Resubmissions
15/09/2026, 11:29
260915-nlkgaatzg107/08/2026, 14:21
260807-rn2ecsfm2v1007/08/2026, 14:20
260807-rnv8cazwds06/08/2026, 22:19
260806-18tppa1gqf1006/08/2026, 22:01
260806-1w8m3svsfz1006/08/2026, 03:44
260806-ear8baff461010/07/2026, 00:11
260710-agy7zsct5t10Analysis
- user interaction
yes - max time kernel
159s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
07/08/2026, 14:21
General
- Target 013ed964d37e80ee700dd98ba83bc25692ee92b4895b92eed17c4ef5359432f8.exe
- Size 955KB
- Sample260807-rn2ecsfm2v
- SHA256 013ed964d37e80ee700dd98ba83bc25692ee92b4895b92eed17c4ef5359432f8
Malware Config
Extracted
-
danabot
-
5.61.58.130
-
2.56.213.39
-
2.56.212.4
-
5.61.56.192
Signatures
- Family: Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Danabot x86 payload 1 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
- Badlisted process makes network request 10 IoCs
Network request originating from process or tool commonly abused by malware.
- Loads dropped DLL 4 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\013ed964d37e80ee700dd98ba83bc25692ee92b4895b92eed17c4ef5359432f8.exe"C:\Users\Admin\AppData\Local\Temp\013ed964d37e80ee700dd98ba83bc25692ee92b4895b92eed17c4ef5359432f8.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\013ED9~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\013ED9~1.EXE@18442⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\013ED9~1.DLL,f03⤵
- Badlisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 4602⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1844 -ip 18441⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
013ED9~1.DLL
memory/1844-1-0x0000000003390000-0x000000000346B000-memory.dmp
memory/1844-2-0x0000000003470000-0x0000000003551000-memory.dmp
memory/1844-12-0x0000000003470000-0x0000000003551000-memory.dmp
memory/1844-11-0x0000000000400000-0x0000000002EA6000-memory.dmp
memory/2212-7-0x00000000006C0000-0x0000000000782000-memory.dmp
memory/2396-10-0x0000000000D30000-0x0000000000DF2000-memory.dmp
memory/2396-13-0x0000000000D30000-0x0000000000DF2000-memory.dmp
memory/2396-14-0x0000000000D30000-0x0000000000DF2000-memory.dmp