Analysis
-
max time kernel
142s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 17:08
Behavioral task
behavioral1
Sample
4.dll
Resource
win10-20240404-en
windows10-1703-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
4.dll
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
4.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
4.dll
-
Size
2.4MB
-
MD5
986d769a639a877a9b8f4fb3c8616911
-
SHA1
ba1cc29d845d958bd60c989eaa36fdaf9db7ea41
-
SHA256
c94374155dded12d9f90d16f03470b12b14c4df109a9cf8dbf26e9cd66850457
-
SHA512
3a1e2a6b57278071906ee2d7b1f9ca6d1ed98084c80512da854e5c1f73e480b92f2b1cceccf87523184bf34250e3cb6a0e1172d7f5478777570f807820d9a187
-
SSDEEP
24576:yqUUcYHqhhW1bCYo9mvn9YDq+0as+MqYrtaBwSbx3jMUAlZSVV4VHa4k3NkZpyM4:yJmFyqC4aeSN3oRlZyA/o7I3fOis
Malware Config
Extracted
Family
danabot
C2
92.204.160.54
2.56.213.179
45.153.186.47
93.115.21.29
185.45.193.50
193.34.166.247
rsa_pubkey.plain
Signatures
-
Blocklisted process makes network request 10 IoCs
flow pid Process 2 2532 rundll32.exe 3 2532 rundll32.exe 4 2532 rundll32.exe 5 2532 rundll32.exe 6 2532 rundll32.exe 7 2532 rundll32.exe 8 2532 rundll32.exe 9 2532 rundll32.exe 10 2532 rundll32.exe 11 2532 rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1088 2164 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3040 wrote to memory of 2164 3040 rundll32.exe 28 PID 3040 wrote to memory of 2164 3040 rundll32.exe 28 PID 3040 wrote to memory of 2164 3040 rundll32.exe 28 PID 3040 wrote to memory of 2164 3040 rundll32.exe 28 PID 3040 wrote to memory of 2164 3040 rundll32.exe 28 PID 3040 wrote to memory of 2164 3040 rundll32.exe 28 PID 3040 wrote to memory of 2164 3040 rundll32.exe 28 PID 2164 wrote to memory of 2532 2164 rundll32.exe 29 PID 2164 wrote to memory of 2532 2164 rundll32.exe 29 PID 2164 wrote to memory of 2532 2164 rundll32.exe 29 PID 2164 wrote to memory of 2532 2164 rundll32.exe 29 PID 2164 wrote to memory of 2532 2164 rundll32.exe 29 PID 2164 wrote to memory of 2532 2164 rundll32.exe 29 PID 2164 wrote to memory of 2532 2164 rundll32.exe 29 PID 2164 wrote to memory of 1088 2164 rundll32.exe 30 PID 2164 wrote to memory of 1088 2164 rundll32.exe 30 PID 2164 wrote to memory of 1088 2164 rundll32.exe 30 PID 2164 wrote to memory of 1088 2164 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\4.dll,f03⤵
- Blocklisted process makes network request
PID:2532
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 3883⤵
- Program crash
PID:1088
-
-