Analysis
- user interaction
yes - max time kernel
287s - max time network
292s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
10/09/2026, 10:53
General
- Target xrkAwe_Sun16.6.exe
- Size 161.0MB
- Sample260910-myyc8ssanh
- SHA256 a80f48a1dceb0bdd4e1c1d483e3b1260f557e7fe7da59e99146e760ee289ce29
Malware Config
Signatures
- Family: Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 1 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 5 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\xrkAwe_Sun16.6.exe"C:\Users\Admin\AppData\Local\Temp\xrkAwe_Sun16.6.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-OIAJRKND1D.tmp\xrkAwe_Sun16.6.tmp"C:\Users\Admin\AppData\Local\Temp\is-OIAJRKND1D.tmp\xrkAwe_Sun16.6.tmp" /SL5="$502C4,167487216,1051648,C:\Users\Admin\AppData\Local\Temp\xrkAwe_Sun16.6.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xrkAwe_Sun16.6.exe"C:\Users\Admin\AppData\Local\Temp\xrkAwe_Sun16.6.exe" /PASSWORD=uDdOSsWmNVfmwIMU3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-08O7WQR6CU.tmp\xrkAwe_Sun16.6.tmp"C:\Users\Admin\AppData\Local\Temp\is-08O7WQR6CU.tmp\xrkAwe_Sun16.6.tmp" /SL5="$602C4,167487216,1051648,C:\Users\Admin\AppData\Local\Temp\xrkAwe_Sun16.6.exe" /PASSWORD=uDdOSsWmNVfmwIMU4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2ece199fc51a948a061c9bfc0bd0c3de.cfg\proxy.exe"C:\Users\Admin\AppData\Local\Temp\2ece199fc51a948a061c9bfc0bd0c3de.cfg\proxy.exe" -Embedding5⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\2ece199fc51a948a061c9bfc0bd0c3de.cfg\AweSun_16.5.0.30757_x64.exe"C:\Users\Admin\AppData\Local\Temp\2ece199fc51a948a061c9bfc0bd0c3de.cfg\AweSun_16.5.0.30757_x64.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2ece199fc51a948a061c9bfc0bd0c3de.cfg\AweSun_16.5.0.30757_x64.exe"C:\Users\Admin\AppData\Local\Temp\2ece199fc51a948a061c9bfc0bd0c3de.cfg\AweSun_16.5.0.30757_x64.exe" --mod=install --admin=16⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\F0AFE262\B1E4D9A3.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
GameuxInstallHelper.dll
proxy.exe
check_sign_test.log
xrkAwe_Sun16.6.tmp
scr_initsetup.log
5d755c6376f01b562c3bbfcd9e37a593.tmp
memory/1648-5-0x00000000019F0000-0x00000000019F1000-memory.dmp
memory/1648-8-0x0000000000FF0000-0x000000000145B000-memory.dmp
memory/2404-49-0x0000000000130000-0x000000000059B000-memory.dmp
memory/2404-15-0x0000000001650000-0x0000000001651000-memory.dmp
memory/2404-25-0x0000000001650000-0x0000000001651000-memory.dmp
memory/2404-24-0x0000000000130000-0x000000000059B000-memory.dmp
memory/2788-95-0x00000000026F0000-0x0000000002765000-memory.dmp
memory/2788-108-0x0000000002E40000-0x0000000002E8D000-memory.dmp
memory/2788-156-0x0000000004660000-0x000000000478A000-memory.dmp
memory/2788-144-0x0000000004660000-0x000000000478A000-memory.dmp
memory/2788-145-0x00000000729D0000-0x00000000729F1000-memory.dmp
memory/2788-58-0x00000000009F0000-0x00000000009F6000-memory.dmp
memory/2788-61-0x0000000010000000-0x000000001002D000-memory.dmp
memory/2788-71-0x000000006EF80000-0x000000006EF90000-memory.dmp
memory/2788-83-0x00000000026F0000-0x0000000002765000-memory.dmp
memory/2788-85-0x00000000026F0000-0x0000000002765000-memory.dmp
memory/2788-84-0x00000000026F0000-0x0000000002765000-memory.dmp
memory/2788-82-0x00000000026F0000-0x0000000002765000-memory.dmp
memory/2788-81-0x00000000026F0000-0x0000000002765000-memory.dmp
memory/2788-74-0x00000000026F0000-0x0000000002765000-memory.dmp
memory/2788-91-0x00000000026F0000-0x0000000002765000-memory.dmp
memory/2788-143-0x0000000004660000-0x000000000478A000-memory.dmp
memory/2788-92-0x00000000026F0000-0x0000000002765000-memory.dmp
memory/2788-93-0x00000000026F0000-0x0000000002765000-memory.dmp
memory/2788-100-0x00000000026F0000-0x0000000002765000-memory.dmp
memory/2788-101-0x00000000026F0000-0x0000000002765000-memory.dmp
memory/2788-99-0x00000000026F0000-0x0000000002765000-memory.dmp
memory/2788-98-0x00000000026F0000-0x0000000002765000-memory.dmp
memory/2788-97-0x00000000026F0000-0x0000000002765000-memory.dmp
memory/2788-96-0x00000000026F0000-0x0000000002765000-memory.dmp
memory/2788-124-0x0000000004660000-0x000000000478A000-memory.dmp
memory/2788-94-0x00000000026F0000-0x0000000002765000-memory.dmp
memory/2788-102-0x00000000026F0000-0x0000000002765000-memory.dmp
memory/2788-103-0x0000000002E40000-0x0000000002E8D000-memory.dmp
memory/2788-111-0x0000000002E40000-0x0000000002E8D000-memory.dmp
memory/2788-110-0x0000000002E40000-0x0000000002E8D000-memory.dmp
memory/2788-109-0x0000000002E40000-0x0000000002E8D000-memory.dmp
memory/2788-131-0x0000000004660000-0x000000000478A000-memory.dmp
memory/2788-113-0x0000000002E40000-0x0000000002E8D000-memory.dmp
memory/2788-114-0x0000000002E40000-0x0000000002E8D000-memory.dmp
memory/2788-123-0x0000000002E40000-0x0000000002E8D000-memory.dmp
memory/2788-122-0x0000000002E40000-0x0000000002E8D000-memory.dmp
memory/2788-121-0x0000000002E40000-0x0000000002E8D000-memory.dmp
memory/2788-120-0x0000000002E40000-0x0000000002E8D000-memory.dmp
memory/2788-119-0x0000000002E40000-0x0000000002E8D000-memory.dmp
memory/2788-118-0x0000000002E40000-0x0000000002E8D000-memory.dmp
memory/2788-117-0x0000000002E40000-0x0000000002E8D000-memory.dmp
memory/2788-116-0x0000000002E40000-0x0000000002E8D000-memory.dmp
memory/2788-115-0x0000000002E40000-0x0000000002E8D000-memory.dmp
memory/2788-129-0x0000000004660000-0x000000000478A000-memory.dmp
memory/2788-133-0x0000000004660000-0x000000000478A000-memory.dmp
memory/2788-141-0x0000000004660000-0x000000000478A000-memory.dmp
memory/2788-140-0x0000000004660000-0x000000000478A000-memory.dmp
memory/2788-138-0x0000000004660000-0x000000000478A000-memory.dmp
memory/2788-137-0x0000000004660000-0x000000000478A000-memory.dmp
memory/2788-136-0x0000000004660000-0x000000000478A000-memory.dmp
memory/2788-135-0x0000000004660000-0x000000000478A000-memory.dmp
memory/2788-134-0x0000000004660000-0x000000000478A000-memory.dmp
memory/2788-132-0x0000000004660000-0x000000000478A000-memory.dmp
memory/2788-130-0x0000000004660000-0x000000000478A000-memory.dmp
memory/2788-139-0x0000000004660000-0x000000000478A000-memory.dmp
memory/2796-0-0x00000000008F0000-0x00000000009FF000-memory.dmp
memory/2796-11-0x00000000008F0000-0x00000000009FF000-memory.dmp
memory/3588-54-0x00007FF689170000-0x00007FF68A170000-memory.dmp
memory/4316-23-0x00000000008F0000-0x00000000009FF000-memory.dmp
memory/4316-9-0x00000000008F0000-0x00000000009FF000-memory.dmp
memory/4316-50-0x00000000008F0000-0x00000000009FF000-memory.dmp