Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 06:55
Behavioral task
behavioral1
Sample
c1d1d4af32478775a39a06ed044da1c28b9b425ce389dae29ff6775354a93158.dll
Resource
win7-20240903-en
General
-
Target
c1d1d4af32478775a39a06ed044da1c28b9b425ce389dae29ff6775354a93158.dll
-
Size
1.3MB
-
MD5
d944f0f6979bd129f224343ad244c36a
-
SHA1
8df62544f634be56142adf16a67c8d3f7d229f48
-
SHA256
c1d1d4af32478775a39a06ed044da1c28b9b425ce389dae29ff6775354a93158
-
SHA512
398ffb0129dd4a5d7bbdace04fa524b42b9310da520c34cf3bf349a67587d4479672ad618ccc816af4d91c1ceca3dace38283c0c3455cfaff9dcfc1d86382f55
-
SSDEEP
24576:58FG/L98qXKTVfl8B0Y1ewAfj3xCV2D3qyzjTrQB79ta:a7VSNAfj3xCoayzjT0ja
Malware Config
Extracted
danabot
4
192.119.110.73:443
192.236.147.159:443
192.210.222.88:443
-
embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
-
type
loader
Signatures
-
Danabot Loader Component 2 IoCs
resource yara_rule behavioral2/memory/3504-0-0x0000000000BB0000-0x0000000000D10000-memory.dmp DanabotLoader2021 behavioral2/memory/3504-1-0x0000000000BB0000-0x0000000000D10000-memory.dmp DanabotLoader2021 -
Danabot family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 1 3504 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5016 wrote to memory of 3504 5016 rundll32.exe 83 PID 5016 wrote to memory of 3504 5016 rundll32.exe 83 PID 5016 wrote to memory of 3504 5016 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c1d1d4af32478775a39a06ed044da1c28b9b425ce389dae29ff6775354a93158.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c1d1d4af32478775a39a06ed044da1c28b9b425ce389dae29ff6775354a93158.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:3504
-