Analysis
-
max time kernel
500s -
max time network
488s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
07-10-2022 00:13
Static task
static1
Behavioral task
behavioral1
Sample
Recibo de Pago.exe
Resource
win10-20220901-en
General
-
Target
Recibo de Pago.exe
-
Size
1.4MB
-
MD5
a896fbd8cffa0ec7ce702382c1998c10
-
SHA1
b31af0dac451c83954a092e8e6482d65a6f4f8be
-
SHA256
5175d32fcf938c4c14823d54b85a3217797bbf5733d5720f191e1911f47a2b83
-
SHA512
08408fc9f398ea066867dd15a97fdd110c7815c3dc36395550555501b261ccaf8aa7ce7739f52a9c25446b0533f87c9c1be56bf816e8b9e06e061c6d9414273e
-
SSDEEP
24576:ALGYO6yrG+Yi3eGdfszdIcNOmPdWjRtdIimNvBLVfGZ0ij01lQ7XthmX:crMDOULOTFBUtsP
Malware Config
Extracted
bandook
deapproved.ru
Signatures
-
Bandook payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3380-430-0x0000000013140000-0x0000000013C7D000-memory.dmp family_bandook behavioral1/memory/3168-474-0x0000000013140000-0x0000000013C7D000-memory.dmp family_bandook -
Processes:
resource yara_rule behavioral1/memory/3380-380-0x0000000013140000-0x0000000013C7D000-memory.dmp upx behavioral1/memory/3380-430-0x0000000013140000-0x0000000013C7D000-memory.dmp upx behavioral1/memory/3168-474-0x0000000013140000-0x0000000013C7D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msinfo32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run msinfo32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\FEAQ = "C:\\Users\\Admin\\AppData\\Roaming\\FEAQ\\FEAQ.exe" msinfo32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3468 WINWORD.EXE 3468 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msinfo32.exepid process 3380 msinfo32.exe 3380 msinfo32.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 3468 WINWORD.EXE 3468 WINWORD.EXE 3468 WINWORD.EXE 3468 WINWORD.EXE 3468 WINWORD.EXE 3468 WINWORD.EXE 3468 WINWORD.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Recibo de Pago.exedescription pid process target process PID 4796 wrote to memory of 3380 4796 Recibo de Pago.exe msinfo32.exe PID 4796 wrote to memory of 3380 4796 Recibo de Pago.exe msinfo32.exe PID 4796 wrote to memory of 3380 4796 Recibo de Pago.exe msinfo32.exe PID 4796 wrote to memory of 3380 4796 Recibo de Pago.exe msinfo32.exe PID 4796 wrote to memory of 3380 4796 Recibo de Pago.exe msinfo32.exe PID 4796 wrote to memory of 3168 4796 Recibo de Pago.exe msinfo32.exe PID 4796 wrote to memory of 3168 4796 Recibo de Pago.exe msinfo32.exe PID 4796 wrote to memory of 3168 4796 Recibo de Pago.exe msinfo32.exe PID 4796 wrote to memory of 3168 4796 Recibo de Pago.exe msinfo32.exe PID 4796 wrote to memory of 3168 4796 Recibo de Pago.exe msinfo32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Recibo de Pago.exe"C:\Users\Admin\AppData\Local\Temp\Recibo de Pago.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\syswow64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\windows\syswow64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Adds Run key to start application
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\Files.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3168-431-0x0000000000000000-mapping.dmp
-
memory/3168-474-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/3380-381-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/3380-383-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/3380-379-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/3380-390-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/3380-388-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/3380-387-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/3380-386-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/3380-385-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/3380-384-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/3380-376-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/3380-382-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/3380-380-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/3380-389-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/3380-430-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/3380-378-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/3380-377-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/3380-375-0x0000000000000000-mapping.dmp
-
memory/3468-159-0x00007FFDA1840000-0x00007FFDA1850000-memory.dmpFilesize
64KB
-
memory/3468-374-0x00007FFDA1840000-0x00007FFDA1850000-memory.dmpFilesize
64KB
-
memory/3468-373-0x00007FFDA1840000-0x00007FFDA1850000-memory.dmpFilesize
64KB
-
memory/3468-372-0x00007FFDA1840000-0x00007FFDA1850000-memory.dmpFilesize
64KB
-
memory/3468-371-0x00007FFDA1840000-0x00007FFDA1850000-memory.dmpFilesize
64KB
-
memory/3468-165-0x00007FFD9DD80000-0x00007FFD9DD90000-memory.dmpFilesize
64KB
-
memory/3468-164-0x00007FFD9DD80000-0x00007FFD9DD90000-memory.dmpFilesize
64KB
-
memory/3468-161-0x00007FFDA1840000-0x00007FFDA1850000-memory.dmpFilesize
64KB
-
memory/3468-160-0x00007FFDA1840000-0x00007FFDA1850000-memory.dmpFilesize
64KB
-
memory/3468-158-0x00007FFDA1840000-0x00007FFDA1850000-memory.dmpFilesize
64KB
-
memory/4796-137-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-142-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-151-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-152-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-153-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-154-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-155-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-156-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-157-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-149-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-148-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-147-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-131-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-138-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-140-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-143-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-146-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-145-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-144-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-150-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-141-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-139-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-120-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-136-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-135-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-134-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-133-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-132-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-130-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-129-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-128-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-127-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-126-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-125-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-124-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-123-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-122-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4796-121-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB