Overview

overview

10

Static

static

3

2026-07-05...er.exe

windows10-2004-x64

10

2026-07-05...er.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 23:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-05_0bd68faabd1e1748e5ed0d5a7cd881f7_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
  • Size 9.3MB
  • Sample260705-3fg7asb17l
  • SHA256 80528e16c3d9e33bda933a88fd034d2a683f339778255a3006ea7828b4370675
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
bankerdiscoverydanabotpersistencespywarestealertrojan

Malware Config

Extracted

Family

  • danabot

C2

  • aqpfkxxtvahlzr6vobt6fhj4riev7wxzoxwltbcysuybirygxzvp23ad.onion

  • t77e4phezpwqebpbhdagr26ewkfaxytscimhxofws4wcisjo4wundead.onion

  • vsjyfpt7vcd6atniefmz36ikxrqk5eyv573a2af4e2ntb437wdch63yd.onion

  • fejdqikkdwheckrutucbbyeovpdnef4bopz2fx636i67p3qpffpfxxad.onion

Attributes
  • embedded_hash

    AE49430CAEC668D5872FB4F5DC3036DB

  • type

    main

Signatures

  • Family: Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 15 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 15 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Checks processor information in registry 2 TTPs 39 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_0bd68faabd1e1748e5ed0d5a7cd881f7_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-05_0bd68faabd1e1748e5ed0d5a7cd881f7_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2996
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1132
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3000
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4172
  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_0bd68faabd1e1748e5ed0d5a7cd881f7_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-05_0bd68faabd1e1748e5ed0d5a7cd881f7_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:2660
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
      PID:5700
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
        PID:3224
      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
        1⤵
          PID:5460
        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
          1⤵
            PID:2608
          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
            1⤵
              PID:1732

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  msedge.exe
                  • Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  • Size 3.9MB
                  • SHA256 6d8e5d6a4d1c147b90b5a394a5054840e19dfa3eae3ea706ffb367477cecb929
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  chrome.exe
                  • Path C:\Program Files\Google\Chrome\Application\chrome.exe
                  • Size 3.1MB
                  • SHA256 fdcfa390134b6d9a6bb68f9b7c452c01701e2b27fca1b9227e5b92f652df2457
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  firefox.exe
                  • Path C:\Program Files\Mozilla Firefox\firefox.exe
                  • Size 667KB
                  • SHA256 81a0316cd0efdad79c3f268a0e25a6e7133e9ad6ebf970fe0db36cd4e87ff849
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  mozglue.dll
                  • Path C:\Program Files\Mozilla Firefox\mozglue.dll
                  • Size 943KB
                  • SHA256 deb71d90971a55f6697918799eb0432c2f80a0c6ae8599eadbfc9976f9822692
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  msvcp140.dll
                  • Path C:\Program Files\Mozilla Firefox\msvcp140.dll
                  • Size 559KB
                  • SHA256 1e57a6df9e3742e31a1c6d9bff81ebeeae8a7de3b45a26e5079d5e1cce54cd98
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/2660-24-0x000001D146100000-0x000001D146986000-memory.dmp
                  Download

                  memory/2660-23-0x000001D145880000-0x000001D1460F5000-memory.dmp
                  Download

                  memory/2660-22-0x0000000000400000-0x0000000000B9B000-memory.dmp
                  Download

                  memory/2660-6-0x0000000000400000-0x0000000000B9B000-memory.dmp
                  Download

                  memory/2660-18-0x000001D146100000-0x000001D146986000-memory.dmp
                  Download

                  memory/2660-8-0x000001D145880000-0x000001D1460F5000-memory.dmp
                  Download

                  memory/2660-9-0x000001D146100000-0x000001D146986000-memory.dmp
                  Download

                  memory/2996-7-0x000001E9E88F0000-0x000001E9E9176000-memory.dmp
                  Download

                  memory/2996-5-0x000001E9E8070000-0x000001E9E88E5000-memory.dmp
                  Download

                  memory/2996-14-0x000001E9E88F0000-0x000001E9E9176000-memory.dmp
                  Download

                  memory/2996-12-0x000001E9E88F0000-0x000001E9E9176000-memory.dmp
                  Download

                  memory/2996-11-0x000000006B480000-0x000000006B556000-memory.dmp
                  Download

                  memory/2996-10-0x0000000065800000-0x0000000065C63000-memory.dmp
                  Download

                  memory/2996-0-0x0000000000400000-0x0000000000B9B000-memory.dmp
                  Download

                  memory/2996-19-0x000001E9E88F0000-0x000001E9E9176000-memory.dmp
                  Download

                  memory/2996-21-0x000001E9E88F0000-0x000001E9E9176000-memory.dmp
                  Download

                  memory/2996-13-0x000001E9E88F0000-0x000001E9E9176000-memory.dmp
                  Download

                  memory/2996-4-0x0000000000400000-0x0000000000B9B000-memory.dmp
                  Download

                  memory/2996-3-0x000001E9E88F0000-0x000001E9E9176000-memory.dmp
                  Download

                  memory/2996-2-0x000001E9E88F0000-0x000001E9E9176000-memory.dmp
                  Download

                  memory/2996-1-0x000001E9E8070000-0x000001E9E88E5000-memory.dmp
                  Download

                  memory/2996-28-0x000001E9E88F0000-0x000001E9E9176000-memory.dmp
                  Download

                  memory/2996-30-0x000001E9E88F0000-0x000001E9E9176000-memory.dmp
                  Download

                  memory/2996-31-0x000001E9E88F0000-0x000001E9E9176000-memory.dmp
                  Download

                  memory/2996-33-0x000001E9E88F0000-0x000001E9E9176000-memory.dmp
                  Download