Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
11/10/2026, 15:00
General
- Target 20018f354f7df2edf52aeda881bfad23.exe
- Size 2.0MB
- Sample261011-sdgsmsby9l
- SHA256 d077cd6d3d76021e95715bb48af8d6483206d2b903ce3096ab5c8107c33baa1f
Malware Config
Signatures
- Family: Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 2 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
- Enumerates video capture drivers 2 TTPs 2 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\20018f354f7df2edf52aeda881bfad23.exe"C:\Users\Admin\AppData\Local\Temp\20018f354f7df2edf52aeda881bfad23.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-T1033JK7AS.tmp\20018f354f7df2edf52aeda881bfad23.tmp"C:\Users\Admin\AppData\Local\Temp\is-T1033JK7AS.tmp\20018f354f7df2edf52aeda881bfad23.tmp" /SL5="$400AE,945919,842240,C:\Users\Admin\AppData\Local\Temp\20018f354f7df2edf52aeda881bfad23.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\KestrelDynamicsLtd\PatchLineUpdater\1.1.3822.2026101116002998\bin1\broker.exe"C:\Users\Admin\AppData\Local\KestrelDynamicsLtd\PatchLineUpdater\1.1.3822.2026101116002998\bin1\broker.exe" -Embedding3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\KestrelDynamicsLtd\PatchLineUpdater\1.1.3822.2026101116002998\bin2\netupd.exe"C:\Users\Admin\AppData\Local\KestrelDynamicsLtd\PatchLineUpdater\1.1.3822.2026101116002998\bin2\netupd.exe" -Embedding3⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\88787799\362608F6.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\60361603\D00712B3.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
GameuxInstallHelper.dll
broker.exe
GameuxInstallHelper.dll
netupd.exe
20018f354f7df2edf52aeda881bfad23.tmp
memory/1208-6-0x0000000002CF0000-0x0000000002CF1000-memory.dmp
memory/1208-75-0x00000000008C0000-0x0000000000CF7000-memory.dmp
memory/2320-0-0x00000000008E0000-0x00000000009BC000-memory.dmp
memory/2320-76-0x00000000008E0000-0x00000000009BC000-memory.dmp
memory/2432-125-0x0000000002C60000-0x0000000002CAD000-memory.dmp
memory/2432-144-0x0000000002C60000-0x0000000002CAD000-memory.dmp
memory/2432-57-0x00000000026C0000-0x000000000273C000-memory.dmp
memory/2432-49-0x00000000026C0000-0x000000000273C000-memory.dmp
memory/2432-45-0x000000006F250000-0x000000006F260000-memory.dmp
memory/2432-35-0x0000000010000000-0x000000001002D000-memory.dmp
memory/2432-67-0x00000000026C0000-0x000000000273C000-memory.dmp
memory/2432-66-0x00000000026C0000-0x000000000273C000-memory.dmp
memory/2432-65-0x00000000026C0000-0x000000000273C000-memory.dmp
memory/2432-63-0x00000000026C0000-0x000000000273C000-memory.dmp
memory/2432-61-0x00000000026C0000-0x000000000273C000-memory.dmp
memory/2432-58-0x00000000026C0000-0x000000000273C000-memory.dmp
memory/2432-56-0x00000000026C0000-0x000000000273C000-memory.dmp
memory/2432-64-0x00000000026C0000-0x000000000273C000-memory.dmp
memory/2432-62-0x00000000026C0000-0x000000000273C000-memory.dmp
memory/2432-60-0x00000000026C0000-0x000000000273C000-memory.dmp
memory/2432-59-0x00000000026C0000-0x000000000273C000-memory.dmp
memory/2432-69-0x00000000026C0000-0x000000000273C000-memory.dmp
memory/2432-80-0x00000000026C0000-0x000000000273C000-memory.dmp
memory/2432-81-0x00000000026C0000-0x000000000273C000-memory.dmp
memory/2432-163-0x0000000004580000-0x00000000046A9000-memory.dmp
memory/2432-164-0x0000000004580000-0x00000000046A9000-memory.dmp
memory/2432-142-0x0000000002C60000-0x0000000002CAD000-memory.dmp
memory/2432-137-0x0000000002C60000-0x0000000002CAD000-memory.dmp
memory/2432-136-0x0000000002C60000-0x0000000002CAD000-memory.dmp
memory/2432-138-0x0000000002C60000-0x0000000002CAD000-memory.dmp
memory/2432-139-0x0000000002C60000-0x0000000002CAD000-memory.dmp
memory/2432-140-0x0000000002C60000-0x0000000002CAD000-memory.dmp
memory/2432-143-0x0000000002C60000-0x0000000002CAD000-memory.dmp
memory/2432-68-0x00000000026C0000-0x000000000273C000-memory.dmp
memory/2432-141-0x0000000002C60000-0x0000000002CAD000-memory.dmp
memory/2432-135-0x0000000002C60000-0x0000000002CAD000-memory.dmp
memory/2432-134-0x0000000002C60000-0x0000000002CAD000-memory.dmp
memory/2432-34-0x00000000023A0000-0x0000000002441000-memory.dmp
memory/2432-131-0x0000000002C60000-0x0000000002CAD000-memory.dmp
memory/2432-129-0x0000000002C60000-0x0000000002CAD000-memory.dmp
memory/2432-130-0x0000000002C60000-0x0000000002CAD000-memory.dmp
memory/2432-123-0x00000000026C0000-0x000000000273C000-memory.dmp
memory/2432-132-0x0000000002C60000-0x0000000002CAD000-memory.dmp
memory/4616-114-0x0000000002690000-0x000000000270C000-memory.dmp
memory/4616-110-0x0000000002690000-0x000000000270C000-memory.dmp
memory/4616-108-0x0000000002690000-0x000000000270C000-memory.dmp
memory/4616-105-0x0000000002690000-0x000000000270C000-memory.dmp
memory/4616-104-0x0000000002690000-0x000000000270C000-memory.dmp
memory/4616-106-0x0000000002690000-0x000000000270C000-memory.dmp
memory/4616-107-0x0000000002690000-0x000000000270C000-memory.dmp
memory/4616-116-0x0000000002690000-0x000000000270C000-memory.dmp
memory/4616-115-0x0000000002690000-0x000000000270C000-memory.dmp
memory/4616-111-0x0000000002690000-0x000000000270C000-memory.dmp
memory/4616-121-0x0000000002690000-0x000000000270C000-memory.dmp
memory/4616-122-0x0000000002690000-0x000000000270C000-memory.dmp
memory/4616-109-0x0000000002690000-0x000000000270C000-memory.dmp
memory/4616-113-0x0000000002690000-0x000000000270C000-memory.dmp
memory/4616-117-0x0000000002690000-0x000000000270C000-memory.dmp
memory/4616-145-0x0000000002690000-0x000000000270C000-memory.dmp
memory/4616-146-0x0000000002C60000-0x0000000002CAD000-memory.dmp
memory/4616-154-0x0000000002C60000-0x0000000002CAD000-memory.dmp
memory/4616-153-0x0000000002C60000-0x0000000002CAD000-memory.dmp
memory/4616-152-0x0000000002C60000-0x0000000002CAD000-memory.dmp
memory/4616-151-0x0000000002C60000-0x0000000002CAD000-memory.dmp
memory/4616-112-0x0000000002690000-0x000000000270C000-memory.dmp
memory/4616-97-0x0000000002690000-0x000000000270C000-memory.dmp