Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 02:59
Static task
static1
Behavioral task
behavioral1
Sample
8004d45da037b7cf301d00832b731acc7e7290a70aa858f81eade63166323519.dll
Resource
win7-20240903-en
General
-
Target
8004d45da037b7cf301d00832b731acc7e7290a70aa858f81eade63166323519.dll
-
Size
1.9MB
-
MD5
e1021216d0073c76d245fb0cbb27b63f
-
SHA1
eca71755e08f94245fd9668b20e04e73c0681ec8
-
SHA256
8004d45da037b7cf301d00832b731acc7e7290a70aa858f81eade63166323519
-
SHA512
456358a111c9b283a57a5ab749ce6f45118f28a2134256c7a2cf8a0c1df385f4304e6c6465965eda0fc882130d1f7ddb30f2f1fdaa3587f13c4320c38ffb8e47
-
SSDEEP
49152:YQU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4BAelqfn8+nFFQCxEsJwKQe:YfaNQh+NUABO/c0Y9Adxlqf8+gqJW
Malware Config
Extracted
danabot
40
185.117.90.36:443
193.42.36.59:443
193.56.146.53:443
185.106.123.228:443
-
embedded_hash
07284E2A3AB3C2E1FFFBD425849BE150
-
type
loader
Signatures
-
Danabot Loader Component 2 IoCs
resource yara_rule behavioral1/memory/2296-5-0x0000000002170000-0x0000000002364000-memory.dmp DanabotLoader2021 behavioral1/memory/2296-10-0x0000000002170000-0x0000000002364000-memory.dmp DanabotLoader2021 -
Danabot family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 2296 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 780 wrote to memory of 2296 780 rundll32.exe 31 PID 780 wrote to memory of 2296 780 rundll32.exe 31 PID 780 wrote to memory of 2296 780 rundll32.exe 31 PID 780 wrote to memory of 2296 780 rundll32.exe 31 PID 780 wrote to memory of 2296 780 rundll32.exe 31 PID 780 wrote to memory of 2296 780 rundll32.exe 31 PID 780 wrote to memory of 2296 780 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8004d45da037b7cf301d00832b731acc7e7290a70aa858f81eade63166323519.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8004d45da037b7cf301d00832b731acc7e7290a70aa858f81eade63166323519.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2296
-