Analysis
-
max time kernel
141s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 02:54
Static task
static1
Behavioral task
behavioral1
Sample
7c74da5310051d5e8998b9ae20148c0c1cdf4b397aa652d9dc20030b4c5a5567.dll
Resource
win7-20240729-en
General
-
Target
7c74da5310051d5e8998b9ae20148c0c1cdf4b397aa652d9dc20030b4c5a5567.dll
-
Size
1.9MB
-
MD5
f367f5c54b4631cd53e5430bbed2fd03
-
SHA1
52c139184c0c53b7b2d814f0803ff89c9aefe58e
-
SHA256
7c74da5310051d5e8998b9ae20148c0c1cdf4b397aa652d9dc20030b4c5a5567
-
SHA512
3dd8aa47473806e8bbda087b128fd440159840c2cf233aa9c048262e1992a45fdbf4068e30864830c5227a212a00d5a4f197d6a5ae93dff7d2f9dbd4ba4a9e10
-
SSDEEP
49152:bQU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4BXeiqfn8+nFFQCxEsJwKQX:bfaNQh+NUABO/c0Y9AdIiqf8+gqJW
Malware Config
Extracted
danabot
40
185.117.90.36:443
193.42.36.59:443
193.56.146.53:443
185.106.123.228:443
-
embedded_hash
07284E2A3AB3C2E1FFFBD425849BE150
-
type
loader
Signatures
-
Danabot Loader Component 3 IoCs
resource yara_rule behavioral2/memory/3468-5-0x0000000002230000-0x0000000002424000-memory.dmp DanabotLoader2021 behavioral2/memory/3468-6-0x0000000002230000-0x0000000002424000-memory.dmp DanabotLoader2021 behavioral2/memory/3468-10-0x0000000002230000-0x0000000002424000-memory.dmp DanabotLoader2021 -
Danabot family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 22 3468 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4800 wrote to memory of 3468 4800 rundll32.exe 85 PID 4800 wrote to memory of 3468 4800 rundll32.exe 85 PID 4800 wrote to memory of 3468 4800 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7c74da5310051d5e8998b9ae20148c0c1cdf4b397aa652d9dc20030b4c5a5567.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7c74da5310051d5e8998b9ae20148c0c1cdf4b397aa652d9dc20030b4c5a5567.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:3468
-