Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31-01-2024 10:16
Behavioral task
behavioral1
Sample
842590dc66c45ec2ea4413bce4f2ac93.dll
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
General
-
Target
842590dc66c45ec2ea4413bce4f2ac93.dll
-
Size
1.3MB
-
MD5
842590dc66c45ec2ea4413bce4f2ac93
-
SHA1
726a576fa262dacba66544ab59adfa611a750ec4
-
SHA256
1275d7423a7cf0935564aabda730f750a3e1bd362e965b8dfa8715af8ca417bd
-
SHA512
fa5fe384eac06c591e8d1aefaea7f167a65571bac5cc44b68359324951a4f518780e1fcff704de91811538e8b6d9fa5655803369544df78fa82bb0459c314551
-
SSDEEP
24576:kcF2VtrZmrDEtLk7Kd/FFdf+BawXHvJbSc9W07TR7McbtV:HzyFJ+3Sc9W07T5Mo
Malware Config
Extracted
Family
danabot
Botnet
4
C2
5.9.224.204:443
192.210.222.81:443
23.229.29.48:443
Attributes
-
embedded_hash
0E1A7A1479C37094441FA911262B322A
-
type
loader
rsa_pubkey.plain
rsa_privkey.plain
Signatures
-
Danabot Loader Component 15 IoCs
Processes:
resource yara_rule behavioral2/memory/3008-0-0x0000000002210000-0x0000000002371000-memory.dmp DanabotLoader2021 behavioral2/memory/3008-1-0x0000000002210000-0x0000000002371000-memory.dmp DanabotLoader2021 behavioral2/memory/3008-2-0x0000000002210000-0x0000000002371000-memory.dmp DanabotLoader2021 behavioral2/memory/3008-3-0x0000000002210000-0x0000000002371000-memory.dmp DanabotLoader2021 behavioral2/memory/3008-4-0x0000000002210000-0x0000000002371000-memory.dmp DanabotLoader2021 behavioral2/memory/3008-5-0x0000000002210000-0x0000000002371000-memory.dmp DanabotLoader2021 behavioral2/memory/3008-6-0x0000000002210000-0x0000000002371000-memory.dmp DanabotLoader2021 behavioral2/memory/3008-7-0x0000000002210000-0x0000000002371000-memory.dmp DanabotLoader2021 behavioral2/memory/3008-8-0x0000000002210000-0x0000000002371000-memory.dmp DanabotLoader2021 behavioral2/memory/3008-9-0x0000000002210000-0x0000000002371000-memory.dmp DanabotLoader2021 behavioral2/memory/3008-10-0x0000000002210000-0x0000000002371000-memory.dmp DanabotLoader2021 behavioral2/memory/3008-11-0x0000000002210000-0x0000000002371000-memory.dmp DanabotLoader2021 behavioral2/memory/3008-12-0x0000000002210000-0x0000000002371000-memory.dmp DanabotLoader2021 behavioral2/memory/3008-13-0x0000000002210000-0x0000000002371000-memory.dmp DanabotLoader2021 behavioral2/memory/3008-14-0x0000000002210000-0x0000000002371000-memory.dmp DanabotLoader2021 -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 3 3008 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 368 wrote to memory of 3008 368 rundll32.exe rundll32.exe PID 368 wrote to memory of 3008 368 rundll32.exe rundll32.exe PID 368 wrote to memory of 3008 368 rundll32.exe rundll32.exe
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\842590dc66c45ec2ea4413bce4f2ac93.dll,#11⤵
- Blocklisted process makes network request
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\842590dc66c45ec2ea4413bce4f2ac93.dll,#11⤵
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3008-0-0x0000000002210000-0x0000000002371000-memory.dmpFilesize
1.4MB
-
memory/3008-1-0x0000000002210000-0x0000000002371000-memory.dmpFilesize
1.4MB
-
memory/3008-2-0x0000000002210000-0x0000000002371000-memory.dmpFilesize
1.4MB
-
memory/3008-3-0x0000000002210000-0x0000000002371000-memory.dmpFilesize
1.4MB
-
memory/3008-4-0x0000000002210000-0x0000000002371000-memory.dmpFilesize
1.4MB
-
memory/3008-5-0x0000000002210000-0x0000000002371000-memory.dmpFilesize
1.4MB
-
memory/3008-6-0x0000000002210000-0x0000000002371000-memory.dmpFilesize
1.4MB
-
memory/3008-7-0x0000000002210000-0x0000000002371000-memory.dmpFilesize
1.4MB
-
memory/3008-8-0x0000000002210000-0x0000000002371000-memory.dmpFilesize
1.4MB
-
memory/3008-9-0x0000000002210000-0x0000000002371000-memory.dmpFilesize
1.4MB
-
memory/3008-10-0x0000000002210000-0x0000000002371000-memory.dmpFilesize
1.4MB
-
memory/3008-11-0x0000000002210000-0x0000000002371000-memory.dmpFilesize
1.4MB
-
memory/3008-12-0x0000000002210000-0x0000000002371000-memory.dmpFilesize
1.4MB
-
memory/3008-13-0x0000000002210000-0x0000000002371000-memory.dmpFilesize
1.4MB
-
memory/3008-14-0x0000000002210000-0x0000000002371000-memory.dmpFilesize
1.4MB