Analysis
-
max time kernel
140s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 02:05
Static task
static1
Behavioral task
behavioral1
Sample
0ca343879edb2e360c978bc6e836ea60aa4388deac71bd05770b008faa08ca11.dll
Resource
win7-20241010-en
General
-
Target
0ca343879edb2e360c978bc6e836ea60aa4388deac71bd05770b008faa08ca11.dll
-
Size
1.9MB
-
MD5
12a52c8f881c9e9564d54862ab4e1d63
-
SHA1
09571f682a5713717c0e900afce06110747e6f01
-
SHA256
0ca343879edb2e360c978bc6e836ea60aa4388deac71bd05770b008faa08ca11
-
SHA512
b9e747492da2591c811915adc3eb9de97abcc5560fd071043407e9da3c3c6d551c031bf9ce958012bcbc909342b4c799e5c1a5eae94c49ab1f5fb3ae207d519a
-
SSDEEP
49152:+QU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4BoeGqfn8+nFFQCxEsJwKQv:+faNQh+NUABO/c0Y9Ad1Gqf8+gqJW
Malware Config
Extracted
danabot
40
185.117.90.36:443
193.42.36.59:443
193.56.146.53:443
185.106.123.228:443
-
embedded_hash
07284E2A3AB3C2E1FFFBD425849BE150
-
type
loader
Signatures
-
Danabot Loader Component 3 IoCs
resource yara_rule behavioral2/memory/2840-4-0x0000000000AF0000-0x0000000000CE4000-memory.dmp DanabotLoader2021 behavioral2/memory/2840-6-0x0000000000AF0000-0x0000000000CE4000-memory.dmp DanabotLoader2021 behavioral2/memory/2840-9-0x0000000000AF0000-0x0000000000CE4000-memory.dmp DanabotLoader2021 -
Danabot family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 18 2840 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4500 wrote to memory of 2840 4500 rundll32.exe 83 PID 4500 wrote to memory of 2840 4500 rundll32.exe 83 PID 4500 wrote to memory of 2840 4500 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ca343879edb2e360c978bc6e836ea60aa4388deac71bd05770b008faa08ca11.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ca343879edb2e360c978bc6e836ea60aa4388deac71bd05770b008faa08ca11.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2840
-