Analysis
-
max time kernel
143s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
27-01-2024 01:08
Static task
static1
Behavioral task
behavioral1
Sample
78e1100d5a478ba8bb78ae8b2711a268.exe
Resource
win7-20231215-en
General
-
Target
78e1100d5a478ba8bb78ae8b2711a268.exe
-
Size
1.2MB
-
MD5
78e1100d5a478ba8bb78ae8b2711a268
-
SHA1
ed9b70d87b55d98b08c56cbce7a83174eac1324b
-
SHA256
40b64bbdb68d008b482daf0459702e6f9f81603a65ca47db258714e445106c9e
-
SHA512
ecdac0a9e3dc279697432af319a2c3b4f0031d0198b4fb501deea25281ca498529d7be553cc969eea28218dbccbf28d8921e2063202a92492a1e293c51a371d3
-
SSDEEP
24576:rQ5cNVldcfXb3xVmgLRkeAF2UMuxykg99iFKm6ZxGE/:tN3qtTLOhA9jkgGKm6/GE/
Malware Config
Extracted
danabot
4
142.11.244.124:443
142.11.206.50:443
-
embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB
-
type
loader
Signatures
-
Danabot Loader Component 11 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\78E110~1.TMP DanabotLoader2021 behavioral1/memory/2664-9-0x0000000001DA0000-0x0000000001EFD000-memory.dmp DanabotLoader2021 behavioral1/memory/2664-11-0x0000000001DA0000-0x0000000001EFD000-memory.dmp DanabotLoader2021 behavioral1/memory/2664-19-0x0000000001DA0000-0x0000000001EFD000-memory.dmp DanabotLoader2021 behavioral1/memory/2664-20-0x0000000001DA0000-0x0000000001EFD000-memory.dmp DanabotLoader2021 behavioral1/memory/2664-21-0x0000000001DA0000-0x0000000001EFD000-memory.dmp DanabotLoader2021 behavioral1/memory/2664-22-0x0000000001DA0000-0x0000000001EFD000-memory.dmp DanabotLoader2021 behavioral1/memory/2664-23-0x0000000001DA0000-0x0000000001EFD000-memory.dmp DanabotLoader2021 behavioral1/memory/2664-24-0x0000000001DA0000-0x0000000001EFD000-memory.dmp DanabotLoader2021 behavioral1/memory/2664-25-0x0000000001DA0000-0x0000000001EFD000-memory.dmp DanabotLoader2021 behavioral1/memory/2664-26-0x0000000001DA0000-0x0000000001EFD000-memory.dmp DanabotLoader2021 -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 2 2664 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 2664 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
78e1100d5a478ba8bb78ae8b2711a268.exedescription pid process target process PID 2464 wrote to memory of 2664 2464 78e1100d5a478ba8bb78ae8b2711a268.exe rundll32.exe PID 2464 wrote to memory of 2664 2464 78e1100d5a478ba8bb78ae8b2711a268.exe rundll32.exe PID 2464 wrote to memory of 2664 2464 78e1100d5a478ba8bb78ae8b2711a268.exe rundll32.exe PID 2464 wrote to memory of 2664 2464 78e1100d5a478ba8bb78ae8b2711a268.exe rundll32.exe PID 2464 wrote to memory of 2664 2464 78e1100d5a478ba8bb78ae8b2711a268.exe rundll32.exe PID 2464 wrote to memory of 2664 2464 78e1100d5a478ba8bb78ae8b2711a268.exe rundll32.exe PID 2464 wrote to memory of 2664 2464 78e1100d5a478ba8bb78ae8b2711a268.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78e1100d5a478ba8bb78ae8b2711a268.exe"C:\Users\Admin\AppData\Local\Temp\78e1100d5a478ba8bb78ae8b2711a268.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\78E110~1.TMP,S C:\Users\Admin\AppData\Local\Temp\78E110~1.EXE2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2664
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5b9a8bd9ca486ff5a2f6a2cb374d597e8
SHA1b564cc3511ac97752eac4758244f7c25e73cf1ee
SHA256ac1b8a84c6fa2132007b1f4baa9449b6d468068610b9f6900332ac342221fcbe
SHA512d3146c825e821feb3a9428f43fc042f0c04cae55db61ccc579005e728b937c16e131013e1eb21c331645a60ec7b93e9a2886fbb3cf0d7f4d40fa4628c157e056