danabot | 013ed964d37e80ee700dd98ba83bc25692ee92b4895b92eed17c4ef5359432f8

Resubmissions

15/09/2026, 11:29

260915-nlkgaatzg1

07/08/2026, 14:21

07/08/2026, 14:20

06/08/2026, 22:19

06/08/2026, 22:01

06/08/2026, 03:44

10/07/2026, 00:11

Analysis

user interaction
yes
max time kernel
34s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
013ed964d37e80ee700dd98ba83bc25692ee92b4895b92eed17c4ef5359432f8.exe
Size 955KB
Sample260806-ear8baff46
SHA256 013ed964d37e80ee700dd98ba83bc25692ee92b4895b92eed17c4ef5359432f8
MD5 13694c1e016d5a35d902070111f63d18
SHA1 8a7de1581df4a927a1b5144af9d590750649aa2c
SHA512 5ddc6f8a61d0879a337f6eb751cfdf8965ba6efcc59abb1fe84f5a304588e0738be214c76dbf6d565d72ec00b8ae398c62f1492a66510926d452c1eca16e6b89
SSDEEP 24576:nnrmNg9r6EAsSDBpvEwL55pkRT8cDbhvKyew4:n39r6/DjlL55rcHE5w4
TLSH
T1662523596BF72123F1B1A930313486B07BA7BE307A70A29D1654116C1F786E35AB0F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker botnet discovery danabot trojan

Malware Config

Extracted

Family

danabot

5.61.58.130
2.56.213.39
2.56.212.4
5.61.56.192

rsa_pubkey.plain

Signatures

Family: Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 1 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

resource	yara_rule
behavioral1/files/0x0009000000024471-4.dat	family_danabot

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	1060	rundll32.exe
6	1060	rundll32.exe
7	1060	rundll32.exe
8	1060	rundll32.exe
12	1060	rundll32.exe
25	1060	rundll32.exe

Loads dropped DLL 2 IoCs

pid	Process
1236	regsvr32.exe
1060	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4412	2504	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	013ed964d37e80ee700dd98ba83bc25692ee92b4895b92eed17c4ef5359432f8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2288	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1716	mspaint.exe
1716	mspaint.exe
3944	mspaint.exe
3944	mspaint.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1716	mspaint.exe
1716	mspaint.exe
1716	mspaint.exe
1716	mspaint.exe
2288	POWERPNT.EXE
2288	POWERPNT.EXE
3944	mspaint.exe
3944	mspaint.exe
3944	mspaint.exe
3944	mspaint.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 1236	2504	013ed964d37e80ee700dd98ba83bc25692ee92b4895b92eed17c4ef5359432f8.exe	86
PID 1236 wrote to memory of 1060	1236	regsvr32.exe	90

C:\Users\Admin\AppData\Local\Temp\013ed964d37e80ee700dd98ba83bc25692ee92b4895b92eed17c4ef5359432f8.exe
"C:\Users\Admin\AppData\Local\Temp\013ed964d37e80ee700dd98ba83bc25692ee92b4895b92eed17c4ef5359432f8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\013ED9~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\013ED9~1.EXE@2504
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\013ED9~1.DLL,f0
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 464
  2⤵
  - Program crash
  PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2504 -ip 2504
1⤵
PID:1772

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\EnterConvert.wmf"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4804

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "C:\Users\Admin\Desktop\SaveUnblock.ppsx" /ou ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2288

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\EnterReset.ico"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

013ED9~1.DLL

Path C:\Users\Admin\AppData\Local\Temp\013ED9~1.DLL
Size 722KB
SHA256 a7a764414712bf2cc09bebe1b8e7dd257fbe7242c4fc103dd7f5876391af0337
MD5 8055973bd2fde1486a90b5e956c8dba3
SHA1 932aa701e1402e957db8677db5e56b9162ccc12b
SHA512 01bfb8bdb89a043fc77a6ea14276eac59d42dd0eb42f095728733b4be5809ac06e388b62483c8440a43422922e484acfc43c2618e98d288765231fe143cab52b
SSDEEP 6144:um+x5rXuGsV0tuZ7YIfCfNtiuOEOn45gQwHejej44FPGCwLcd0WhyJevyULaUVtY:uEDqtuwi/tHejjQ4UVt1LNdHe
TLSH
T185F4D531AB61E72BC1B15C3B508A5585447C73F5DB8CEC4B229C0FBDDC98192E6862EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 3KB
SHA256 b1bf8728cf2b5124c3e1e119271190c4ea4bff494a8150db9de0d210d3ca3cf9
MD5 f87c5d9d2ea11dee1432727d1f01222d
SHA1 c3415fee042e4f1b3a95dbde6c6d82dd5217af11
SHA512 3c18cb6fbc6b7f4079808ee4860051a078bb1055dbe3d3950a62886ee61fd93de838a920e3d1f2453bf4e89ed48807b2ab54725776c211c1044f7fcbd8ac7dc2
TLSH
T10F61EAC0C4C0691FD78B311ACB8915A92B9FB8D669E110620F3FBED690AB25DC3E7506
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1060-10-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/1060-12-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/1236-6-0x00000000004B5000-0x00000000004B6000-memory.dmp

Download

memory/2288-17-0x00007FF826090000-0x00007FF8260A0000-memory.dmp

Download

memory/2288-13-0x00007FF826090000-0x00007FF8260A0000-memory.dmp

Download

memory/2288-14-0x00007FF826090000-0x00007FF8260A0000-memory.dmp

Download

memory/2288-15-0x00007FF826090000-0x00007FF8260A0000-memory.dmp

Download

memory/2288-16-0x00007FF826090000-0x00007FF8260A0000-memory.dmp

Download

memory/2288-18-0x00007FF823A90000-0x00007FF823AA0000-memory.dmp

Download

memory/2288-19-0x00007FF823A90000-0x00007FF823AA0000-memory.dmp

Download

memory/2504-8-0x0000000000400000-0x0000000002EA6000-memory.dmp

Download

memory/2504-9-0x0000000003540000-0x0000000003621000-memory.dmp

Download

memory/2504-1-0x0000000003460000-0x0000000003536000-memory.dmp

Download

memory/2504-2-0x0000000003540000-0x0000000003621000-memory.dmp

Download