Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
08/11/2026, 04:31
General
- Target 35fa880749410630c93184ce4055c71ca2f0569caa450769addc66006efb7c26.exe
- Size 1.2MB
- Sample261108-e5dcmsxwbw
- SHA256 35fa880749410630c93184ce4055c71ca2f0569caa450769addc66006efb7c26
Malware Config
Signatures
- Family: Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- UAC bypass 3 TTPs 4 IoCs
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 5 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- System policy modification 1 TTPs 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\35fa880749410630c93184ce4055c71ca2f0569caa450769addc66006efb7c26.exe"C:\Users\Admin\AppData\Local\Temp\35fa880749410630c93184ce4055c71ca2f0569caa450769addc66006efb7c26.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\35fa880749410630c93184ce4055c71ca2f0569caa450769addc66006efb7c26.exe"C:\Users\Admin\AppData\Local\Temp\35fa880749410630c93184ce4055c71ca2f0569caa450769addc66006efb7c26.exe"2⤵
-
-
C:\ProgramData\Virtual_Windows\WinComboExt.exe"C:\ProgramData\Virtual_Windows\WinComboExt.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\Virtual_Windows\WinComboExt.exe"C:\ProgramData\Virtual_Windows\WinComboExt.exe"3⤵
- Executes dropped EXE
-
-
-
C:\ProgramData\Virtual_Windows\Security_Module.datC:\ProgramData\Virtual_Windows\Security_Module.dat1⤵
- Executes dropped EXE
-
C:\ProgramData\Virtual_Windows\WinComboExt.exe"C:\ProgramData\Virtual_Windows\WinComboExt.exe"1⤵
- UAC bypass
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\Virtual_Windows\WinComboExt.exe"C:\ProgramData\Virtual_Windows\WinComboExt.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\C3558162\47AE1530.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
Security_Module.dat
WinComboExt.exe
h_x64_4B02AE74F25A4AEB8C8938E23759EC10_0.dat
s_x64_4B02AE74F25A4AEB8C8938E23759EC10_0.dat
1cd39f00a324e86c8e7e95b5f1dcc090
memory/1368-16-0x0000000140000000-0x000000014002C000-memory.dmp
memory/1368-17-0x0000000140000000-0x000000014002C000-memory.dmp
memory/1368-18-0x0000000140000000-0x000000014002C000-memory.dmp
memory/1368-20-0x0000000140000000-0x000000014002C000-memory.dmp
memory/1368-19-0x0000000140000000-0x000000014002C000-memory.dmp
memory/3448-101-0x0000018395360000-0x00000183953FE000-memory.dmp
memory/3448-105-0x0000018395360000-0x00000183953FE000-memory.dmp
memory/3448-111-0x0000018395360000-0x00000183953FE000-memory.dmp
memory/3448-100-0x00007FF970450000-0x00007FF970645000-memory.dmp
memory/3448-116-0x0000018395360000-0x00000183953FE000-memory.dmp
memory/3448-117-0x00007FF970450000-0x00007FF970645000-memory.dmp
memory/3448-23-0x0000018394FF0000-0x00000183951F0000-memory.dmp
memory/3448-103-0x0000018395360000-0x00000183953FE000-memory.dmp
memory/3448-104-0x0000018395360000-0x00000183953FE000-memory.dmp
memory/3448-102-0x0000018395360000-0x00000183953FE000-memory.dmp
memory/3448-106-0x0000018395360000-0x00000183953FE000-memory.dmp
memory/3448-107-0x0000018395360000-0x00000183953FE000-memory.dmp
memory/3448-108-0x0000018395360000-0x00000183953FE000-memory.dmp
memory/3448-109-0x0000018395360000-0x00000183953FE000-memory.dmp
memory/3448-110-0x0000018395360000-0x00000183953FE000-memory.dmp
memory/3448-91-0x0000018395360000-0x00000183953FE000-memory.dmp
memory/3448-115-0x0000018394E10000-0x0000018394EDD000-memory.dmp
memory/3448-114-0x0000018395360000-0x00000183953FE000-memory.dmp
memory/3448-113-0x0000018395360000-0x00000183953FE000-memory.dmp
memory/3448-112-0x0000018395360000-0x00000183953FE000-memory.dmp
memory/4280-29-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4280-28-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4280-31-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4280-30-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4480-126-0x000001EA78660000-0x000001EA786BC000-memory.dmp
memory/4480-59-0x000001EA78570000-0x000001EA7860E000-memory.dmp
memory/4480-50-0x000001EA78570000-0x000001EA7860E000-memory.dmp
memory/4480-65-0x000001EA78570000-0x000001EA7860E000-memory.dmp
memory/4480-72-0x000001EA78570000-0x000001EA7860E000-memory.dmp
memory/4480-139-0x000001EA78660000-0x000001EA786BC000-memory.dmp
memory/4480-140-0x000001EA78660000-0x000001EA786BC000-memory.dmp
memory/4480-141-0x000001EA78660000-0x000001EA786BC000-memory.dmp
memory/4480-142-0x000001EA78660000-0x000001EA786BC000-memory.dmp
memory/4480-143-0x000001EA78660000-0x000001EA786BC000-memory.dmp
memory/4480-70-0x000001EA78570000-0x000001EA7860E000-memory.dmp
memory/4480-69-0x000001EA78570000-0x000001EA7860E000-memory.dmp
memory/4480-68-0x000001EA78570000-0x000001EA7860E000-memory.dmp
memory/4480-67-0x000001EA78570000-0x000001EA7860E000-memory.dmp
memory/4480-66-0x000001EA78570000-0x000001EA7860E000-memory.dmp
memory/4480-64-0x000001EA78570000-0x000001EA7860E000-memory.dmp
memory/4480-63-0x000001EA78570000-0x000001EA7860E000-memory.dmp
memory/4480-62-0x000001EA78570000-0x000001EA7860E000-memory.dmp
memory/4480-61-0x000001EA78570000-0x000001EA7860E000-memory.dmp
memory/4480-60-0x000001EA78570000-0x000001EA7860E000-memory.dmp
memory/4480-35-0x0000000180000000-0x000000018003A000-memory.dmp
memory/4480-58-0x00007FF970450000-0x00007FF970645000-memory.dmp
memory/4480-138-0x000001EA78660000-0x000001EA786BC000-memory.dmp
memory/4480-46-0x00007FF930450000-0x00007FF930460000-memory.dmp
memory/4480-133-0x000001EA78660000-0x000001EA786BC000-memory.dmp
memory/4480-134-0x000001EA78660000-0x000001EA786BC000-memory.dmp
memory/4480-124-0x000001EA78570000-0x000001EA7860E000-memory.dmp
memory/4480-123-0x000001EA78570000-0x000001EA7860E000-memory.dmp
memory/4480-135-0x000001EA78660000-0x000001EA786BC000-memory.dmp
memory/4480-125-0x000001EA78570000-0x000001EA7860E000-memory.dmp
memory/4480-71-0x000001EA78570000-0x000001EA7860E000-memory.dmp
memory/4480-132-0x00007FF970450000-0x00007FF970645000-memory.dmp
memory/4480-136-0x000001EA78660000-0x000001EA786BC000-memory.dmp
memory/4952-7-0x000002DCB59E0000-0x000002DCB59E1000-memory.dmp
memory/4952-8-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4952-5-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4952-6-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4952-4-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4952-3-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4952-1-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4952-2-0x0000000140000000-0x000000014002C000-memory.dmp
memory/4952-0-0x000002DCB5840000-0x000002DCB5865000-memory.dmp