Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
08/11/2026, 03:32
General
- Target 4a3384a86035cc34513f513b6a5ad6e6fa1a9b4b875e79d57f8053f25023736a.exe
- Size 664KB
- Sample261108-d3vy8sty2k
- SHA256 4a3384a86035cc34513f513b6a5ad6e6fa1a9b4b875e79d57f8053f25023736a
Malware Config
Signatures
- Family: Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- UAC bypass 3 TTPs 4 IoCs
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 5 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- System policy modification 1 TTPs 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a3384a86035cc34513f513b6a5ad6e6fa1a9b4b875e79d57f8053f25023736a.exe"C:\Users\Admin\AppData\Local\Temp\4a3384a86035cc34513f513b6a5ad6e6fa1a9b4b875e79d57f8053f25023736a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4a3384a86035cc34513f513b6a5ad6e6fa1a9b4b875e79d57f8053f25023736a.exe"C:\Users\Admin\AppData\Local\Temp\4a3384a86035cc34513f513b6a5ad6e6fa1a9b4b875e79d57f8053f25023736a.exe"2⤵
-
-
C:\ProgramData\Virtual_Windows\WinComboEx.exe"C:\ProgramData\Virtual_Windows\WinComboEx.exe"2⤵
- UAC bypass
- Downloads MZ/PE file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\Virtual_Windows\WinComboEx.exe"C:\ProgramData\Virtual_Windows\WinComboEx.exe"3⤵
- Executes dropped EXE
-
-
-
C:\ProgramData\Virtual_Windows\Security_Module.datC:\ProgramData\Virtual_Windows\Security_Module.dat1⤵
- Executes dropped EXE
-
C:\ProgramData\Virtual_Windows\WinComboEx.exe"C:\ProgramData\Virtual_Windows\WinComboEx.exe"1⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\Virtual_Windows\WinComboEx.exe"C:\ProgramData\Virtual_Windows\WinComboEx.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\C3558162\47AE1530.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
Security_Module.dat
WinComboEx.exe
h_x64_4B02AE74F25A4AEB8C8938E23759EC10_0.dat
s_x64_4B02AE74F25A4AEB8C8938E23759EC10_0.dat
1cd39f00a324e86c8e7e95b5f1dcc090
memory/1924-1-0x0000000140000000-0x000000014002C000-memory.dmp
memory/1924-6-0x000002117DC00000-0x000002117DC01000-memory.dmp
memory/1924-2-0x0000000140000000-0x000000014002C000-memory.dmp
memory/1924-4-0x0000000140000000-0x000000014002C000-memory.dmp
memory/1924-8-0x000002117D960000-0x000002117D985000-memory.dmp
memory/1924-5-0x0000000140000000-0x000000014002C000-memory.dmp
memory/1924-3-0x0000000140000000-0x000000014002C000-memory.dmp
memory/1924-7-0x0000000140000000-0x000000014002C000-memory.dmp
memory/2316-113-0x00007FF8132B0000-0x00007FF8134A5000-memory.dmp
memory/2316-118-0x00000267970C0000-0x000002679715E000-memory.dmp
memory/2316-120-0x00000267970C0000-0x000002679715E000-memory.dmp
memory/2316-130-0x00000267970C0000-0x000002679715E000-memory.dmp
memory/2316-104-0x00000267970C0000-0x000002679715E000-memory.dmp
memory/2316-131-0x00007FF8132B0000-0x00007FF8134A5000-memory.dmp
memory/2316-115-0x00000267970C0000-0x000002679715E000-memory.dmp
memory/2316-116-0x00000267970C0000-0x000002679715E000-memory.dmp
memory/2316-117-0x00000267970C0000-0x000002679715E000-memory.dmp
memory/2316-114-0x00000267970C0000-0x000002679715E000-memory.dmp
memory/2316-30-0x00007FF7AB4A0000-0x00007FF7AB5F1000-memory.dmp
memory/2316-119-0x00000267970C0000-0x000002679715E000-memory.dmp
memory/2316-121-0x00000267970C0000-0x000002679715E000-memory.dmp
memory/2316-122-0x00000267970C0000-0x000002679715E000-memory.dmp
memory/2316-123-0x00000267970C0000-0x000002679715E000-memory.dmp
memory/2316-124-0x00000267970C0000-0x000002679715E000-memory.dmp
memory/2316-125-0x00000267970C0000-0x000002679715E000-memory.dmp
memory/2316-126-0x00000267970C0000-0x000002679715E000-memory.dmp
memory/2316-127-0x00000267970C0000-0x000002679715E000-memory.dmp
memory/2316-148-0x00007FF7AB4A0000-0x00007FF7AB5F1000-memory.dmp
memory/2328-70-0x00000221343F0000-0x000002213448E000-memory.dmp
memory/2328-143-0x0000022134490000-0x00000221344EC000-memory.dmp
memory/2328-75-0x00000221343F0000-0x000002213448E000-memory.dmp
memory/2328-74-0x00000221343F0000-0x000002213448E000-memory.dmp
memory/2328-73-0x00000221343F0000-0x000002213448E000-memory.dmp
memory/2328-72-0x00000221343F0000-0x000002213448E000-memory.dmp
memory/2328-71-0x00000221343F0000-0x000002213448E000-memory.dmp
memory/2328-188-0x0000022133FE0000-0x00000221341E0000-memory.dmp
memory/2328-69-0x00000221343F0000-0x000002213448E000-memory.dmp
memory/2328-68-0x00000221343F0000-0x000002213448E000-memory.dmp
memory/2328-66-0x00007FF8132B0000-0x00007FF8134A5000-memory.dmp
memory/2328-77-0x00000221343F0000-0x000002213448E000-memory.dmp
memory/2328-78-0x00000221343F0000-0x000002213448E000-memory.dmp
memory/2328-80-0x00000221343F0000-0x000002213448E000-memory.dmp
memory/2328-128-0x00000221343F0000-0x000002213448E000-memory.dmp
memory/2328-129-0x00000221343F0000-0x000002213448E000-memory.dmp
memory/2328-79-0x00000221343F0000-0x000002213448E000-memory.dmp
memory/2328-67-0x00000221343F0000-0x000002213448E000-memory.dmp
memory/2328-42-0x0000000180000000-0x000000018003A000-memory.dmp
memory/2328-54-0x00007FF7D32B0000-0x00007FF7D32C0000-memory.dmp
memory/2328-57-0x00000221343F0000-0x000002213448E000-memory.dmp
memory/2328-53-0x0000022134320000-0x00000221343ED000-memory.dmp
memory/2328-150-0x0000022134490000-0x00000221344EC000-memory.dmp
memory/2328-152-0x0000022134490000-0x00000221344EC000-memory.dmp
memory/2328-159-0x00007FF7AB4A0000-0x00007FF7AB5F1000-memory.dmp
memory/2328-151-0x0000022134490000-0x00000221344EC000-memory.dmp
memory/2328-147-0x0000022134490000-0x00000221344EC000-memory.dmp
memory/2328-149-0x0000022134490000-0x00000221344EC000-memory.dmp
memory/2328-15-0x00007FF7AB4A0000-0x00007FF7AB5F1000-memory.dmp
memory/2328-135-0x0000022134490000-0x00000221344EC000-memory.dmp
memory/2328-27-0x0000022133FE0000-0x00000221341E0000-memory.dmp
memory/2328-141-0x0000022134490000-0x00000221344EC000-memory.dmp
memory/2328-142-0x0000022134490000-0x00000221344EC000-memory.dmp
memory/2328-76-0x00000221343F0000-0x000002213448E000-memory.dmp
memory/2328-133-0x00000221343F0000-0x000002213448E000-memory.dmp
memory/2328-140-0x00007FF8132B0000-0x00007FF8134A5000-memory.dmp
memory/2328-144-0x0000022134490000-0x00000221344EC000-memory.dmp
memory/2832-36-0x0000000140000000-0x000000014002C000-memory.dmp
memory/2832-35-0x0000000140000000-0x000000014002C000-memory.dmp
memory/2832-34-0x0000000140000000-0x000000014002C000-memory.dmp
memory/2832-33-0x0000000140000000-0x000000014002C000-memory.dmp
memory/2852-39-0x00007FF688DC0000-0x00007FF688F11000-memory.dmp
memory/2852-0-0x00007FF688DC0000-0x00007FF688F11000-memory.dmp
memory/5008-21-0x0000000140000000-0x000000014002C000-memory.dmp
memory/5008-23-0x0000000140000000-0x000000014002C000-memory.dmp
memory/5008-22-0x00007FF7AB4A0000-0x00007FF7AB5F1000-memory.dmp
memory/5008-20-0x0000000140000000-0x000000014002C000-memory.dmp
memory/5008-19-0x0000000140000000-0x000000014002C000-memory.dmp
memory/5008-18-0x0000000140000000-0x000000014002C000-memory.dmp