Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 03:35
Static task
static1
Behavioral task
behavioral1
Sample
d5cde707cc31c891dc3ca93a6d078fd1fd5e7bb897c07e10c240f0e1aa9c293d.dll
Resource
win7-20240903-en
General
-
Target
d5cde707cc31c891dc3ca93a6d078fd1fd5e7bb897c07e10c240f0e1aa9c293d.dll
-
Size
1.9MB
-
MD5
536eb8b12cdd42a048f1af293ffbd706
-
SHA1
0fbc3b782c15c2c091a8706e5e6ce7f4887727d8
-
SHA256
d5cde707cc31c891dc3ca93a6d078fd1fd5e7bb897c07e10c240f0e1aa9c293d
-
SHA512
da8c958e50e879db0753a489f7ec437ec41c26d257e78365bd9c4c3d0c87afc75aa1b2efe9220f13755c2b39946620d3a52fd60d3a8fc9cc875cc7a05560c473
-
SSDEEP
49152:8QU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4B0eZqfn8+nFFQCxEsJwKQG:8faNQh+NUABO/c0Y9Ad1Zqf8+gqJW
Malware Config
Extracted
danabot
40
185.117.90.36:443
193.42.36.59:443
193.56.146.53:443
185.106.123.228:443
-
embedded_hash
07284E2A3AB3C2E1FFFBD425849BE150
-
type
loader
Signatures
-
Danabot Loader Component 3 IoCs
resource yara_rule behavioral1/memory/2688-5-0x0000000001FC0000-0x00000000021B4000-memory.dmp DanabotLoader2021 behavioral1/memory/2688-9-0x0000000001FC0000-0x00000000021B4000-memory.dmp DanabotLoader2021 behavioral1/memory/2688-10-0x0000000001FC0000-0x00000000021B4000-memory.dmp DanabotLoader2021 -
Danabot family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 2688 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2688 2372 rundll32.exe 31 PID 2372 wrote to memory of 2688 2372 rundll32.exe 31 PID 2372 wrote to memory of 2688 2372 rundll32.exe 31 PID 2372 wrote to memory of 2688 2372 rundll32.exe 31 PID 2372 wrote to memory of 2688 2372 rundll32.exe 31 PID 2372 wrote to memory of 2688 2372 rundll32.exe 31 PID 2372 wrote to memory of 2688 2372 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d5cde707cc31c891dc3ca93a6d078fd1fd5e7bb897c07e10c240f0e1aa9c293d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d5cde707cc31c891dc3ca93a6d078fd1fd5e7bb897c07e10c240f0e1aa9c293d.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2688
-