Analysis
-
max time kernel
140s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03-11-2024 18:41
Static task
static1
Behavioral task
behavioral1
Sample
45FD9AAF1D07676187DDB47B7C7BB81E.dll
Resource
win7-20240903-en
General
-
Target
45FD9AAF1D07676187DDB47B7C7BB81E.dll
-
Size
1.9MB
-
MD5
45fd9aaf1d07676187ddb47b7c7bb81e
-
SHA1
df864079598c06a2799c7a1a75355e724ff4e1d9
-
SHA256
f4be28ff3ca6e36a4b6844cde7898e15bd66e9014b50933947e94e132f737d1c
-
SHA512
33f3754c6b8d969692874b1f563d39b084c98c3e768867ad96b07fd9ea1f094f9e73ea88d82e31066b6bfc285d5232ff1159b0db187a632bdeb0669df59ccc4f
-
SSDEEP
49152:VQU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4BueSqfn8+nFFQCxEsJwKQf:VfaNQh+NUABO/c0Y9AdTSqf8+gqJW
Malware Config
Extracted
danabot
40
185.117.90.36:443
193.42.36.59:443
193.56.146.53:443
185.106.123.228:443
-
embedded_hash
07284E2A3AB3C2E1FFFBD425849BE150
-
type
loader
Signatures
-
Danabot Loader Component 3 IoCs
resource yara_rule behavioral1/memory/2848-5-0x0000000002110000-0x0000000002304000-memory.dmp DanabotLoader2021 behavioral1/memory/2848-6-0x0000000002110000-0x0000000002304000-memory.dmp DanabotLoader2021 behavioral1/memory/2848-10-0x0000000002110000-0x0000000002304000-memory.dmp DanabotLoader2021 -
Danabot family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 2848 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1820 wrote to memory of 2848 1820 rundll32.exe 28 PID 1820 wrote to memory of 2848 1820 rundll32.exe 28 PID 1820 wrote to memory of 2848 1820 rundll32.exe 28 PID 1820 wrote to memory of 2848 1820 rundll32.exe 28 PID 1820 wrote to memory of 2848 1820 rundll32.exe 28 PID 1820 wrote to memory of 2848 1820 rundll32.exe 28 PID 1820 wrote to memory of 2848 1820 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\45FD9AAF1D07676187DDB47B7C7BB81E.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\45FD9AAF1D07676187DDB47B7C7BB81E.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2848
-