Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
30/08/2026, 09:20
General
- Target 213d3c201feb2d31d50d48fb74ad244b.exe
- Size 4.1MB
- Sample260830-lay47abb34
- SHA256 93a1e16f5c41e6d6540732e5d21e178b7e8a6adc086c75000050f21bd26a2740
Malware Config
Signatures
- Family: Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 1 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 4 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 56 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\213d3c201feb2d31d50d48fb74ad244b.exe"C:\Users\Admin\AppData\Local\Temp\213d3c201feb2d31d50d48fb74ad244b.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-6GIIB2AMKH.tmp\213d3c201feb2d31d50d48fb74ad244b.tmp"C:\Users\Admin\AppData\Local\Temp\is-6GIIB2AMKH.tmp\213d3c201feb2d31d50d48fb74ad244b.tmp" /SL5="$50206,3054473,842240,C:\Users\Admin\AppData\Local\Temp\213d3c201feb2d31d50d48fb74ad244b.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\213d3c201feb2d31d50d48fb74ad244b.exe"C:\Users\Admin\AppData\Local\Temp\213d3c201feb2d31d50d48fb74ad244b.exe" /PASSWORD=8asOW6JhfPUYEEZi3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-0HG2RO7LM7.tmp\213d3c201feb2d31d50d48fb74ad244b.tmp"C:\Users\Admin\AppData\Local\Temp\is-0HG2RO7LM7.tmp\213d3c201feb2d31d50d48fb74ad244b.tmp" /SL5="$60206,3054473,842240,C:\Users\Admin\AppData\Local\Temp\213d3c201feb2d31d50d48fb74ad244b.exe" /PASSWORD=8asOW6JhfPUYEEZi4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5e257721b896fa84a64b12d669ea8524.bak\core.exe"C:\Users\Admin\AppData\Local\Temp\5e257721b896fa84a64b12d669ea8524.bak\core.exe" -Embedding5⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\7F747CDB\49B6007E.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
GameuxInstallHelper.dll
core.exe
213d3c201feb2d31d50d48fb74ad244b.tmp
scr_initsetup.log
729feef3e15154a0c25406b829f636b3.tmp
memory/824-15-0x00000000030A0000-0x00000000030A1000-memory.dmp
memory/824-35-0x00000000007D0000-0x0000000000C07000-memory.dmp
memory/2040-85-0x0000000003430000-0x000000000347D000-memory.dmp
memory/2040-95-0x0000000003430000-0x000000000347D000-memory.dmp
memory/2040-58-0x0000000002630000-0x00000000026A5000-memory.dmp
memory/2040-62-0x0000000002630000-0x00000000026A5000-memory.dmp
memory/2040-61-0x0000000002630000-0x00000000026A5000-memory.dmp
memory/2040-60-0x0000000002630000-0x00000000026A5000-memory.dmp
memory/2040-59-0x0000000002630000-0x00000000026A5000-memory.dmp
memory/2040-51-0x0000000002630000-0x00000000026A5000-memory.dmp
memory/2040-39-0x0000000010000000-0x000000001002D000-memory.dmp
memory/2040-48-0x000000006F740000-0x000000006F750000-memory.dmp
memory/2040-68-0x0000000002630000-0x00000000026A5000-memory.dmp
memory/2040-131-0x00000000045C0000-0x00000000046EA000-memory.dmp
memory/2040-69-0x0000000002630000-0x00000000026A5000-memory.dmp
memory/2040-70-0x0000000002630000-0x00000000026A5000-memory.dmp
memory/2040-78-0x0000000002630000-0x00000000026A5000-memory.dmp
memory/2040-77-0x0000000002630000-0x00000000026A5000-memory.dmp
memory/2040-76-0x0000000002630000-0x00000000026A5000-memory.dmp
memory/2040-75-0x0000000002630000-0x00000000026A5000-memory.dmp
memory/2040-74-0x0000000002630000-0x00000000026A5000-memory.dmp
memory/2040-73-0x0000000002630000-0x00000000026A5000-memory.dmp
memory/2040-72-0x0000000002630000-0x00000000026A5000-memory.dmp
memory/2040-71-0x0000000002630000-0x00000000026A5000-memory.dmp
memory/2040-79-0x0000000002630000-0x00000000026A5000-memory.dmp
memory/2040-80-0x0000000003430000-0x000000000347D000-memory.dmp
memory/2040-88-0x0000000003430000-0x000000000347D000-memory.dmp
memory/2040-87-0x0000000003430000-0x000000000347D000-memory.dmp
memory/2040-86-0x0000000003430000-0x000000000347D000-memory.dmp
memory/2040-120-0x00000000045C0000-0x00000000046EA000-memory.dmp
memory/2040-90-0x0000000003430000-0x000000000347D000-memory.dmp
memory/2040-99-0x0000000003430000-0x000000000347D000-memory.dmp
memory/2040-37-0x0000000000550000-0x0000000000556000-memory.dmp
memory/2040-92-0x0000000003430000-0x000000000347D000-memory.dmp
memory/2040-91-0x0000000003430000-0x000000000347D000-memory.dmp
memory/2040-98-0x0000000003430000-0x000000000347D000-memory.dmp
memory/2040-97-0x0000000003430000-0x000000000347D000-memory.dmp
memory/2040-100-0x0000000003430000-0x000000000347D000-memory.dmp
memory/2040-94-0x0000000003430000-0x000000000347D000-memory.dmp
memory/2040-93-0x0000000003430000-0x000000000347D000-memory.dmp
memory/2040-96-0x0000000003430000-0x000000000347D000-memory.dmp
memory/2040-101-0x00000000045C0000-0x00000000046EA000-memory.dmp
memory/2040-109-0x00000000045C0000-0x00000000046EA000-memory.dmp
memory/2040-118-0x00000000045C0000-0x00000000046EA000-memory.dmp
memory/2040-117-0x00000000045C0000-0x00000000046EA000-memory.dmp
memory/2040-116-0x00000000045C0000-0x00000000046EA000-memory.dmp
memory/2040-115-0x00000000045C0000-0x00000000046EA000-memory.dmp
memory/2040-114-0x00000000045C0000-0x00000000046EA000-memory.dmp
memory/2040-113-0x00000000045C0000-0x00000000046EA000-memory.dmp
memory/2040-112-0x00000000045C0000-0x00000000046EA000-memory.dmp
memory/2040-111-0x00000000045C0000-0x00000000046EA000-memory.dmp
memory/2040-110-0x00000000045C0000-0x00000000046EA000-memory.dmp
memory/2040-108-0x00000000045C0000-0x00000000046EA000-memory.dmp
memory/2040-107-0x00000000045C0000-0x00000000046EA000-memory.dmp
memory/2040-106-0x00000000045C0000-0x00000000046EA000-memory.dmp
memory/2040-121-0x0000000073430000-0x0000000073451000-memory.dmp
memory/2040-122-0x00000000045C0000-0x00000000046EA000-memory.dmp
memory/2788-8-0x00000000001E0000-0x00000000002BC000-memory.dmp
memory/2788-36-0x00000000001E0000-0x00000000002BC000-memory.dmp
memory/4688-0-0x00000000001E0000-0x00000000002BC000-memory.dmp
memory/4688-11-0x00000000001E0000-0x00000000002BC000-memory.dmp
memory/4728-5-0x0000000001440000-0x0000000001441000-memory.dmp
memory/4728-10-0x0000000000D80000-0x00000000011B7000-memory.dmp