Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
07/11/2026, 13:46
General
- Target fd84b8da6b82e4d566f293944403a5635cd531ad7b2eeb825b6d99bdfc0a356d.exe
- Size 689KB
- Sample261107-q3engafa92
- SHA256 fd84b8da6b82e4d566f293944403a5635cd531ad7b2eeb825b6d99bdfc0a356d
Malware Config
Signatures
- Family: Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Downloads MZ/PE file 1 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 38 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd84b8da6b82e4d566f293944403a5635cd531ad7b2eeb825b6d99bdfc0a356d.exe"C:\Users\Admin\AppData\Local\Temp\fd84b8da6b82e4d566f293944403a5635cd531ad7b2eeb825b6d99bdfc0a356d.exe"1⤵
- Downloads MZ/PE file
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fd84b8da6b82e4d566f293944403a5635cd531ad7b2eeb825b6d99bdfc0a356d.exe"C:\Users\Admin\AppData\Local\Temp\fd84b8da6b82e4d566f293944403a5635cd531ad7b2eeb825b6d99bdfc0a356d.exe"2⤵
-
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\E20C540E\83B29B51.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
d8055d7f071f956037eca5b14c30bc27
memory/2884-1-0x000001EE4ACD0000-0x000001EE4ACD1000-memory.dmp
memory/2884-0-0x000001EE4AD30000-0x000001EE4AD55000-memory.dmp
memory/2884-2-0x0000000140000000-0x000000014002C000-memory.dmp
memory/2884-6-0x0000000140000000-0x000000014002C000-memory.dmp
memory/2884-7-0x0000000140000000-0x000000014002C000-memory.dmp
memory/2884-8-0x0000000140000000-0x000000014002C000-memory.dmp
memory/2884-5-0x0000000140000000-0x000000014002C000-memory.dmp
memory/2884-3-0x0000000140000000-0x000000014002C000-memory.dmp
memory/2884-4-0x0000000140000000-0x000000014002C000-memory.dmp
memory/3236-10-0x00000266494C0000-0x00000266496C0000-memory.dmp
memory/3236-13-0x0000000180000000-0x000000018003A000-memory.dmp
memory/3236-41-0x000002664AFB0000-0x000002664B04E000-memory.dmp
memory/3236-51-0x000002664AFB0000-0x000002664B04E000-memory.dmp
memory/3236-50-0x000002664AFB0000-0x000002664B04E000-memory.dmp
memory/3236-49-0x000002664AFB0000-0x000002664B04E000-memory.dmp
memory/3236-48-0x000002664AFB0000-0x000002664B04E000-memory.dmp
memory/3236-47-0x000002664AFB0000-0x000002664B04E000-memory.dmp
memory/3236-46-0x000002664AFB0000-0x000002664B04E000-memory.dmp
memory/3236-45-0x000002664AFB0000-0x000002664B04E000-memory.dmp
memory/3236-44-0x000002664AFB0000-0x000002664B04E000-memory.dmp
memory/3236-43-0x000002664AFB0000-0x000002664B04E000-memory.dmp
memory/3236-42-0x000002664AFB0000-0x000002664B04E000-memory.dmp
memory/3236-40-0x000002664AFB0000-0x000002664B04E000-memory.dmp
memory/3236-39-0x000002664AFB0000-0x000002664B04E000-memory.dmp
memory/3236-37-0x00007FFF8C3B0000-0x00007FFF8C5A5000-memory.dmp
memory/3236-38-0x000002664AFB0000-0x000002664B04E000-memory.dmp
memory/3236-28-0x000002664AFB0000-0x000002664B04E000-memory.dmp
memory/3236-27-0x000002664AEB0000-0x000002664AF7D000-memory.dmp
memory/3236-24-0x00007FFF4C3B0000-0x00007FFF4C3C0000-memory.dmp
memory/3236-57-0x000002664AFB0000-0x000002664B04E000-memory.dmp
memory/3236-58-0x000002664AFB0000-0x000002664B04E000-memory.dmp
memory/3236-59-0x000002664AFB0000-0x000002664B04E000-memory.dmp
memory/3236-70-0x000002664B0B0000-0x000002664B10C000-memory.dmp
memory/3236-69-0x000002664B0B0000-0x000002664B10C000-memory.dmp
memory/3236-68-0x000002664B0B0000-0x000002664B10C000-memory.dmp
memory/3236-67-0x000002664B0B0000-0x000002664B10C000-memory.dmp
memory/3236-66-0x00007FFF8C3B0000-0x00007FFF8C5A5000-memory.dmp
memory/3236-60-0x000002664B0B0000-0x000002664B10C000-memory.dmp
memory/3236-73-0x000002664B0B0000-0x000002664B10C000-memory.dmp
memory/3236-72-0x000002664B0B0000-0x000002664B10C000-memory.dmp
memory/3236-78-0x000002664B0B0000-0x000002664B10C000-memory.dmp
memory/3236-82-0x000002664B0B0000-0x000002664B10C000-memory.dmp
memory/3236-81-0x000002664B0B0000-0x000002664B10C000-memory.dmp
memory/3236-80-0x000002664B0B0000-0x000002664B10C000-memory.dmp
memory/3236-79-0x000002664B0B0000-0x000002664B10C000-memory.dmp
memory/3236-77-0x000002664B0B0000-0x000002664B10C000-memory.dmp
memory/3236-76-0x000002664B0B0000-0x000002664B10C000-memory.dmp
memory/3236-74-0x000002664B0B0000-0x000002664B10C000-memory.dmp
memory/3236-75-0x000002664B0B0000-0x000002664B10C000-memory.dmp
memory/3236-100-0x000002664C410000-0x000002664C54D000-memory.dmp
memory/3236-102-0x000002664C410000-0x000002664C54D000-memory.dmp
memory/3236-99-0x000002664C410000-0x000002664C54D000-memory.dmp
memory/3236-97-0x000002664C410000-0x000002664C54D000-memory.dmp
memory/3236-96-0x000002664C410000-0x000002664C54D000-memory.dmp
memory/3236-95-0x000002664C410000-0x000002664C54D000-memory.dmp
memory/3236-94-0x000002664C410000-0x000002664C54D000-memory.dmp
memory/3236-92-0x000002664C410000-0x000002664C54D000-memory.dmp
memory/3236-91-0x000002664C410000-0x000002664C54D000-memory.dmp
memory/3236-90-0x000002664C410000-0x000002664C54D000-memory.dmp
memory/3236-98-0x000002664C410000-0x000002664C54D000-memory.dmp
memory/3236-93-0x000002664C410000-0x000002664C54D000-memory.dmp
memory/3236-89-0x00007FFF8C3B0000-0x00007FFF8C5A5000-memory.dmp
memory/3236-83-0x000002664C410000-0x000002664C54D000-memory.dmp
memory/3236-101-0x000002664C410000-0x000002664C54D000-memory.dmp
memory/3236-104-0x000002664C410000-0x000002664C54D000-memory.dmp
memory/3236-105-0x000002664C410000-0x000002664C54D000-memory.dmp
memory/3236-111-0x00000266494C0000-0x00000266496C0000-memory.dmp
memory/3236-115-0x000002664C410000-0x000002664C54D000-memory.dmp