Resubmissions
15/09/2026, 11:29
260915-nlkgaatzg107/08/2026, 14:21
260807-rn2ecsfm2v1007/08/2026, 14:20
260807-rnv8cazwds06/08/2026, 22:19
260806-18tppa1gqf1006/08/2026, 22:01
260806-1w8m3svsfz1006/08/2026, 03:44
260806-ear8baff461010/07/2026, 00:11
260710-agy7zsct5t10Analysis
- max time kernel
598s - max time network
601s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
06/08/2026, 03:44
General
- Target 014cbdc259ef1fde1a1e27b064eebcfa8344075d591dad1ab56888df71a13a89.exe
- Size 1.0MB
- Sample260806-ear8baff46
- SHA256 014cbdc259ef1fde1a1e27b064eebcfa8344075d591dad1ab56888df71a13a89
Malware Config
Extracted
-
danabot
-
5.61.58.130
-
2.56.213.39
-
2.56.212.4
-
5.61.56.192
Signatures
- Family: Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Danabot x86 payload 1 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
- Badlisted process makes network request 19 IoCs
Network request originating from process or tool commonly abused by malware.
- Loads dropped DLL 3 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\014cbdc259ef1fde1a1e27b064eebcfa8344075d591dad1ab56888df71a13a89.exe"C:\Users\Admin\AppData\Local\Temp\014cbdc259ef1fde1a1e27b064eebcfa8344075d591dad1ab56888df71a13a89.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\014CBD~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\014CBD~1.EXE@41842⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\014CBD~1.DLL,f03⤵
- Badlisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 4922⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4184 -ip 41841⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
014CBD~1.DLL
memory/2644-7-0x00000000004B5000-0x00000000004B6000-memory.dmp
memory/2764-15-0x0000000002750000-0x0000000002812000-memory.dmp
memory/2764-48-0x0000000002750000-0x0000000002812000-memory.dmp
memory/2764-10-0x0000000002750000-0x0000000002812000-memory.dmp
memory/2764-53-0x0000000002750000-0x0000000002812000-memory.dmp
memory/2764-51-0x0000000002750000-0x0000000002812000-memory.dmp
memory/2764-13-0x0000000002750000-0x0000000002812000-memory.dmp
memory/2764-49-0x0000000002750000-0x0000000002812000-memory.dmp
memory/2764-16-0x0000000002750000-0x0000000002812000-memory.dmp
memory/2764-17-0x0000000002750000-0x0000000002812000-memory.dmp
memory/2764-18-0x0000000002750000-0x0000000002812000-memory.dmp
memory/4184-2-0x0000000003090000-0x0000000003171000-memory.dmp
memory/4184-1-0x0000000002FC0000-0x000000000308E000-memory.dmp
memory/4184-12-0x0000000003090000-0x0000000003171000-memory.dmp
memory/4184-6-0x0000000000400000-0x0000000002CEF000-memory.dmp