Analysis
-
max time kernel
111s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 09:30
Static task
static1
Behavioral task
behavioral1
Sample
753b2ba3f48b1d24c5488801c1ccf5a326aa703b59d2809e44aa710d3c76d3ac.dll
Resource
win7-20240708-en
General
-
Target
753b2ba3f48b1d24c5488801c1ccf5a326aa703b59d2809e44aa710d3c76d3ac.dll
-
Size
2.8MB
-
MD5
649bed846b496e33d530aadb8bb1aca3
-
SHA1
45702f48d05af26324d5ba89b6b376bd748f1ae5
-
SHA256
753b2ba3f48b1d24c5488801c1ccf5a326aa703b59d2809e44aa710d3c76d3ac
-
SHA512
a060f453dc016c4d958529c379af66f2c63540cf65f3917080af63ec2d79e85bdf7292eea65bc73167334e9b1da579875b922605fbc0e1982b26b7f101ca2efa
-
SSDEEP
49152:GVx6+py2qII/jg8UdAQD/207yVkutLLdoM+nFU95YeCczKM:GSHQddJWJLdoM+FqZzl
Malware Config
Extracted
danabot
40
185.158.250.216:443
194.76.225.46:443
45.11.180.153:443
194.76.225.61:443
-
embedded_hash
AD14EA44261341E3690FA8CC1E236523
-
type
loader
Signatures
-
Danabot Loader Component 14 IoCs
resource yara_rule behavioral2/memory/1440-2-0x0000000075200000-0x00000000754EC000-memory.dmp DanabotLoader2021 behavioral2/memory/1440-3-0x0000000075200000-0x00000000754EC000-memory.dmp DanabotLoader2021 behavioral2/memory/1440-7-0x0000000075200000-0x00000000754EC000-memory.dmp DanabotLoader2021 behavioral2/memory/1440-8-0x0000000075200000-0x00000000754EC000-memory.dmp DanabotLoader2021 behavioral2/memory/1440-9-0x0000000075200000-0x00000000754EC000-memory.dmp DanabotLoader2021 behavioral2/memory/1440-10-0x0000000075200000-0x00000000754EC000-memory.dmp DanabotLoader2021 behavioral2/memory/1440-11-0x0000000075200000-0x00000000754EC000-memory.dmp DanabotLoader2021 behavioral2/memory/1440-12-0x0000000075200000-0x00000000754EC000-memory.dmp DanabotLoader2021 behavioral2/memory/1440-13-0x0000000075200000-0x00000000754EC000-memory.dmp DanabotLoader2021 behavioral2/memory/1440-14-0x0000000075200000-0x00000000754EC000-memory.dmp DanabotLoader2021 behavioral2/memory/1440-15-0x0000000075200000-0x00000000754EC000-memory.dmp DanabotLoader2021 behavioral2/memory/1440-16-0x0000000075200000-0x00000000754EC000-memory.dmp DanabotLoader2021 behavioral2/memory/1440-17-0x0000000075200000-0x00000000754EC000-memory.dmp DanabotLoader2021 behavioral2/memory/1440-18-0x0000000075200000-0x00000000754EC000-memory.dmp DanabotLoader2021 -
Danabot family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 14 1440 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4540 wrote to memory of 1440 4540 rundll32.exe 82 PID 4540 wrote to memory of 1440 4540 rundll32.exe 82 PID 4540 wrote to memory of 1440 4540 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\753b2ba3f48b1d24c5488801c1ccf5a326aa703b59d2809e44aa710d3c76d3ac.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\753b2ba3f48b1d24c5488801c1ccf5a326aa703b59d2809e44aa710d3c76d3ac.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:1440
-