Analysis
-
max time kernel
140s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04-11-2024 02:37
Static task
static1
Behavioral task
behavioral1
Sample
94c5cf35160062b5810c8839d94a5ff27c16e43435376bc4a79693c9879aee0b.dll
Resource
win7-20240903-en
General
-
Target
94c5cf35160062b5810c8839d94a5ff27c16e43435376bc4a79693c9879aee0b.dll
-
Size
1.9MB
-
MD5
3ba40ab5aa74dc76522942bae0793e51
-
SHA1
e59857ad8b2f560be38e62c4006b6498569dbbd3
-
SHA256
94c5cf35160062b5810c8839d94a5ff27c16e43435376bc4a79693c9879aee0b
-
SHA512
7aae7c27ba029c79de7f107c926a086389ba1c194342b8e308a3d50cd2d9937740e3cdb041c3f2e2512764322548220a79c9c82e260c2da63edaf8fff0e8cbf9
-
SSDEEP
49152:FQU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4Bwezqfn8+nFFQCxEsJwKQs:FfaNQh+NUABO/c0Y9Adxzqf8+gqJW
Malware Config
Extracted
danabot
40
185.117.90.36:443
193.42.36.59:443
193.56.146.53:443
185.106.123.228:443
-
embedded_hash
07284E2A3AB3C2E1FFFBD425849BE150
-
type
loader
Signatures
-
Danabot Loader Component 2 IoCs
resource yara_rule behavioral2/memory/4952-3-0x0000000000400000-0x00000000005F4000-memory.dmp DanabotLoader2021 behavioral2/memory/4952-7-0x0000000000400000-0x00000000005F4000-memory.dmp DanabotLoader2021 -
Danabot family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 28 4952 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2548 wrote to memory of 4952 2548 rundll32.exe 84 PID 2548 wrote to memory of 4952 2548 rundll32.exe 84 PID 2548 wrote to memory of 4952 2548 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\94c5cf35160062b5810c8839d94a5ff27c16e43435376bc4a79693c9879aee0b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\94c5cf35160062b5810c8839d94a5ff27c16e43435376bc4a79693c9879aee0b.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:4952
-