Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
24-02-2024 06:11
General
-
Target
a12506001fec6fba3c9b4f7a9c837349.dll
-
Size
1.3MB
-
MD5
a12506001fec6fba3c9b4f7a9c837349
-
SHA1
ee1077557fcd031a70b3bbb8aa82dcc273690c6f
-
SHA256
45498fc7ad058a572bb653f5307d549ac6f72c9c016a0f7f9b3134bbb8a5b29d
-
SHA512
d5e72bac10eb13992ccb8cb1e38b717a29682849a7bf30cefaba94a1bc36d000d5cb598a6e1be7ffccb81e2b713f6495d6d9f822468c69c65c2b58f1fd5c2278
-
SSDEEP
24576:y8pWEmNN85Fhyuqsghhg0SWKyolmi3TOfU:ZlMgYvoD3T6
Score
10/10
Malware Config
Extracted
Family
danabot
Botnet
4
C2
23.229.29.48:443
5.9.224.204:443
192.210.222.81:443
Attributes
-
embedded_hash
0E1A7A1479C37094441FA911262B322A
-
type
loader
rsa_pubkey.plain
rsa_privkey.plain
Signatures
-
Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
-
Danabot Loader Component 14 IoCs
-
Blocklisted process makes network request 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a12506001fec6fba3c9b4f7a9c837349.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a12506001fec6fba3c9b4f7a9c837349.dll,#12⤵
- Blocklisted process makes network request
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB