Analysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
07/11/2026, 12:27
General
- Target 4bbb7e869ee5b8f23abc53970833900f7551db4387bc1798b1566dc9936f5ba0.exe
- Size 693KB
- Sample261107-pm5z2seh63
- SHA256 4bbb7e869ee5b8f23abc53970833900f7551db4387bc1798b1566dc9936f5ba0
Malware Config
Signatures
- Family: Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Downloads MZ/PE file 17 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 17 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4bbb7e869ee5b8f23abc53970833900f7551db4387bc1798b1566dc9936f5ba0.exe"C:\Users\Admin\AppData\Local\Temp\4bbb7e869ee5b8f23abc53970833900f7551db4387bc1798b1566dc9936f5ba0.exe"1⤵
- Downloads MZ/PE file
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4bbb7e869ee5b8f23abc53970833900f7551db4387bc1798b1566dc9936f5ba0.exe"C:\Users\Admin\AppData\Local\Temp\4bbb7e869ee5b8f23abc53970833900f7551db4387bc1798b1566dc9936f5ba0.exe"2⤵
-
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\79867305\692FE6C1.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2D8C92D0.dat
692FE6C1.exe
692FE6C1.vbs
goufu.txt
libluajit.dll
vcruntime140.dll
memory/3260-76-0x0000022C228E0000-0x0000022C2293C000-memory.dmp
memory/3260-98-0x0000022C23B40000-0x0000022C23C7D000-memory.dmp
memory/3260-40-0x0000022C227A0000-0x0000022C2283E000-memory.dmp
memory/3260-50-0x0000022C227A0000-0x0000022C2283E000-memory.dmp
memory/3260-49-0x0000022C227A0000-0x0000022C2283E000-memory.dmp
memory/3260-36-0x00007FFB29920000-0x00007FFB29B83000-memory.dmp
memory/3260-73-0x0000022C228E0000-0x0000022C2293C000-memory.dmp
memory/3260-48-0x0000022C227A0000-0x0000022C2283E000-memory.dmp
memory/3260-47-0x0000022C227A0000-0x0000022C2283E000-memory.dmp
memory/3260-70-0x0000022C228E0000-0x0000022C2293C000-memory.dmp
memory/3260-45-0x0000022C227A0000-0x0000022C2283E000-memory.dmp
memory/3260-44-0x0000022C227A0000-0x0000022C2283E000-memory.dmp
memory/3260-43-0x0000022C227A0000-0x0000022C2283E000-memory.dmp
memory/3260-42-0x0000022C227A0000-0x0000022C2283E000-memory.dmp
memory/3260-39-0x0000022C227A0000-0x0000022C2283E000-memory.dmp
memory/3260-38-0x0000022C227A0000-0x0000022C2283E000-memory.dmp
memory/3260-37-0x0000022C227A0000-0x0000022C2283E000-memory.dmp
memory/3260-54-0x0000022C227A0000-0x0000022C2283E000-memory.dmp
memory/3260-55-0x0000022C227A0000-0x0000022C2283E000-memory.dmp
memory/3260-56-0x0000022C227A0000-0x0000022C2283E000-memory.dmp
memory/3260-64-0x0000022C228E0000-0x0000022C2293C000-memory.dmp
memory/3260-67-0x0000022C228E0000-0x0000022C2293C000-memory.dmp
memory/3260-63-0x00007FFB29920000-0x00007FFB29B83000-memory.dmp
memory/3260-66-0x0000022C228E0000-0x0000022C2293C000-memory.dmp
memory/3260-65-0x0000022C228E0000-0x0000022C2293C000-memory.dmp
memory/3260-57-0x0000022C228E0000-0x0000022C2293C000-memory.dmp
memory/3260-69-0x0000022C228E0000-0x0000022C2293C000-memory.dmp
memory/3260-71-0x0000022C228E0000-0x0000022C2293C000-memory.dmp
memory/3260-79-0x0000022C228E0000-0x0000022C2293C000-memory.dmp
memory/3260-78-0x0000022C228E0000-0x0000022C2293C000-memory.dmp
memory/3260-77-0x0000022C228E0000-0x0000022C2293C000-memory.dmp
memory/3260-9-0x0000022C209C0000-0x0000022C20AC0000-memory.dmp
memory/3260-75-0x0000022C228E0000-0x0000022C2293C000-memory.dmp
memory/3260-74-0x0000022C228E0000-0x0000022C2293C000-memory.dmp
memory/3260-28-0x0000022C227A0000-0x0000022C2283E000-memory.dmp
memory/3260-23-0x0000022C22690000-0x0000022C2275D000-memory.dmp
memory/3260-46-0x0000022C227A0000-0x0000022C2283E000-memory.dmp
memory/3260-80-0x0000022C23B40000-0x0000022C23C7D000-memory.dmp
memory/3260-88-0x0000022C23B40000-0x0000022C23C7D000-memory.dmp
memory/3260-99-0x0000022C23B40000-0x0000022C23C7D000-memory.dmp
memory/3260-72-0x0000022C228E0000-0x0000022C2293C000-memory.dmp
memory/3260-97-0x0000022C23B40000-0x0000022C23C7D000-memory.dmp
memory/3260-96-0x0000022C23B40000-0x0000022C23C7D000-memory.dmp
memory/3260-95-0x0000022C23B40000-0x0000022C23C7D000-memory.dmp
memory/3260-94-0x0000022C23B40000-0x0000022C23C7D000-memory.dmp
memory/3260-93-0x0000022C23B40000-0x0000022C23C7D000-memory.dmp
memory/3260-92-0x0000022C23B40000-0x0000022C23C7D000-memory.dmp
memory/3260-91-0x0000022C23B40000-0x0000022C23C7D000-memory.dmp
memory/3260-90-0x0000022C23B40000-0x0000022C23C7D000-memory.dmp
memory/3260-89-0x0000022C23B40000-0x0000022C23C7D000-memory.dmp
memory/3260-86-0x00007FFB29920000-0x00007FFB29B83000-memory.dmp
memory/3260-87-0x0000022C23B40000-0x0000022C23C7D000-memory.dmp
memory/3260-101-0x0000022C23B40000-0x0000022C23C7D000-memory.dmp
memory/3260-102-0x0000022C23B40000-0x0000022C23C7D000-memory.dmp
memory/3260-108-0x0000022C227A0000-0x0000022C2283E000-memory.dmp
memory/3260-109-0x0000022C227A0000-0x0000022C2283E000-memory.dmp
memory/3260-110-0x0000022C209C0000-0x0000022C20AC0000-memory.dmp
memory/3260-111-0x0000022C227A0000-0x0000022C2283E000-memory.dmp
memory/3260-112-0x0000022C228E0000-0x0000022C2293C000-memory.dmp
memory/3260-12-0x0000000180000000-0x000000018003A000-memory.dmp
memory/3260-24-0x00007FFAE9990000-0x00007FFAE99A0000-memory.dmp
memory/3260-41-0x0000022C227A0000-0x0000022C2283E000-memory.dmp
memory/4104-1-0x000001CC82390000-0x000001CC82391000-memory.dmp
memory/4104-0-0x000001CC82080000-0x000001CC820A5000-memory.dmp
memory/4104-7-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4104-6-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4104-5-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4104-4-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4104-3-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4104-2-0x0000000140000000-0x000000014002C000-memory.dmp