Analysis
-
max time kernel
496s -
max time network
1743s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
07-10-2022 00:49
Static task
static1
Behavioral task
behavioral1
Sample
Recibo de Pago.exe
Resource
win10-20220812-en
General
-
Target
Recibo de Pago.exe
-
Size
1.4MB
-
MD5
a896fbd8cffa0ec7ce702382c1998c10
-
SHA1
b31af0dac451c83954a092e8e6482d65a6f4f8be
-
SHA256
5175d32fcf938c4c14823d54b85a3217797bbf5733d5720f191e1911f47a2b83
-
SHA512
08408fc9f398ea066867dd15a97fdd110c7815c3dc36395550555501b261ccaf8aa7ce7739f52a9c25446b0533f87c9c1be56bf816e8b9e06e061c6d9414273e
-
SSDEEP
24576:ALGYO6yrG+Yi3eGdfszdIcNOmPdWjRtdIimNvBLVfGZ0ij01lQ7XthmX:crMDOULOTFBUtsP
Malware Config
Extracted
bandook
deapproved.ru
Signatures
-
Bandook payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/3876-198-0x0000000013140000-0x0000000013C7D000-memory.dmp family_bandook behavioral1/memory/3876-212-0x0000000013140000-0x0000000013C7D000-memory.dmp family_bandook behavioral1/memory/3796-256-0x0000000013140000-0x0000000013C7D000-memory.dmp family_bandook -
Processes:
resource yara_rule behavioral1/memory/3876-161-0x0000000013140000-0x0000000013C7D000-memory.dmp upx behavioral1/memory/3876-198-0x0000000013140000-0x0000000013C7D000-memory.dmp upx behavioral1/memory/3876-212-0x0000000013140000-0x0000000013C7D000-memory.dmp upx behavioral1/memory/3796-256-0x0000000013140000-0x0000000013C7D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msinfo32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run msinfo32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\FEAQ = "C:\\Users\\Admin\\AppData\\Roaming\\FEAQ\\FEAQ.exe" msinfo32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msinfo32.exepid process 3876 msinfo32.exe 3876 msinfo32.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Recibo de Pago.exedescription pid process target process PID 4324 wrote to memory of 3876 4324 Recibo de Pago.exe msinfo32.exe PID 4324 wrote to memory of 3876 4324 Recibo de Pago.exe msinfo32.exe PID 4324 wrote to memory of 3876 4324 Recibo de Pago.exe msinfo32.exe PID 4324 wrote to memory of 3876 4324 Recibo de Pago.exe msinfo32.exe PID 4324 wrote to memory of 3876 4324 Recibo de Pago.exe msinfo32.exe PID 4324 wrote to memory of 3796 4324 Recibo de Pago.exe msinfo32.exe PID 4324 wrote to memory of 3796 4324 Recibo de Pago.exe msinfo32.exe PID 4324 wrote to memory of 3796 4324 Recibo de Pago.exe msinfo32.exe PID 4324 wrote to memory of 3796 4324 Recibo de Pago.exe msinfo32.exe PID 4324 wrote to memory of 3796 4324 Recibo de Pago.exe msinfo32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Recibo de Pago.exe"C:\Users\Admin\AppData\Local\Temp\Recibo de Pago.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\syswow64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\windows\syswow64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3796-213-0x0000000000000000-mapping.dmp
-
memory/3796-256-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/3876-173-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/3876-181-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/3876-171-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/3876-176-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/3876-170-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/3876-182-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/3876-180-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/3876-179-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/3876-178-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/3876-177-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/3876-175-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/3876-169-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/3876-156-0x0000000000000000-mapping.dmp
-
memory/3876-172-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/3876-198-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/3876-212-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/3876-174-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/3876-168-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/3876-167-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/3876-163-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/3876-166-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/3876-164-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/3876-165-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/3876-162-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/3876-161-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/3876-160-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/3876-158-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/3876-159-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/3876-157-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-135-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-137-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-151-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-152-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-153-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-154-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-155-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-149-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-148-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-147-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-146-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-145-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-143-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-144-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-142-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-141-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-140-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-139-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-138-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-150-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-136-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-118-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-134-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-133-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-132-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-131-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-130-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-129-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-128-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-127-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-126-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-125-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-124-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-123-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-122-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-121-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-120-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4324-119-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB