Analysis
-
max time kernel
111s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 13:25
Static task
static1
Behavioral task
behavioral1
Sample
ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe
Resource
win10v2004-20221111-en
General
-
Target
ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe
-
Size
991KB
-
MD5
b00e12c16d784b4d5e711e51e0430d66
-
SHA1
d2d7d47df634c39f79331dfe2e5f953251266b17
-
SHA256
ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257
-
SHA512
09a7d929a4e3385bde47a51161647bcfa6971e6bdca1c3d40b78951f5b2db46bd448f6e912821ac27e2b54d7c824a5d9efb2c5ddcfe19a4d22317b266b17a94f
-
SSDEEP
24576:KinYayzdUnKEaoxfqyQjnr5iKULyQUVyhaPvNy/UtR:Tyz6BxfxmrNUL7lo0s
Malware Config
Extracted
bandook
sat-iva.org
Signatures
-
Bandook payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1116-82-0x0000000013140000-0x0000000013B8E000-memory.dmp family_bandook behavioral1/memory/1116-83-0x0000000013148052-mapping.dmp family_bandook behavioral1/memory/1116-86-0x0000000013140000-0x0000000013B8E000-memory.dmp family_bandook -
Suspicious use of SetThreadContext 2 IoCs
Processes:
ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exeab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exedescription pid process target process PID 2028 set thread context of 752 2028 ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe PID 752 set thread context of 1116 752 ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exeab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exedescription pid process target process PID 2028 wrote to memory of 752 2028 ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe PID 2028 wrote to memory of 752 2028 ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe PID 2028 wrote to memory of 752 2028 ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe PID 2028 wrote to memory of 752 2028 ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe PID 2028 wrote to memory of 752 2028 ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe PID 2028 wrote to memory of 752 2028 ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe PID 2028 wrote to memory of 752 2028 ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe PID 2028 wrote to memory of 752 2028 ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe PID 2028 wrote to memory of 752 2028 ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe PID 2028 wrote to memory of 752 2028 ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe PID 2028 wrote to memory of 752 2028 ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe PID 2028 wrote to memory of 752 2028 ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe PID 2028 wrote to memory of 752 2028 ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe PID 2028 wrote to memory of 752 2028 ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe PID 2028 wrote to memory of 752 2028 ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe PID 2028 wrote to memory of 752 2028 ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe PID 752 wrote to memory of 1116 752 ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe PID 752 wrote to memory of 1116 752 ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe PID 752 wrote to memory of 1116 752 ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe PID 752 wrote to memory of 1116 752 ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe PID 752 wrote to memory of 1116 752 ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe PID 752 wrote to memory of 1116 752 ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe PID 752 wrote to memory of 1116 752 ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe PID 752 wrote to memory of 1116 752 ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe PID 752 wrote to memory of 1116 752 ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe"C:\Users\Admin\AppData\Local\Temp\ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe"C:\Users\Admin\AppData\Local\Temp\ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe"C:\Users\Admin\AppData\Local\Temp\ab87cb76028fce6863acec34faebf250bad0f17120188b5f95fec8f37a2aa257.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/752-72-0x0000000000400000-0x000000000055F000-memory.dmpFilesize
1.4MB
-
memory/752-58-0x0000000000400000-0x000000000055F000-memory.dmpFilesize
1.4MB
-
memory/752-87-0x0000000000400000-0x000000000055F000-memory.dmpFilesize
1.4MB
-
memory/752-79-0x0000000000400000-0x000000000055F000-memory.dmpFilesize
1.4MB
-
memory/752-73-0x00000000004FD18C-mapping.dmp
-
memory/752-59-0x0000000000400000-0x000000000055F000-memory.dmpFilesize
1.4MB
-
memory/752-61-0x0000000000400000-0x000000000055F000-memory.dmpFilesize
1.4MB
-
memory/752-74-0x0000000000400000-0x000000000055F000-memory.dmpFilesize
1.4MB
-
memory/752-65-0x0000000000400000-0x000000000055F000-memory.dmpFilesize
1.4MB
-
memory/752-67-0x0000000000400000-0x000000000055F000-memory.dmpFilesize
1.4MB
-
memory/752-68-0x0000000000400000-0x000000000055F000-memory.dmpFilesize
1.4MB
-
memory/752-70-0x0000000000400000-0x000000000055F000-memory.dmpFilesize
1.4MB
-
memory/752-78-0x0000000000400000-0x000000000055F000-memory.dmpFilesize
1.4MB
-
memory/752-76-0x0000000000400000-0x000000000055F000-memory.dmpFilesize
1.4MB
-
memory/752-63-0x0000000000400000-0x000000000055F000-memory.dmpFilesize
1.4MB
-
memory/1116-80-0x0000000013140000-0x0000000013B8E000-memory.dmpFilesize
10.3MB
-
memory/1116-82-0x0000000013140000-0x0000000013B8E000-memory.dmpFilesize
10.3MB
-
memory/1116-83-0x0000000013148052-mapping.dmp
-
memory/1116-86-0x0000000013140000-0x0000000013B8E000-memory.dmpFilesize
10.3MB
-
memory/2028-75-0x0000000000140000-0x0000000000180000-memory.dmpFilesize
256KB
-
memory/2028-55-0x0000000074A80000-0x000000007502B000-memory.dmpFilesize
5.7MB
-
memory/2028-77-0x0000000074A80000-0x000000007502B000-memory.dmpFilesize
5.7MB
-
memory/2028-56-0x0000000074A80000-0x000000007502B000-memory.dmpFilesize
5.7MB
-
memory/2028-57-0x0000000000140000-0x0000000000180000-memory.dmpFilesize
256KB
-
memory/2028-54-0x00000000760B1000-0x00000000760B3000-memory.dmpFilesize
8KB