Analysis
-
max time kernel
110s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10-11-2024 10:35
Static task
static1
Behavioral task
behavioral1
Sample
8257b88092500ecdab0a787d521bae736fe27ba3dbb113f2f5f4d47b7140f63aN.dll
Resource
win7-20240903-en
General
-
Target
8257b88092500ecdab0a787d521bae736fe27ba3dbb113f2f5f4d47b7140f63aN.dll
-
Size
1.9MB
-
MD5
bc7d3a4a5f6903318674e69e8f808540
-
SHA1
50658aa2bcf5c8fd2611d1c09219f13262139df1
-
SHA256
8257b88092500ecdab0a787d521bae736fe27ba3dbb113f2f5f4d47b7140f63a
-
SHA512
c92b2fd6465bb7021ff9c7e5c067a40d480b65ffae0ed93d799853fb9a3edf7e808caf366485f757826512d5d334ca33a83fe9604dbad5ca37f632fb1b7476d3
-
SSDEEP
49152:NQU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4BOeGqfn8+nFFQCxEsJwKQH:NfaNQh+NUABO/c0Y9AdDGqf8+gqJW
Malware Config
Extracted
danabot
40
185.117.90.36:443
193.42.36.59:443
193.56.146.53:443
185.106.123.228:443
-
embedded_hash
07284E2A3AB3C2E1FFFBD425849BE150
-
type
loader
Signatures
-
Danabot Loader Component 3 IoCs
resource yara_rule behavioral1/memory/2400-5-0x00000000021D0000-0x00000000023C4000-memory.dmp DanabotLoader2021 behavioral1/memory/2400-4-0x00000000021D0000-0x00000000023C4000-memory.dmp DanabotLoader2021 behavioral1/memory/2400-9-0x00000000021D0000-0x00000000023C4000-memory.dmp DanabotLoader2021 -
Danabot family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 2400 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2400 2708 rundll32.exe 31 PID 2708 wrote to memory of 2400 2708 rundll32.exe 31 PID 2708 wrote to memory of 2400 2708 rundll32.exe 31 PID 2708 wrote to memory of 2400 2708 rundll32.exe 31 PID 2708 wrote to memory of 2400 2708 rundll32.exe 31 PID 2708 wrote to memory of 2400 2708 rundll32.exe 31 PID 2708 wrote to memory of 2400 2708 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8257b88092500ecdab0a787d521bae736fe27ba3dbb113f2f5f4d47b7140f63aN.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8257b88092500ecdab0a787d521bae736fe27ba3dbb113f2f5f4d47b7140f63aN.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2400
-