Analysis
-
max time kernel
143s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-02-2024 10:06
Behavioral task
behavioral1
Sample
a8e35f06e5b70105d7f5e12d9a43ea9f.dll
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
a8e35f06e5b70105d7f5e12d9a43ea9f.dll
-
Size
1.3MB
-
MD5
a8e35f06e5b70105d7f5e12d9a43ea9f
-
SHA1
5d298767f6e25c862dc628c8d9f06b97fc72c356
-
SHA256
c12050496ed4656a6126f2488e656578bf99c179fc66cf3f04df27829038d753
-
SHA512
e1c2f26a85bb128351d2dafe68aabb5752dbb6ec62ea676a252f530916f5acad9de794ab0ac5f384a403160d0228fe1b411fea0da5f44fc4dbf79f4c8a3e227c
-
SSDEEP
24576:lcFXBM0PECFsIAqutGsVqhKtbGTQ7fpK8:G1W8RTmh
Malware Config
Extracted
Family
danabot
Botnet
4
C2
142.11.244.124:443
142.11.206.50:443
Attributes
-
embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB
-
type
loader
rsa_pubkey.plain
rsa_privkey.plain
Signatures
-
Danabot Loader Component 15 IoCs
Processes:
resource yara_rule behavioral1/memory/2172-0-0x0000000001F40000-0x000000000209D000-memory.dmp DanabotLoader2021 behavioral1/memory/2172-1-0x0000000001F40000-0x000000000209D000-memory.dmp DanabotLoader2021 behavioral1/memory/2172-2-0x0000000001F40000-0x000000000209D000-memory.dmp DanabotLoader2021 behavioral1/memory/2172-3-0x0000000001F40000-0x000000000209D000-memory.dmp DanabotLoader2021 behavioral1/memory/2172-4-0x0000000001F40000-0x000000000209D000-memory.dmp DanabotLoader2021 behavioral1/memory/2172-5-0x0000000001F40000-0x000000000209D000-memory.dmp DanabotLoader2021 behavioral1/memory/2172-6-0x0000000001F40000-0x000000000209D000-memory.dmp DanabotLoader2021 behavioral1/memory/2172-7-0x0000000001F40000-0x000000000209D000-memory.dmp DanabotLoader2021 behavioral1/memory/2172-8-0x0000000001F40000-0x000000000209D000-memory.dmp DanabotLoader2021 behavioral1/memory/2172-9-0x0000000001F40000-0x000000000209D000-memory.dmp DanabotLoader2021 behavioral1/memory/2172-10-0x0000000001F40000-0x000000000209D000-memory.dmp DanabotLoader2021 behavioral1/memory/2172-11-0x0000000001F40000-0x000000000209D000-memory.dmp DanabotLoader2021 behavioral1/memory/2172-12-0x0000000001F40000-0x000000000209D000-memory.dmp DanabotLoader2021 behavioral1/memory/2172-13-0x0000000001F40000-0x000000000209D000-memory.dmp DanabotLoader2021 behavioral1/memory/2172-14-0x0000000001F40000-0x000000000209D000-memory.dmp DanabotLoader2021 -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 2 2172 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 548 wrote to memory of 2172 548 rundll32.exe rundll32.exe PID 548 wrote to memory of 2172 548 rundll32.exe rundll32.exe PID 548 wrote to memory of 2172 548 rundll32.exe rundll32.exe PID 548 wrote to memory of 2172 548 rundll32.exe rundll32.exe PID 548 wrote to memory of 2172 548 rundll32.exe rundll32.exe PID 548 wrote to memory of 2172 548 rundll32.exe rundll32.exe PID 548 wrote to memory of 2172 548 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a8e35f06e5b70105d7f5e12d9a43ea9f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a8e35f06e5b70105d7f5e12d9a43ea9f.dll,#12⤵
- Blocklisted process makes network request
PID:2172