Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
08/11/2026, 04:27
General
- Target 4393997d6104118b7f436671b5649458c38dd9839f1a0a42e85173ec57c8525e.exe
- Size 1.7MB
- Sample261108-e3hvcaxway
- SHA256 4393997d6104118b7f436671b5649458c38dd9839f1a0a42e85173ec57c8525e
Malware Config
Signatures
- Family: Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- UAC bypass 3 TTPs 4 IoCs
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 5 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- UPX packed file 15 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- System policy modification 1 TTPs 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4393997d6104118b7f436671b5649458c38dd9839f1a0a42e85173ec57c8525e.exe"C:\Users\Admin\AppData\Local\Temp\4393997d6104118b7f436671b5649458c38dd9839f1a0a42e85173ec57c8525e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4393997d6104118b7f436671b5649458c38dd9839f1a0a42e85173ec57c8525e.exe"C:\Users\Admin\AppData\Local\Temp\4393997d6104118b7f436671b5649458c38dd9839f1a0a42e85173ec57c8525e.exe"2⤵
-
-
C:\ProgramData\Virtual_Windows\WinComboExt.exe"C:\ProgramData\Virtual_Windows\WinComboExt.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\Virtual_Windows\WinComboExt.exe"C:\ProgramData\Virtual_Windows\WinComboExt.exe"3⤵
- Executes dropped EXE
-
-
-
C:\ProgramData\Virtual_Windows\WinComboExt.exe"C:\ProgramData\Virtual_Windows\WinComboExt.exe"1⤵
- UAC bypass
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\Virtual_Windows\WinComboExt.exe"C:\ProgramData\Virtual_Windows\WinComboExt.exe"2⤵
- Executes dropped EXE
-
-
C:\ProgramData\Virtual_Windows\Security_Module.datC:\ProgramData\Virtual_Windows\Security_Module.dat1⤵
- Executes dropped EXE
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\DF17CE53\814B7F4C.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
Security_Module.dat
WinComboExt.exe
h_x64_4B02AE74F25A4AEB8C8938E23759EC10_0.dat
s_x64_4B02AE74F25A4AEB8C8938E23759EC10_0.dat
32348e6594935dd3091506e1f0927fed
memory/732-45-0x00007FFEC88B0000-0x00007FFEC88C0000-memory.dmp
memory/732-71-0x000002260B340000-0x000002260B3DE000-memory.dmp
memory/732-57-0x00007FFF088B0000-0x00007FFF08AA5000-memory.dmp
memory/732-114-0x000002260B340000-0x000002260B3DE000-memory.dmp
memory/732-65-0x000002260B340000-0x000002260B3DE000-memory.dmp
memory/732-66-0x000002260B340000-0x000002260B3DE000-memory.dmp
memory/732-115-0x00007FFF088B0000-0x00007FFF08AA5000-memory.dmp
memory/732-67-0x000002260B340000-0x000002260B3DE000-memory.dmp
memory/732-68-0x000002260B340000-0x000002260B3DE000-memory.dmp
memory/732-69-0x000002260B340000-0x000002260B3DE000-memory.dmp
memory/732-22-0x0000022608600000-0x0000022608800000-memory.dmp
memory/732-60-0x000002260B340000-0x000002260B3DE000-memory.dmp
memory/732-61-0x000002260B340000-0x000002260B3DE000-memory.dmp
memory/732-62-0x000002260B340000-0x000002260B3DE000-memory.dmp
memory/732-63-0x000002260B340000-0x000002260B3DE000-memory.dmp
memory/732-34-0x0000000180000000-0x000000018003A000-memory.dmp
memory/732-64-0x000002260B340000-0x000002260B3DE000-memory.dmp
memory/732-48-0x000002260B340000-0x000002260B3DE000-memory.dmp
memory/732-58-0x000002260B340000-0x000002260B3DE000-memory.dmp
memory/732-59-0x000002260B340000-0x000002260B3DE000-memory.dmp
memory/732-70-0x000002260B340000-0x000002260B3DE000-memory.dmp
memory/1660-15-0x0000000140000000-0x000000014002C000-memory.dmp
memory/1660-16-0x0000000140000000-0x000000014002C000-memory.dmp
memory/1660-17-0x0000000140000000-0x000000014002C000-memory.dmp
memory/1660-19-0x0000000140000000-0x000000014002C000-memory.dmp
memory/1660-18-0x0000000140000000-0x000000014002C000-memory.dmp
memory/2712-112-0x000001B039740000-0x000001B0397DE000-memory.dmp
memory/2712-131-0x000001B039820000-0x000001B03987C000-memory.dmp
memory/2712-139-0x000001B039820000-0x000001B03987C000-memory.dmp
memory/2712-137-0x000001B039820000-0x000001B03987C000-memory.dmp
memory/2712-138-0x000001B039820000-0x000001B03987C000-memory.dmp
memory/2712-140-0x000001B039820000-0x000001B03987C000-memory.dmp
memory/2712-113-0x000001B039740000-0x000001B0397DE000-memory.dmp
memory/2712-111-0x000001B039740000-0x000001B0397DE000-memory.dmp
memory/2712-110-0x000001B039740000-0x000001B0397DE000-memory.dmp
memory/2712-109-0x000001B039740000-0x000001B0397DE000-memory.dmp
memory/2712-108-0x000001B039740000-0x000001B0397DE000-memory.dmp
memory/2712-107-0x000001B039740000-0x000001B0397DE000-memory.dmp
memory/2712-106-0x000001B039740000-0x000001B0397DE000-memory.dmp
memory/2712-105-0x000001B039740000-0x000001B0397DE000-memory.dmp
memory/2712-104-0x000001B039740000-0x000001B0397DE000-memory.dmp
memory/2712-103-0x000001B039740000-0x000001B0397DE000-memory.dmp
memory/2712-102-0x000001B039740000-0x000001B0397DE000-memory.dmp
memory/2712-101-0x000001B039740000-0x000001B0397DE000-memory.dmp
memory/2712-100-0x000001B039740000-0x000001B0397DE000-memory.dmp
memory/2712-99-0x00007FFF088B0000-0x00007FFF08AA5000-memory.dmp
memory/2712-90-0x000001B039740000-0x000001B0397DE000-memory.dmp
memory/2712-141-0x000001B039820000-0x000001B03987C000-memory.dmp
memory/2712-136-0x000001B039820000-0x000001B03987C000-memory.dmp
memory/2712-124-0x000001B039820000-0x000001B03987C000-memory.dmp
memory/2712-130-0x00007FFF088B0000-0x00007FFF08AA5000-memory.dmp
memory/2712-132-0x000001B039820000-0x000001B03987C000-memory.dmp
memory/2712-133-0x000001B039820000-0x000001B03987C000-memory.dmp
memory/2712-121-0x000001B039740000-0x000001B0397DE000-memory.dmp
memory/2712-122-0x000001B039740000-0x000001B0397DE000-memory.dmp
memory/2712-134-0x000001B039820000-0x000001B03987C000-memory.dmp
memory/2712-123-0x000001B039740000-0x000001B0397DE000-memory.dmp
memory/4084-2-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4084-0-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4084-3-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4084-7-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4084-5-0x000002A3239D0000-0x000002A3239F5000-memory.dmp
memory/4084-1-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4084-6-0x000002A323B30000-0x000002A323B31000-memory.dmp
memory/4084-4-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4248-27-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4248-29-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4248-28-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4248-26-0x0000000140000000-0x000000014002C000-memory.dmp