Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25-02-2024 14:41
Static task
static1
Behavioral task
behavioral1
Sample
a40b8f61420b24835c93f7974f39a23e.exe
Resource
win7-20240220-en
General
-
Target
a40b8f61420b24835c93f7974f39a23e.exe
-
Size
1.2MB
-
MD5
a40b8f61420b24835c93f7974f39a23e
-
SHA1
bce1227b915b76825b3589c3b60ccc2e114f7dd2
-
SHA256
f8c983fce1af5b6e17289a88d19a70fb5a67c6bc32d7aa4f3bc3ce1ffcddc282
-
SHA512
75b81661d3758b207b1f2dfc8d5dd40bd868934b931f0c0513e5d1f95ba665b7949b8db8528351d55b18f443a644094f57d07c85317510961b5f5a9a1353f95a
-
SSDEEP
24576:7xBaQMsE+VUxLY8VKUgln+NNTbhbY1oY2vTCtKz7HD53J:7N7yK5a6YTSe7V3J
Malware Config
Extracted
danabot
4
142.11.206.50:443
142.11.244.124:443
-
embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB
-
type
loader
Signatures
-
Danabot Loader Component 11 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\A40B8F~1.TMP DanabotLoader2021 behavioral1/memory/2796-9-0x0000000001E70000-0x0000000001FCE000-memory.dmp DanabotLoader2021 behavioral1/memory/2796-11-0x0000000001E70000-0x0000000001FCE000-memory.dmp DanabotLoader2021 behavioral1/memory/2796-19-0x0000000001E70000-0x0000000001FCE000-memory.dmp DanabotLoader2021 behavioral1/memory/2796-20-0x0000000001E70000-0x0000000001FCE000-memory.dmp DanabotLoader2021 behavioral1/memory/2796-21-0x0000000001E70000-0x0000000001FCE000-memory.dmp DanabotLoader2021 behavioral1/memory/2796-22-0x0000000001E70000-0x0000000001FCE000-memory.dmp DanabotLoader2021 behavioral1/memory/2796-23-0x0000000001E70000-0x0000000001FCE000-memory.dmp DanabotLoader2021 behavioral1/memory/2796-24-0x0000000001E70000-0x0000000001FCE000-memory.dmp DanabotLoader2021 behavioral1/memory/2796-25-0x0000000001E70000-0x0000000001FCE000-memory.dmp DanabotLoader2021 behavioral1/memory/2796-26-0x0000000001E70000-0x0000000001FCE000-memory.dmp DanabotLoader2021 -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 2 2796 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 2796 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
a40b8f61420b24835c93f7974f39a23e.exedescription pid process target process PID 2912 wrote to memory of 2796 2912 a40b8f61420b24835c93f7974f39a23e.exe rundll32.exe PID 2912 wrote to memory of 2796 2912 a40b8f61420b24835c93f7974f39a23e.exe rundll32.exe PID 2912 wrote to memory of 2796 2912 a40b8f61420b24835c93f7974f39a23e.exe rundll32.exe PID 2912 wrote to memory of 2796 2912 a40b8f61420b24835c93f7974f39a23e.exe rundll32.exe PID 2912 wrote to memory of 2796 2912 a40b8f61420b24835c93f7974f39a23e.exe rundll32.exe PID 2912 wrote to memory of 2796 2912 a40b8f61420b24835c93f7974f39a23e.exe rundll32.exe PID 2912 wrote to memory of 2796 2912 a40b8f61420b24835c93f7974f39a23e.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a40b8f61420b24835c93f7974f39a23e.exe"C:\Users\Admin\AppData\Local\Temp\a40b8f61420b24835c93f7974f39a23e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\A40B8F~1.TMP,S C:\Users\Admin\AppData\Local\Temp\A40B8F~1.EXE2⤵
- Blocklisted process makes network request
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\A40B8F~1.TMPFilesize
1.3MB
MD54aa41aaf04e35d03f880708db1cd5407
SHA128594223d6718c61918f0f667cb6a70add3906e4
SHA256604dce77259862fab9ef6a93b9c0eb1992821967b98d7ab1f0d141593025e16c
SHA5121bd6a2cb83cdf60db26240bd292124fce39f85cf48c95dab35f43c00010d94ad764bc6becc92a243e0c2048cec3f521c3b8c2b6fe9b86387a8785ab9385e04a6
-
memory/2796-22-0x0000000001E70000-0x0000000001FCE000-memory.dmpFilesize
1.4MB
-
memory/2796-9-0x0000000001E70000-0x0000000001FCE000-memory.dmpFilesize
1.4MB
-
memory/2796-26-0x0000000001E70000-0x0000000001FCE000-memory.dmpFilesize
1.4MB
-
memory/2796-25-0x0000000001E70000-0x0000000001FCE000-memory.dmpFilesize
1.4MB
-
memory/2796-19-0x0000000001E70000-0x0000000001FCE000-memory.dmpFilesize
1.4MB
-
memory/2796-24-0x0000000001E70000-0x0000000001FCE000-memory.dmpFilesize
1.4MB
-
memory/2796-23-0x0000000001E70000-0x0000000001FCE000-memory.dmpFilesize
1.4MB
-
memory/2796-11-0x0000000001E70000-0x0000000001FCE000-memory.dmpFilesize
1.4MB
-
memory/2796-21-0x0000000001E70000-0x0000000001FCE000-memory.dmpFilesize
1.4MB
-
memory/2796-20-0x0000000001E70000-0x0000000001FCE000-memory.dmpFilesize
1.4MB
-
memory/2912-2-0x0000000001F10000-0x0000000002010000-memory.dmpFilesize
1024KB
-
memory/2912-0-0x0000000000550000-0x000000000063A000-memory.dmpFilesize
936KB
-
memory/2912-1-0x0000000000550000-0x000000000063A000-memory.dmpFilesize
936KB
-
memory/2912-10-0x0000000001F10000-0x0000000002010000-memory.dmpFilesize
1024KB
-
memory/2912-6-0x0000000000400000-0x0000000000547000-memory.dmpFilesize
1.3MB
-
memory/2912-3-0x0000000000400000-0x0000000000547000-memory.dmpFilesize
1.3MB