Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
04-11-2024 03:00
Static task
static1
Behavioral task
behavioral1
Sample
e28b71ca332112c2709c20f4d993a819e2562618f79c9404e9b2d4a58b16cab0.dll
Resource
win7-20241010-en
General
-
Target
e28b71ca332112c2709c20f4d993a819e2562618f79c9404e9b2d4a58b16cab0.dll
-
Size
1.9MB
-
MD5
5e43a9cbf8dc4f82a2b19ce44ff14fe8
-
SHA1
151051d4041f386e0314d42322898664da205c48
-
SHA256
e28b71ca332112c2709c20f4d993a819e2562618f79c9404e9b2d4a58b16cab0
-
SHA512
a9d072b6b60791c49ff43c861b4121667f38db309ab8a93c35431fa21a31a9526501e9f8b8aaa6d5523237d24f121c2be2b152e3694eb473c7ec98cd39ede572
-
SSDEEP
49152:SQU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4Ble3qfn8+nFFQCxEsJwKQg:SfaNQh+NUABO/c0Y9AdO3qf8+gqJW
Malware Config
Extracted
danabot
40
185.117.90.36:443
193.42.36.59:443
193.56.146.53:443
185.106.123.228:443
-
embedded_hash
07284E2A3AB3C2E1FFFBD425849BE150
-
type
loader
Signatures
-
Danabot Loader Component 4 IoCs
resource yara_rule behavioral1/memory/2448-3-0x0000000001EE0000-0x00000000020D4000-memory.dmp DanabotLoader2021 behavioral1/memory/2448-4-0x0000000001EE0000-0x00000000020D4000-memory.dmp DanabotLoader2021 behavioral1/memory/2448-8-0x0000000001EE0000-0x00000000020D4000-memory.dmp DanabotLoader2021 behavioral1/memory/2448-9-0x0000000001EE0000-0x00000000020D4000-memory.dmp DanabotLoader2021 -
Danabot family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 2448 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2920 wrote to memory of 2448 2920 rundll32.exe 30 PID 2920 wrote to memory of 2448 2920 rundll32.exe 30 PID 2920 wrote to memory of 2448 2920 rundll32.exe 30 PID 2920 wrote to memory of 2448 2920 rundll32.exe 30 PID 2920 wrote to memory of 2448 2920 rundll32.exe 30 PID 2920 wrote to memory of 2448 2920 rundll32.exe 30 PID 2920 wrote to memory of 2448 2920 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e28b71ca332112c2709c20f4d993a819e2562618f79c9404e9b2d4a58b16cab0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e28b71ca332112c2709c20f4d993a819e2562618f79c9404e9b2d4a58b16cab0.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2448
-