Analysis
-
max time kernel
110s -
max time network
26s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-11-2024 23:21
Static task
static1
Behavioral task
behavioral1
Sample
9ffa5208d7456129da42a58f32b284aef3c15d793a23fc4b47e95d09947fe3eeN.dll
Resource
win7-20240903-en
General
-
Target
9ffa5208d7456129da42a58f32b284aef3c15d793a23fc4b47e95d09947fe3eeN.dll
-
Size
1.9MB
-
MD5
e9cb52cc3396741f14f5a570a1c04180
-
SHA1
5f2119ff4d62cb1d924a65f1eabab394cc319769
-
SHA256
9ffa5208d7456129da42a58f32b284aef3c15d793a23fc4b47e95d09947fe3ee
-
SHA512
d5c7e61f446940af3c4f431ca3178eb5de965d43db9f5f4563acea61a1cfbd05209288ecb65d7f6465d36206ac7aa915f47da2f1d7fb8363aa028a03ce2ab8fe
-
SSDEEP
49152:zQU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4BMeKqfn8+nFFQCxEsJwKQ3:zfaNQh+NUABO/c0Y9AdRKqf8+gqJW
Malware Config
Extracted
danabot
40
185.117.90.36:443
193.42.36.59:443
193.56.146.53:443
185.106.123.228:443
-
embedded_hash
07284E2A3AB3C2E1FFFBD425849BE150
-
type
loader
Signatures
-
Danabot Loader Component 3 IoCs
resource yara_rule behavioral1/memory/2916-4-0x0000000000B60000-0x0000000000D54000-memory.dmp DanabotLoader2021 behavioral1/memory/2916-5-0x0000000000B60000-0x0000000000D54000-memory.dmp DanabotLoader2021 behavioral1/memory/2916-9-0x0000000000B60000-0x0000000000D54000-memory.dmp DanabotLoader2021 -
Danabot family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 2916 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2900 wrote to memory of 2916 2900 rundll32.exe 28 PID 2900 wrote to memory of 2916 2900 rundll32.exe 28 PID 2900 wrote to memory of 2916 2900 rundll32.exe 28 PID 2900 wrote to memory of 2916 2900 rundll32.exe 28 PID 2900 wrote to memory of 2916 2900 rundll32.exe 28 PID 2900 wrote to memory of 2916 2900 rundll32.exe 28 PID 2900 wrote to memory of 2916 2900 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9ffa5208d7456129da42a58f32b284aef3c15d793a23fc4b47e95d09947fe3eeN.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9ffa5208d7456129da42a58f32b284aef3c15d793a23fc4b47e95d09947fe3eeN.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2916
-