Overview
overview
10Static
static
037ff659cb...8f.exe
windows7_x64
10037ff659cb...8f.exe
windows10_x64
82fc92db641...fc.exe
windows7_x64
102fc92db641...fc.exe
windows10_x64
858c6424d1d...ed.exe
windows7_x64
1058c6424d1d...ed.exe
windows10_x64
8bc089259a1...5d.exe
windows7_x64
10bc089259a1...5d.exe
windows10_x64
10d3e7b5be90...57.exe
windows7_x64
10d3e7b5be90...57.exe
windows10_x64
8e72ace3a76...eb.exe
windows7_x64
10e72ace3a76...eb.exe
windows10_x64
10Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
16-07-2021 17:35
Static task
static1
Behavioral task
behavioral1
Sample
037ff659cb188100251c228a1babe2cd3bc3aaa43e0039555e12c232a8b9f38f.exe
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral2
Sample
037ff659cb188100251c228a1babe2cd3bc3aaa43e0039555e12c232a8b9f38f.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral3
Sample
2fc92db641004976273712cdacab3f1416b6f7fcb8a6019bbb6ca539e9effefc.exe
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral4
Sample
2fc92db641004976273712cdacab3f1416b6f7fcb8a6019bbb6ca539e9effefc.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral5
Sample
58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral6
Sample
58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral7
Sample
bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral8
Sample
bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral9
Sample
d3e7b5be903eb9a596b9b2b78e5dd28390c6aadb8bdd4ea1ba3d896d99fa0057.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral10
Sample
d3e7b5be903eb9a596b9b2b78e5dd28390c6aadb8bdd4ea1ba3d896d99fa0057.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral11
Sample
e72ace3a76024645161ecb73c57083d38b85594df5117de94d782df9f48a10eb.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral12
Sample
e72ace3a76024645161ecb73c57083d38b85594df5117de94d782df9f48a10eb.exe
Resource
win10v20210410
windows10_x64
General
-
Target
bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe
Malware Config
Signatures
-
Bandook Payload 2 IoCs
resource yara_rule behavioral7/memory/1620-62-0x0000000013C8F890-mapping.dmp family_bandook behavioral7/memory/1164-71-0x0000000013C8F890-mapping.dmp family_bandook -
resource yara_rule behavioral7/memory/1620-61-0x0000000013140000-0x0000000013CEB000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\wlobmncxhgiofafdhdwo = "C:\\Users\\Admin\\AppData\\Roaming\\wlobmncxhgiofafdhdwo\\wlobmncxhgiofafdhdwo.exe" iexplore.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1944 set thread context of 1620 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 29 PID 1944 set thread context of 740 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 30 PID 1944 set thread context of 996 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 31 PID 1944 set thread context of 1164 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1620 iexplore.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1944 wrote to memory of 1620 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 29 PID 1944 wrote to memory of 1620 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 29 PID 1944 wrote to memory of 1620 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 29 PID 1944 wrote to memory of 1620 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 29 PID 1944 wrote to memory of 1620 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 29 PID 1944 wrote to memory of 1620 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 29 PID 1944 wrote to memory of 740 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 30 PID 1944 wrote to memory of 740 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 30 PID 1944 wrote to memory of 740 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 30 PID 1944 wrote to memory of 740 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 30 PID 1944 wrote to memory of 740 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 30 PID 1944 wrote to memory of 740 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 30 PID 1944 wrote to memory of 996 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 31 PID 1944 wrote to memory of 996 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 31 PID 1944 wrote to memory of 996 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 31 PID 1944 wrote to memory of 996 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 31 PID 1944 wrote to memory of 996 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 31 PID 1944 wrote to memory of 996 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 31 PID 1944 wrote to memory of 1164 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 32 PID 1944 wrote to memory of 1164 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 32 PID 1944 wrote to memory of 1164 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 32 PID 1944 wrote to memory of 1164 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 32 PID 1944 wrote to memory of 1164 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 32 PID 1944 wrote to memory of 1164 1944 bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe"C:\Users\Admin\AppData\Local\Temp\bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1620
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Adds Run key to start application
PID:740
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵PID:996
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵PID:1164
-