Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
01/09/2026, 03:30
General
- Target 爱接码平台客户端.exe
- Size 4.1MB
- Sample260901-d2mlgagr2z
- SHA256 2b371117fd3dc235ab72fa57397da7ed522ab65c665b2b0d62526ceafa3aa2c3
Malware Config
Signatures
- Family: Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 1 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 4 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 56 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\爱接码平台客户端.exe"C:\Users\Admin\AppData\Local\Temp\爱接码平台客户端.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-KBOZTQWCS1.tmp\爱接码平台客户端.tmp"C:\Users\Admin\AppData\Local\Temp\is-KBOZTQWCS1.tmp\爱接码平台客户端.tmp" /SL5="$50240,3054473,842240,C:\Users\Admin\AppData\Local\Temp\爱接码平台客户端.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\爱接码平台客户端.exe"C:\Users\Admin\AppData\Local\Temp\爱接码平台客户端.exe" /PASSWORD=oEbfBGbfPMmCxC5a3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-8DOZ5H35UE.tmp\爱接码平台客户端.tmp"C:\Users\Admin\AppData\Local\Temp\is-8DOZ5H35UE.tmp\爱接码平台客户端.tmp" /SL5="$60240,3054473,842240,C:\Users\Admin\AppData\Local\Temp\爱接码平台客户端.exe" /PASSWORD=oEbfBGbfPMmCxC5a4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f660b14b3dcd383b12d6788259751ae7.cache\daemon.exe"C:\Users\Admin\AppData\Local\Temp\f660b14b3dcd383b12d6788259751ae7.cache\daemon.exe" -Embedding5⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\B79CBAB8\0E9E05CB.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
GameuxInstallHelper.dll
daemon.exe
爱接码平台客户端.tmp
scr_initsetup.log
3b71e6cde8dac75d769a8ef2566a9700.tmp
memory/1372-16-0x0000000002E60000-0x0000000002E61000-memory.dmp
memory/1372-35-0x0000000000B00000-0x0000000000F37000-memory.dmp
memory/3796-1-0x0000000000B20000-0x0000000000BFC000-memory.dmp
memory/3796-11-0x0000000000B20000-0x0000000000BFC000-memory.dmp
memory/4560-5-0x0000000000A40000-0x0000000000A41000-memory.dmp
memory/4560-10-0x0000000000A60000-0x0000000000E97000-memory.dmp
memory/5260-8-0x0000000000B20000-0x0000000000BFC000-memory.dmp
memory/5260-36-0x0000000000B20000-0x0000000000BFC000-memory.dmp
memory/5676-88-0x00000000033B0000-0x00000000033FD000-memory.dmp
memory/5676-91-0x00000000033B0000-0x00000000033FD000-memory.dmp
memory/5676-58-0x0000000002600000-0x0000000002675000-memory.dmp
memory/5676-62-0x0000000002600000-0x0000000002675000-memory.dmp
memory/5676-61-0x0000000002600000-0x0000000002675000-memory.dmp
memory/5676-60-0x0000000002600000-0x0000000002675000-memory.dmp
memory/5676-59-0x0000000002600000-0x0000000002675000-memory.dmp
memory/5676-51-0x0000000002600000-0x0000000002675000-memory.dmp
memory/5676-38-0x0000000010000000-0x000000001002D000-memory.dmp
memory/5676-68-0x0000000002600000-0x0000000002675000-memory.dmp
memory/5676-69-0x0000000002600000-0x0000000002675000-memory.dmp
memory/5676-71-0x0000000002600000-0x0000000002675000-memory.dmp
memory/5676-78-0x0000000002600000-0x0000000002675000-memory.dmp
memory/5676-77-0x0000000002600000-0x0000000002675000-memory.dmp
memory/5676-76-0x0000000002600000-0x0000000002675000-memory.dmp
memory/5676-75-0x0000000002600000-0x0000000002675000-memory.dmp
memory/5676-74-0x0000000002600000-0x0000000002675000-memory.dmp
memory/5676-73-0x0000000002600000-0x0000000002675000-memory.dmp
memory/5676-72-0x0000000002600000-0x0000000002675000-memory.dmp
memory/5676-70-0x0000000002600000-0x0000000002675000-memory.dmp
memory/5676-79-0x0000000002600000-0x0000000002675000-memory.dmp
memory/5676-37-0x0000000000580000-0x0000000000586000-memory.dmp
memory/5676-87-0x00000000033B0000-0x00000000033FD000-memory.dmp
memory/5676-86-0x00000000033B0000-0x00000000033FD000-memory.dmp
memory/5676-85-0x00000000033B0000-0x00000000033FD000-memory.dmp
memory/5676-80-0x00000000033B0000-0x00000000033FD000-memory.dmp
memory/5676-90-0x00000000033B0000-0x00000000033FD000-memory.dmp
memory/5676-48-0x000000006F690000-0x000000006F6A0000-memory.dmp
memory/5676-92-0x00000000033B0000-0x00000000033FD000-memory.dmp
memory/5676-100-0x00000000033B0000-0x00000000033FD000-memory.dmp
memory/5676-99-0x00000000033B0000-0x00000000033FD000-memory.dmp
memory/5676-98-0x00000000033B0000-0x00000000033FD000-memory.dmp
memory/5676-97-0x00000000033B0000-0x00000000033FD000-memory.dmp
memory/5676-96-0x00000000033B0000-0x00000000033FD000-memory.dmp
memory/5676-95-0x00000000033B0000-0x00000000033FD000-memory.dmp
memory/5676-93-0x00000000033B0000-0x00000000033FD000-memory.dmp
memory/5676-94-0x00000000033B0000-0x00000000033FD000-memory.dmp
memory/5676-101-0x0000000073380000-0x00000000733A1000-memory.dmp
memory/5676-107-0x0000000004610000-0x000000000473A000-memory.dmp
memory/5676-117-0x0000000004610000-0x000000000473A000-memory.dmp
memory/5676-119-0x0000000004610000-0x000000000473A000-memory.dmp
memory/5676-118-0x0000000004610000-0x000000000473A000-memory.dmp
memory/5676-116-0x0000000004610000-0x000000000473A000-memory.dmp
memory/5676-115-0x0000000004610000-0x000000000473A000-memory.dmp
memory/5676-114-0x0000000004610000-0x000000000473A000-memory.dmp
memory/5676-113-0x0000000004610000-0x000000000473A000-memory.dmp
memory/5676-112-0x0000000004610000-0x000000000473A000-memory.dmp
memory/5676-111-0x0000000004610000-0x000000000473A000-memory.dmp
memory/5676-110-0x0000000004610000-0x000000000473A000-memory.dmp
memory/5676-109-0x0000000004610000-0x000000000473A000-memory.dmp
memory/5676-108-0x0000000004610000-0x000000000473A000-memory.dmp
memory/5676-102-0x0000000004610000-0x000000000473A000-memory.dmp
memory/5676-121-0x0000000004610000-0x000000000473A000-memory.dmp
memory/5676-122-0x0000000004610000-0x000000000473A000-memory.dmp
memory/5676-131-0x0000000004610000-0x000000000473A000-memory.dmp