Analysis
-
max time kernel
142s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
14-02-2024 02:50
General
-
Target
97add543482f00fa819e2cf732b365e9.dll
-
Size
1.3MB
-
MD5
97add543482f00fa819e2cf732b365e9
-
SHA1
6d978b03d43181577c0e24c4262128c9a47bab8c
-
SHA256
e1d1cbf3c976e260ba56e67bb058ab5a89a46f63ef20e77cff7bc72f45fe7318
-
SHA512
525c2a5b2c37795bb14ad7bed7769d8ad77127b51b5311adefe8c4f9e67b1c2dc9caddf236ae04b6f9411034a92ea23346210b1a637a423f3d27e93c24db9d9b
-
SSDEEP
24576:L8pWEmDXswcrLEEcQ1fObM5HqTgNmsBdpTWnrO:QtSzeTBdpTq
Score
10/10
Malware Config
Extracted
Family
danabot
Botnet
4
C2
23.229.29.48:443
5.9.224.204:443
192.210.222.81:443
Attributes
-
embedded_hash
0E1A7A1479C37094441FA911262B322A
-
type
loader
rsa_pubkey.plain
rsa_privkey.plain
Signatures
-
Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
-
Blocklisted process makes network request 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\97add543482f00fa819e2cf732b365e9.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\97add543482f00fa819e2cf732b365e9.dll,#12⤵
- Blocklisted process makes network request
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB