Analysis
-
max time kernel
141s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 03:11
Static task
static1
Behavioral task
behavioral1
Sample
a75f0ee7a2d908811e20d66b2bb8f7849676901e6448ad4f12b2a7b299fd006f.dll
Resource
win7-20240903-en
General
-
Target
a75f0ee7a2d908811e20d66b2bb8f7849676901e6448ad4f12b2a7b299fd006f.dll
-
Size
1.9MB
-
MD5
32bd6ec36e8382ea9a0c11e2b2b71bba
-
SHA1
066b600eeeb3ebfe3a6bb2f1baee688ebe4ff5ab
-
SHA256
a75f0ee7a2d908811e20d66b2bb8f7849676901e6448ad4f12b2a7b299fd006f
-
SHA512
813815627d4b5d3999cb65e37cadb41348a723c64a44e08393442e16c0f5c9f194cdcc49e173da2b7192a05b0f6a874f80885ad937016a84f6e6a9bb671396fa
-
SSDEEP
49152:hQU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4BAenqfn8+nFFQCxEsJwKQY:hfaNQh+NUABO/c0Y9Adlnqf8+gqJW
Malware Config
Extracted
danabot
40
185.117.90.36:443
193.42.36.59:443
193.56.146.53:443
185.106.123.228:443
-
embedded_hash
07284E2A3AB3C2E1FFFBD425849BE150
-
type
loader
Signatures
-
Danabot Loader Component 3 IoCs
resource yara_rule behavioral2/memory/3972-2-0x0000000000400000-0x00000000005F4000-memory.dmp DanabotLoader2021 behavioral2/memory/3972-3-0x0000000000400000-0x00000000005F4000-memory.dmp DanabotLoader2021 behavioral2/memory/3972-7-0x0000000000400000-0x00000000005F4000-memory.dmp DanabotLoader2021 -
Danabot family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 20 3972 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1676 wrote to memory of 3972 1676 rundll32.exe 83 PID 1676 wrote to memory of 3972 1676 rundll32.exe 83 PID 1676 wrote to memory of 3972 1676 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a75f0ee7a2d908811e20d66b2bb8f7849676901e6448ad4f12b2a7b299fd006f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a75f0ee7a2d908811e20d66b2bb8f7849676901e6448ad4f12b2a7b299fd006f.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:3972
-