Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
08/11/2026, 04:30
General
- Target 6ec5be082561161cdfab4494db7097be5ca5cdf1d442e28523df60fff1d1c4a2.exe
- Size 1.2MB
- Sample261108-e5b5kshx7t
- SHA256 6ec5be082561161cdfab4494db7097be5ca5cdf1d442e28523df60fff1d1c4a2
Malware Config
Signatures
- Family: Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- UAC bypass 3 TTPs 4 IoCs
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 5 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- System policy modification 1 TTPs 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ec5be082561161cdfab4494db7097be5ca5cdf1d442e28523df60fff1d1c4a2.exe"C:\Users\Admin\AppData\Local\Temp\6ec5be082561161cdfab4494db7097be5ca5cdf1d442e28523df60fff1d1c4a2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6ec5be082561161cdfab4494db7097be5ca5cdf1d442e28523df60fff1d1c4a2.exe"C:\Users\Admin\AppData\Local\Temp\6ec5be082561161cdfab4494db7097be5ca5cdf1d442e28523df60fff1d1c4a2.exe"2⤵
-
-
C:\ProgramData\Virtual_Windows\WinComboExt.exe"C:\ProgramData\Virtual_Windows\WinComboExt.exe"2⤵
- UAC bypass
- Downloads MZ/PE file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\Virtual_Windows\WinComboExt.exe"C:\ProgramData\Virtual_Windows\WinComboExt.exe"3⤵
- Executes dropped EXE
-
-
-
C:\ProgramData\Virtual_Windows\Security_Module.datC:\ProgramData\Virtual_Windows\Security_Module.dat1⤵
- Executes dropped EXE
-
C:\ProgramData\Virtual_Windows\WinComboExt.exe"C:\ProgramData\Virtual_Windows\WinComboExt.exe"1⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\Virtual_Windows\WinComboExt.exe"C:\ProgramData\Virtual_Windows\WinComboExt.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\7B3BDD0C\850D0FBB.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
Security_Module.dat
WinComboExt.exe
523aba0da52ee6e699ce2e4a9e561684.tmp
memory/5180-3-0x0000000140000000-0x000000014002C000-memory.dmp
memory/5180-2-0x0000000140000000-0x000000014002C000-memory.dmp
memory/5180-1-0x0000000140000000-0x000000014002C000-memory.dmp
memory/5180-0-0x0000000140000000-0x000000014002C000-memory.dmp
memory/5180-5-0x0000020AE4010000-0x0000020AE4035000-memory.dmp
memory/5180-6-0x0000020AE5A60000-0x0000020AE5A61000-memory.dmp
memory/5180-4-0x0000000140000000-0x000000014002C000-memory.dmp
memory/5180-7-0x0000000140000000-0x000000014002C000-memory.dmp
memory/5580-31-0x0000000140000000-0x000000014002C000-memory.dmp
memory/5580-28-0x0000000140000000-0x000000014002C000-memory.dmp
memory/5580-29-0x0000000140000000-0x000000014002C000-memory.dmp
memory/5580-30-0x0000000140000000-0x000000014002C000-memory.dmp
memory/5732-117-0x000001F5E8EB0000-0x000001F5E8F4E000-memory.dmp
memory/5732-110-0x000001F5E8EB0000-0x000001F5E8F4E000-memory.dmp
memory/5732-109-0x000001F5E8EB0000-0x000001F5E8F4E000-memory.dmp
memory/5732-114-0x000001F5E8EB0000-0x000001F5E8F4E000-memory.dmp
memory/5732-120-0x000001F5E8EB0000-0x000001F5E8F4E000-memory.dmp
memory/5732-108-0x00007FFF4C9D0000-0x00007FFF4CBC5000-memory.dmp
memory/5732-111-0x000001F5E8EB0000-0x000001F5E8F4E000-memory.dmp
memory/5732-123-0x000001F5E8EB0000-0x000001F5E8F4E000-memory.dmp
memory/5732-124-0x00007FFF4C9D0000-0x00007FFF4CBC5000-memory.dmp
memory/5732-112-0x000001F5E8EB0000-0x000001F5E8F4E000-memory.dmp
memory/5732-113-0x000001F5E8EB0000-0x000001F5E8F4E000-memory.dmp
memory/5732-115-0x000001F5E8EB0000-0x000001F5E8F4E000-memory.dmp
memory/5732-116-0x000001F5E8EB0000-0x000001F5E8F4E000-memory.dmp
memory/5732-118-0x000001F5E8EB0000-0x000001F5E8F4E000-memory.dmp
memory/5732-119-0x000001F5E8EB0000-0x000001F5E8F4E000-memory.dmp
memory/5732-121-0x000001F5E8EB0000-0x000001F5E8F4E000-memory.dmp
memory/5732-122-0x000001F5E8EB0000-0x000001F5E8F4E000-memory.dmp
memory/5732-99-0x000001F5E8EB0000-0x000001F5E8F4E000-memory.dmp
memory/6112-50-0x000001E8A8650000-0x000001E8A86EE000-memory.dmp
memory/6112-46-0x000001E8A8120000-0x000001E8A81ED000-memory.dmp
memory/6112-177-0x000001E8A8310000-0x000001E8A8510000-memory.dmp
memory/6112-60-0x000001E8A8650000-0x000001E8A86EE000-memory.dmp
memory/6112-59-0x00007FFF4C9D0000-0x00007FFF4CBC5000-memory.dmp
memory/6112-35-0x0000000180000000-0x000000018003A000-memory.dmp
memory/6112-79-0x000001E8A8650000-0x000001E8A86EE000-memory.dmp
memory/6112-80-0x000001E8A8650000-0x000001E8A86EE000-memory.dmp
memory/6112-125-0x000001E8A8650000-0x000001E8A86EE000-memory.dmp
memory/6112-65-0x000001E8A8650000-0x000001E8A86EE000-memory.dmp
memory/6112-66-0x000001E8A8650000-0x000001E8A86EE000-memory.dmp
memory/6112-67-0x000001E8A8650000-0x000001E8A86EE000-memory.dmp
memory/6112-68-0x000001E8A8650000-0x000001E8A86EE000-memory.dmp
memory/6112-69-0x000001E8A8650000-0x000001E8A86EE000-memory.dmp
memory/6112-70-0x000001E8A8650000-0x000001E8A86EE000-memory.dmp
memory/6112-71-0x000001E8A8650000-0x000001E8A86EE000-memory.dmp
memory/6112-72-0x000001E8A8650000-0x000001E8A86EE000-memory.dmp
memory/6112-73-0x000001E8A8650000-0x000001E8A86EE000-memory.dmp
memory/6112-63-0x000001E8A8650000-0x000001E8A86EE000-memory.dmp
memory/6112-47-0x00007FFF0C9D0000-0x00007FFF0C9E0000-memory.dmp
memory/6112-62-0x000001E8A8650000-0x000001E8A86EE000-memory.dmp
memory/6112-64-0x000001E8A8650000-0x000001E8A86EE000-memory.dmp
memory/6112-61-0x000001E8A8650000-0x000001E8A86EE000-memory.dmp
memory/6112-126-0x000001E8A8720000-0x000001E8A877C000-memory.dmp
memory/6112-133-0x000001E8A8720000-0x000001E8A877C000-memory.dmp
memory/6112-134-0x000001E8A8720000-0x000001E8A877C000-memory.dmp
memory/6112-23-0x000001E8A8310000-0x000001E8A8510000-memory.dmp
memory/6112-139-0x000001E8A8720000-0x000001E8A877C000-memory.dmp
memory/6112-136-0x000001E8A8720000-0x000001E8A877C000-memory.dmp
memory/6112-132-0x00007FFF4C9D0000-0x00007FFF4CBC5000-memory.dmp
memory/6112-135-0x000001E8A8720000-0x000001E8A877C000-memory.dmp
memory/6112-138-0x000001E8A8720000-0x000001E8A877C000-memory.dmp
memory/6112-142-0x000001E8A8720000-0x000001E8A877C000-memory.dmp
memory/6112-140-0x000001E8A8720000-0x000001E8A877C000-memory.dmp
memory/6112-141-0x000001E8A8720000-0x000001E8A877C000-memory.dmp
memory/6112-143-0x000001E8A8720000-0x000001E8A877C000-memory.dmp
memory/6116-14-0x0000000140000000-0x000000014002C000-memory.dmp
memory/6116-16-0x0000000140000000-0x000000014002C000-memory.dmp
memory/6116-17-0x0000000140000000-0x000000014002C000-memory.dmp
memory/6116-19-0x0000000140000000-0x000000014002C000-memory.dmp
memory/6116-20-0x0000000140000000-0x000000014002C000-memory.dmp
memory/6116-18-0x0000000140000000-0x000000014002C000-memory.dmp