Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
08-11-2024 17:57
Static task
static1
Behavioral task
behavioral1
Sample
291152a44d06027a6f32777430dc7a58dbf17b461f477e3984b4bc94989961a2N.dll
Resource
win7-20241010-en
General
-
Target
291152a44d06027a6f32777430dc7a58dbf17b461f477e3984b4bc94989961a2N.dll
-
Size
1.9MB
-
MD5
648be3334bd524d77f2f8422078c7e40
-
SHA1
d8a65cff04d5ac0d75fdebd24cad8e2a3447e643
-
SHA256
291152a44d06027a6f32777430dc7a58dbf17b461f477e3984b4bc94989961a2
-
SHA512
042827d601a92a239d6b02810759282ce725cb3b8c8c38346b6b2db9dd6938470e574444230a8fb16568d3fd498ac9ca79f0b743714883fa9eaf10e2373ddf78
-
SSDEEP
49152:1QU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4BPeGqfn8+nFFQCxEsJwKQX:1faNQh+NUABO/c0Y9AdUGqf8+gqJW
Malware Config
Extracted
danabot
40
185.117.90.36:443
193.42.36.59:443
193.56.146.53:443
185.106.123.228:443
-
embedded_hash
07284E2A3AB3C2E1FFFBD425849BE150
-
type
loader
Signatures
-
Danabot Loader Component 3 IoCs
resource yara_rule behavioral1/memory/2576-4-0x0000000000AC0000-0x0000000000CB4000-memory.dmp DanabotLoader2021 behavioral1/memory/2576-5-0x0000000000AC0000-0x0000000000CB4000-memory.dmp DanabotLoader2021 behavioral1/memory/2576-9-0x0000000000AC0000-0x0000000000CB4000-memory.dmp DanabotLoader2021 -
Danabot family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 2576 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2572 wrote to memory of 2576 2572 rundll32.exe 30 PID 2572 wrote to memory of 2576 2572 rundll32.exe 30 PID 2572 wrote to memory of 2576 2572 rundll32.exe 30 PID 2572 wrote to memory of 2576 2572 rundll32.exe 30 PID 2572 wrote to memory of 2576 2572 rundll32.exe 30 PID 2572 wrote to memory of 2576 2572 rundll32.exe 30 PID 2572 wrote to memory of 2576 2572 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\291152a44d06027a6f32777430dc7a58dbf17b461f477e3984b4bc94989961a2N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\291152a44d06027a6f32777430dc7a58dbf17b461f477e3984b4bc94989961a2N.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2576
-