Resubmissions
11-08-2022 15:58
220811-tezkhsbed4 1011-08-2022 15:43
220811-s5817shagk 1011-08-2022 15:40
220811-s4f9ssbcg8 1Analysis
-
max time kernel
500s -
max time network
551s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
11-08-2022 15:58
Static task
static1
Behavioral task
behavioral1
Sample
SOLICITUD DE COTIZACION AGOSTO2022.exe
Resource
win10v2004-20220721-en
windows10-2004-x64
6 signatures
600 seconds
General
-
Target
SOLICITUD DE COTIZACION AGOSTO2022.exe
-
Size
1.8MB
-
MD5
7ff53fc876eef0820b0aa10fa785ee0b
-
SHA1
30dd64bda5b153c9ffef8ec80f733f80e2711fa5
-
SHA256
870a008fca1426aee37c2e1c088c04a22a95d5023456ad14bfae8ca128c59000
-
SHA512
659a46853ecbe78f6f3a036f7da317fff17853d2d312b37f78c233b34c0eb925e9f805092bc6e5994f1c52bf58861634014042c449e369660a88cfde9d3559a3
Score
10/10
Malware Config
Signatures
-
Bandook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/4616-133-0x0000000013140000-0x0000000013C7D000-memory.dmp family_bandook behavioral1/memory/4616-134-0x0000000013140000-0x0000000013C7D000-memory.dmp family_bandook behavioral1/memory/4616-135-0x0000000013140000-0x0000000013C7D000-memory.dmp family_bandook behavioral1/memory/3156-140-0x0000000013140000-0x0000000013C7D000-memory.dmp family_bandook -
Processes:
resource yara_rule behavioral1/memory/4616-131-0x0000000013140000-0x0000000013C7D000-memory.dmp upx behavioral1/memory/4616-132-0x0000000013140000-0x0000000013C7D000-memory.dmp upx behavioral1/memory/4616-133-0x0000000013140000-0x0000000013C7D000-memory.dmp upx behavioral1/memory/4616-134-0x0000000013140000-0x0000000013C7D000-memory.dmp upx behavioral1/memory/4616-135-0x0000000013140000-0x0000000013C7D000-memory.dmp upx behavioral1/memory/3156-140-0x0000000013140000-0x0000000013C7D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msinfo32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Windows\CurrentVersion\Run msinfo32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GWLU = "C:\\Users\\Admin\\AppData\\Roaming\\GWLU\\GWLU.exe" msinfo32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msinfo32.exepid process 4616 msinfo32.exe 4616 msinfo32.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
SOLICITUD DE COTIZACION AGOSTO2022.exedescription pid process target process PID 1988 wrote to memory of 4616 1988 SOLICITUD DE COTIZACION AGOSTO2022.exe msinfo32.exe PID 1988 wrote to memory of 4616 1988 SOLICITUD DE COTIZACION AGOSTO2022.exe msinfo32.exe PID 1988 wrote to memory of 4616 1988 SOLICITUD DE COTIZACION AGOSTO2022.exe msinfo32.exe PID 1988 wrote to memory of 4616 1988 SOLICITUD DE COTIZACION AGOSTO2022.exe msinfo32.exe PID 1988 wrote to memory of 4616 1988 SOLICITUD DE COTIZACION AGOSTO2022.exe msinfo32.exe PID 1988 wrote to memory of 3156 1988 SOLICITUD DE COTIZACION AGOSTO2022.exe msinfo32.exe PID 1988 wrote to memory of 3156 1988 SOLICITUD DE COTIZACION AGOSTO2022.exe msinfo32.exe PID 1988 wrote to memory of 3156 1988 SOLICITUD DE COTIZACION AGOSTO2022.exe msinfo32.exe PID 1988 wrote to memory of 3156 1988 SOLICITUD DE COTIZACION AGOSTO2022.exe msinfo32.exe PID 1988 wrote to memory of 3156 1988 SOLICITUD DE COTIZACION AGOSTO2022.exe msinfo32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SOLICITUD DE COTIZACION AGOSTO2022.exe"C:\Users\Admin\AppData\Local\Temp\SOLICITUD DE COTIZACION AGOSTO2022.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\windows\SysWOW64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4616 -
C:\windows\SysWOW64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Adds Run key to start application
PID:3156
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3156-136-0x0000000000000000-mapping.dmp
-
memory/3156-140-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/4616-130-0x0000000000000000-mapping.dmp
-
memory/4616-131-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/4616-132-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/4616-133-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/4616-134-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/4616-135-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB