process makes network request
PID:3132
-