Analysis
-
max time kernel
110s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 05:46
Behavioral task
behavioral1
Sample
4c606dee9525228ffc8b6d011f973b2855455b2f1330de31d40d0b0aa5ba7a48.dll
Resource
win7-20240903-en
General
-
Target
4c606dee9525228ffc8b6d011f973b2855455b2f1330de31d40d0b0aa5ba7a48.dll
-
Size
1.3MB
-
MD5
0a44a3a233fc004a6d38caed99e9bb59
-
SHA1
ead382fbdae0cb70f5c625de67998f0d2e92416a
-
SHA256
4c606dee9525228ffc8b6d011f973b2855455b2f1330de31d40d0b0aa5ba7a48
-
SHA512
25a5e01ebd53df063f5cf343daae459de8c2faa7165e997d134750da307f6cd258afcb7e145f6f6b2aedcf1a9594f1fe89748117aa20fd9ee1d9e2b402e1af26
-
SSDEEP
24576:/8pWEm4bqFd1leD0o8WVVld/uCNZZT0dCIQbS:UcynDP/7ZZTOQbS
Malware Config
Extracted
danabot
4
192.119.110.73:443
192.236.147.159:443
192.210.222.88:443
-
embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
-
type
loader
Signatures
-
Danabot Loader Component 12 IoCs
resource yara_rule behavioral2/memory/1272-0-0x00000000023F0000-0x0000000002552000-memory.dmp DanabotLoader2021 behavioral2/memory/1272-1-0x00000000023F0000-0x0000000002552000-memory.dmp DanabotLoader2021 behavioral2/memory/1272-2-0x00000000023F0000-0x0000000002552000-memory.dmp DanabotLoader2021 behavioral2/memory/1272-3-0x00000000023F0000-0x0000000002552000-memory.dmp DanabotLoader2021 behavioral2/memory/1272-4-0x00000000023F0000-0x0000000002552000-memory.dmp DanabotLoader2021 behavioral2/memory/1272-5-0x00000000023F0000-0x0000000002552000-memory.dmp DanabotLoader2021 behavioral2/memory/1272-6-0x00000000023F0000-0x0000000002552000-memory.dmp DanabotLoader2021 behavioral2/memory/1272-7-0x00000000023F0000-0x0000000002552000-memory.dmp DanabotLoader2021 behavioral2/memory/1272-8-0x00000000023F0000-0x0000000002552000-memory.dmp DanabotLoader2021 behavioral2/memory/1272-9-0x00000000023F0000-0x0000000002552000-memory.dmp DanabotLoader2021 behavioral2/memory/1272-10-0x00000000023F0000-0x0000000002552000-memory.dmp DanabotLoader2021 behavioral2/memory/1272-11-0x00000000023F0000-0x0000000002552000-memory.dmp DanabotLoader2021 -
Danabot family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 1272 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1656 wrote to memory of 1272 1656 rundll32.exe 81 PID 1656 wrote to memory of 1272 1656 rundll32.exe 81 PID 1656 wrote to memory of 1272 1656 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4c606dee9525228ffc8b6d011f973b2855455b2f1330de31d40d0b0aa5ba7a48.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4c606dee9525228ffc8b6d011f973b2855455b2f1330de31d40d0b0aa5ba7a48.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:1272
-