Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
08/11/2026, 04:31
General
- Target 6d694b7d64972343268a01f67def71e845edf3c693f48e533b6616e8031911e9.exe
- Size 1.2MB
- Sample261108-e5cfcahx7w
- SHA256 6d694b7d64972343268a01f67def71e845edf3c693f48e533b6616e8031911e9
Malware Config
Signatures
- Family: Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- UAC bypass 3 TTPs 4 IoCs
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 5 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- UPX packed file 15 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- System policy modification 1 TTPs 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d694b7d64972343268a01f67def71e845edf3c693f48e533b6616e8031911e9.exe"C:\Users\Admin\AppData\Local\Temp\6d694b7d64972343268a01f67def71e845edf3c693f48e533b6616e8031911e9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6d694b7d64972343268a01f67def71e845edf3c693f48e533b6616e8031911e9.exe"C:\Users\Admin\AppData\Local\Temp\6d694b7d64972343268a01f67def71e845edf3c693f48e533b6616e8031911e9.exe"2⤵
-
-
C:\ProgramData\Virtual_Windows\WinComboExt.exe"C:\ProgramData\Virtual_Windows\WinComboExt.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\Virtual_Windows\WinComboExt.exe"C:\ProgramData\Virtual_Windows\WinComboExt.exe"3⤵
- Executes dropped EXE
-
-
-
C:\ProgramData\Virtual_Windows\WinComboExt.exe"C:\ProgramData\Virtual_Windows\WinComboExt.exe"1⤵
- UAC bypass
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\Virtual_Windows\WinComboExt.exe"C:\ProgramData\Virtual_Windows\WinComboExt.exe"2⤵
- Executes dropped EXE
-
-
C:\ProgramData\Virtual_Windows\Security_Module.datC:\ProgramData\Virtual_Windows\Security_Module.dat1⤵
- Executes dropped EXE
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\ACEC3503\AA0EE452.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
Security_Module.dat
WinComboExt.exe
h_x64_4B02AE74F25A4AEB8C8938E23759EC10_0.dat
s_x64_4B02AE74F25A4AEB8C8938E23759EC10_0.dat
b56c1a5c6514675357777722b9a59bfc
memory/1564-19-0x0000000140000000-0x000000014002C000-memory.dmp
memory/1564-18-0x0000000140000000-0x000000014002C000-memory.dmp
memory/1564-17-0x0000000140000000-0x000000014002C000-memory.dmp
memory/1564-16-0x0000000140000000-0x000000014002C000-memory.dmp
memory/1564-15-0x0000000140000000-0x000000014002C000-memory.dmp
memory/1936-6-0x0000015051550000-0x0000015051551000-memory.dmp
memory/1936-5-0x000001504FB00000-0x000001504FB25000-memory.dmp
memory/1936-2-0x0000000140000000-0x000000014002C000-memory.dmp
memory/1936-1-0x0000000140000000-0x000000014002C000-memory.dmp
memory/1936-0-0x0000000140000000-0x000000014002C000-memory.dmp
memory/1936-7-0x0000000140000000-0x000000014002C000-memory.dmp
memory/1936-3-0x0000000140000000-0x000000014002C000-memory.dmp
memory/1936-4-0x0000000140000000-0x000000014002C000-memory.dmp
memory/2220-26-0x0000000140000000-0x000000014002C000-memory.dmp
memory/2220-28-0x0000000140000000-0x000000014002C000-memory.dmp
memory/2220-29-0x0000000140000000-0x000000014002C000-memory.dmp
memory/2220-27-0x0000000140000000-0x000000014002C000-memory.dmp
memory/2528-112-0x000002B864A30000-0x000002B864ACE000-memory.dmp
memory/2528-91-0x000002B864A30000-0x000002B864ACE000-memory.dmp
memory/2528-139-0x000002B864B20000-0x000002B864B7C000-memory.dmp
memory/2528-138-0x000002B864B20000-0x000002B864B7C000-memory.dmp
memory/2528-140-0x000002B864B20000-0x000002B864B7C000-memory.dmp
memory/2528-141-0x000002B864B20000-0x000002B864B7C000-memory.dmp
memory/2528-142-0x000002B864B20000-0x000002B864B7C000-memory.dmp
memory/2528-137-0x000002B864B20000-0x000002B864B7C000-memory.dmp
memory/2528-132-0x000002B864B20000-0x000002B864B7C000-memory.dmp
memory/2528-133-0x000002B864B20000-0x000002B864B7C000-memory.dmp
memory/2528-134-0x000002B864B20000-0x000002B864B7C000-memory.dmp
memory/2528-135-0x000002B864B20000-0x000002B864B7C000-memory.dmp
memory/2528-114-0x000002B864A30000-0x000002B864ACE000-memory.dmp
memory/2528-113-0x000002B864A30000-0x000002B864ACE000-memory.dmp
memory/2528-131-0x00007FFDB2610000-0x00007FFDB2805000-memory.dmp
memory/2528-111-0x000002B864A30000-0x000002B864ACE000-memory.dmp
memory/2528-110-0x000002B864A30000-0x000002B864ACE000-memory.dmp
memory/2528-109-0x000002B864A30000-0x000002B864ACE000-memory.dmp
memory/2528-108-0x000002B864A30000-0x000002B864ACE000-memory.dmp
memory/2528-107-0x000002B864A30000-0x000002B864ACE000-memory.dmp
memory/2528-106-0x000002B864A30000-0x000002B864ACE000-memory.dmp
memory/2528-105-0x000002B864A30000-0x000002B864ACE000-memory.dmp
memory/2528-104-0x000002B864A30000-0x000002B864ACE000-memory.dmp
memory/2528-103-0x000002B864A30000-0x000002B864ACE000-memory.dmp
memory/2528-102-0x000002B864A30000-0x000002B864ACE000-memory.dmp
memory/2528-101-0x000002B864A30000-0x000002B864ACE000-memory.dmp
memory/2528-100-0x00007FFDB2610000-0x00007FFDB2805000-memory.dmp
memory/2528-125-0x000002B864B20000-0x000002B864B7C000-memory.dmp
memory/2528-124-0x000002B864A30000-0x000002B864ACE000-memory.dmp
memory/2528-122-0x000002B864A30000-0x000002B864ACE000-memory.dmp
memory/2528-123-0x000002B864A30000-0x000002B864ACE000-memory.dmp
memory/4020-72-0x0000026A84DE0000-0x0000026A84E7E000-memory.dmp
memory/4020-58-0x00007FFDB2610000-0x00007FFDB2805000-memory.dmp
memory/4020-46-0x00007FFD72610000-0x00007FFD72620000-memory.dmp
memory/4020-34-0x0000000180000000-0x000000018003A000-memory.dmp
memory/4020-22-0x0000026A849D0000-0x0000026A84BD0000-memory.dmp
memory/4020-120-0x0000026A84DE0000-0x0000026A84E7E000-memory.dmp
memory/4020-61-0x0000026A84DE0000-0x0000026A84E7E000-memory.dmp
memory/4020-45-0x0000026A84D10000-0x0000026A84DDD000-memory.dmp
memory/4020-121-0x00007FFDB2610000-0x00007FFDB2805000-memory.dmp
memory/4020-62-0x0000026A84DE0000-0x0000026A84E7E000-memory.dmp
memory/4020-59-0x0000026A84DE0000-0x0000026A84E7E000-memory.dmp
memory/4020-60-0x0000026A84DE0000-0x0000026A84E7E000-memory.dmp
memory/4020-49-0x0000026A84DE0000-0x0000026A84E7E000-memory.dmp
memory/4020-63-0x0000026A84DE0000-0x0000026A84E7E000-memory.dmp
memory/4020-64-0x0000026A84DE0000-0x0000026A84E7E000-memory.dmp
memory/4020-65-0x0000026A84DE0000-0x0000026A84E7E000-memory.dmp
memory/4020-66-0x0000026A84DE0000-0x0000026A84E7E000-memory.dmp
memory/4020-67-0x0000026A84DE0000-0x0000026A84E7E000-memory.dmp
memory/4020-68-0x0000026A84DE0000-0x0000026A84E7E000-memory.dmp
memory/4020-69-0x0000026A84DE0000-0x0000026A84E7E000-memory.dmp
memory/4020-70-0x0000026A84DE0000-0x0000026A84E7E000-memory.dmp
memory/4020-71-0x0000026A84DE0000-0x0000026A84E7E000-memory.dmp