Analysis
-
max time kernel
111s -
max time network
23s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-11-2024 13:44
Static task
static1
Behavioral task
behavioral1
Sample
bc4437545aa1c5bc43af88195b2f0185fc562d47e5a01ff2b9fc3724892afa33N.dll
Resource
win7-20240903-en
General
-
Target
bc4437545aa1c5bc43af88195b2f0185fc562d47e5a01ff2b9fc3724892afa33N.dll
-
Size
1.9MB
-
MD5
ba4e81eb335b8fd6fbc859b2422e7240
-
SHA1
2ea0a8374e44356add8a05f9c7ed0e43905971f1
-
SHA256
bc4437545aa1c5bc43af88195b2f0185fc562d47e5a01ff2b9fc3724892afa33
-
SHA512
f55491a30c611c97bdc7a3a073ac26c07ddccab5e4163e41519eea4d67b6f7c51aa6636b55889ffaa9a624936ee2055ca082685d21190cabba6163c72dcdc7a1
-
SSDEEP
49152:fQU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4Bvegqfn8+nFFQCxEsJwKQh:ffaNQh+NUABO/c0Y9Adkgqf8+gqJW
Malware Config
Extracted
danabot
40
185.117.90.36:443
193.42.36.59:443
193.56.146.53:443
185.106.123.228:443
-
embedded_hash
07284E2A3AB3C2E1FFFBD425849BE150
-
type
loader
Signatures
-
Danabot Loader Component 2 IoCs
resource yara_rule behavioral1/memory/2388-5-0x00000000021E0000-0x00000000023D4000-memory.dmp DanabotLoader2021 behavioral1/memory/2388-9-0x00000000021E0000-0x00000000023D4000-memory.dmp DanabotLoader2021 -
Danabot family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 2388 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 828 wrote to memory of 2388 828 rundll32.exe 31 PID 828 wrote to memory of 2388 828 rundll32.exe 31 PID 828 wrote to memory of 2388 828 rundll32.exe 31 PID 828 wrote to memory of 2388 828 rundll32.exe 31 PID 828 wrote to memory of 2388 828 rundll32.exe 31 PID 828 wrote to memory of 2388 828 rundll32.exe 31 PID 828 wrote to memory of 2388 828 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bc4437545aa1c5bc43af88195b2f0185fc562d47e5a01ff2b9fc3724892afa33N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bc4437545aa1c5bc43af88195b2f0185fc562d47e5a01ff2b9fc3724892afa33N.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2388
-