Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
01/06/2026, 12:39
General
- Target 2026-06-01_64073883426ec69184b0ba0847876b03_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
- Size 4.8MB
- Sample260601-pvsppaet7p
- SHA256 5dfddcf08c62318edd0ae622aab63b446dfbf8bf704429a5b36793c61cb52024
Malware Config
Extracted
-
danabot
-
1732
-
3
-
108.62.118.103:443
-
192.241.101.68:443
-
104.144.64.163:443
-
23.226.132.92:443
-
embedded_hash
49574F66CD0103BBD725C08A9805C2BE
-
type
main
Signatures
- Family: Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Detects PowerShell content designed to retrieve passwords from host 9 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 9 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 9 IoCs
- Detects executables referencing many email and collaboration clients. Observed in information steale 9 IoCs
- Detects executables referencing many file transfer clients. Observed in information stealers 9 IoCs
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Loads dropped DLL 4 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-01_64073883426ec69184b0ba0847876b03_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-01_64073883426ec69184b0ba0847876b03_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\2026-0~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\2026-0~1.DLL,VEoKLDZqAw==3⤵
- Badlisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-0~1.DLL
jfshdibizxvf.tmp
memory/2960-46-0x0000000003680000-0x0000000003CDF000-memory.dmp
memory/2960-84-0x0000000003680000-0x0000000003CDF000-memory.dmp
memory/2960-82-0x0000000003680000-0x0000000003CDF000-memory.dmp
memory/2960-48-0x0000000003680000-0x0000000003CDF000-memory.dmp
memory/2960-45-0x0000000002D30000-0x00000000030FB000-memory.dmp
memory/2960-13-0x0000000002D30000-0x00000000030FB000-memory.dmp
memory/2960-14-0x0000000003680000-0x0000000003CDF000-memory.dmp
memory/2960-15-0x0000000003F00000-0x0000000003F01000-memory.dmp
memory/2960-41-0x0000000003680000-0x0000000003CDF000-memory.dmp
memory/2960-17-0x0000000003680000-0x0000000003CDF000-memory.dmp
memory/2960-16-0x0000000003680000-0x0000000003CDF000-memory.dmp
memory/3504-9-0x0000000002E60000-0x00000000034BF000-memory.dmp
memory/3504-10-0x0000000003700000-0x0000000003701000-memory.dmp
memory/3504-8-0x00000000024D0000-0x000000000289B000-memory.dmp
memory/4660-44-0x0000000005340000-0x000000000571C000-memory.dmp
memory/4660-43-0x0000000000400000-0x00000000047DC000-memory.dmp
memory/4660-42-0x0000000004F60000-0x0000000005333000-memory.dmp
memory/4660-3-0x0000000005340000-0x000000000571C000-memory.dmp
memory/4660-0-0x0000000000400000-0x00000000047DC000-memory.dmp
memory/4660-2-0x0000000004F60000-0x0000000005333000-memory.dmp