Analysis
-
max time kernel
146s -
max time network
65s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 00:13
Static task
static1
Behavioral task
behavioral1
Sample
2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe
Resource
win10v2004-20221111-en
General
-
Target
2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe
-
Size
1.5MB
-
MD5
35e9fc4bff3729865fcbe688d33e9819
-
SHA1
74a5dc1856d990634c4c838309f124966c95b145
-
SHA256
2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4
-
SHA512
483ec08f00f5d3d2620b94f11c6a58f3c936112d189b9208bd6b7f22e285269274d177f12fec461232ede595b80836d883f8965b87cc12ddfe35e1d1849bfdb7
-
SSDEEP
24576:57OlTY81NmsM4SFu6/4WiAH4ACs/85iIn1xJSG8El7jsMtAndBAicuUO:57cXOAYwGJI1xkwrAXA+
Malware Config
Extracted
bandook
somfiar2a.ddns.net
Signatures
-
Bandook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1372-56-0x0000000013140000-0x0000000013B90000-memory.dmp family_bandook behavioral1/memory/1372-57-0x0000000013148C7C-mapping.dmp family_bandook behavioral1/memory/1372-60-0x0000000013140000-0x0000000013B90000-memory.dmp family_bandook behavioral1/memory/1372-61-0x0000000013140000-0x0000000013B90000-memory.dmp family_bandook behavioral1/memory/1372-62-0x0000000013140000-0x0000000013B90000-memory.dmp family_bandook -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exeiexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ksd = "C:\\Users\\Admin\\AppData\\Local\\ksd\\ksd.exe" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ksd = "C:\\Users\\Admin\\AppData\\Local\\ksd\\ksd.exe" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exedescription pid process target process PID 1636 set thread context of 1372 1636 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exedescription pid process target process PID 1636 wrote to memory of 1372 1636 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe PID 1636 wrote to memory of 1372 1636 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe PID 1636 wrote to memory of 1372 1636 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe PID 1636 wrote to memory of 1372 1636 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe PID 1636 wrote to memory of 1372 1636 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe PID 1636 wrote to memory of 1372 1636 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe PID 1372 wrote to memory of 1324 1372 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe iexplore.exe PID 1372 wrote to memory of 1324 1372 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe iexplore.exe PID 1372 wrote to memory of 1324 1372 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe iexplore.exe PID 1372 wrote to memory of 1324 1372 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe iexplore.exe PID 1372 wrote to memory of 1324 1372 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe iexplore.exe PID 1372 wrote to memory of 972 1372 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe iexplore.exe PID 1372 wrote to memory of 972 1372 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe iexplore.exe PID 1372 wrote to memory of 972 1372 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe iexplore.exe PID 1372 wrote to memory of 972 1372 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe iexplore.exe PID 1372 wrote to memory of 972 1372 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe iexplore.exe PID 1372 wrote to memory of 1824 1372 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe iexplore.exe PID 1372 wrote to memory of 1824 1372 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe iexplore.exe PID 1372 wrote to memory of 1824 1372 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe iexplore.exe PID 1372 wrote to memory of 1824 1372 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe iexplore.exe PID 1372 wrote to memory of 1824 1372 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe iexplore.exe PID 1372 wrote to memory of 1784 1372 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe iexplore.exe PID 1372 wrote to memory of 1784 1372 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe iexplore.exe PID 1372 wrote to memory of 1784 1372 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe iexplore.exe PID 1372 wrote to memory of 1784 1372 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe iexplore.exe PID 1372 wrote to memory of 1784 1372 2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe"C:\Users\Admin\AppData\Local\Temp\2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe"C:\Users\Admin\AppData\Local\Temp\2063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Adds Run key to start application
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\ksd\ksd.exeFilesize
1.5MB
MD535e9fc4bff3729865fcbe688d33e9819
SHA174a5dc1856d990634c4c838309f124966c95b145
SHA2562063ccad3a86a5808d3521eff0da421986761ad5d154a5de2243bf03fe59b1f4
SHA512483ec08f00f5d3d2620b94f11c6a58f3c936112d189b9208bd6b7f22e285269274d177f12fec461232ede595b80836d883f8965b87cc12ddfe35e1d1849bfdb7
-
memory/1372-54-0x0000000013140000-0x0000000013B90000-memory.dmpFilesize
10.3MB
-
memory/1372-56-0x0000000013140000-0x0000000013B90000-memory.dmpFilesize
10.3MB
-
memory/1372-57-0x0000000013148C7C-mapping.dmp
-
memory/1372-59-0x0000000075071000-0x0000000075073000-memory.dmpFilesize
8KB
-
memory/1372-60-0x0000000013140000-0x0000000013B90000-memory.dmpFilesize
10.3MB
-
memory/1372-61-0x0000000013140000-0x0000000013B90000-memory.dmpFilesize
10.3MB
-
memory/1372-62-0x0000000013140000-0x0000000013B90000-memory.dmpFilesize
10.3MB