Analysis

  • max time kernel
    149s
  • max time network
    87s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    25-11-2022 15:52

General

  • Target

    c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe

  • Size

    1.5MB

  • MD5

    8a3559d0186867422bdeda233c42e837

  • SHA1

    fc2fc7010739c22050d0ebb8d5d5212083fbbc5e

  • SHA256

    c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e

  • SHA512

    0d2b76bb65139de7ee2b2412f885fd8af7e60c61489a05ce3e7d99a91ad3f4d3b4a310c67bcb9897b29a5937dc0bc685712fc89fae25e03a59d0c424c9df1569

  • SSDEEP

    24576:bqtusu+tVxHPidqUAIM3CNQgII6SZlCDHh3R5IdBAJ58:bZwd4MbyZlUBB5mA

Malware Config

Extracted

Family

bandook

C2

soniaswiss.ddns.net

Signatures

  • Bandook RAT

    Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

  • Bandook payload 5 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe
    "C:\Users\Admin\AppData\Local\Temp\c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Users\Admin\AppData\Local\Temp\c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe
      "C:\Users\Admin\AppData\Local\Temp\c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1892
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        3⤵
          PID:1500
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
          3⤵
          • Adds Run key to start application
          PID:776
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
          3⤵
            PID:1392
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
            3⤵
            • Adds Run key to start application
            PID:360

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Defense Evasion

      Modify Registry

      1
      T1112

      Discovery

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\obm\obm.exe
        Filesize

        1.5MB

        MD5

        8a3559d0186867422bdeda233c42e837

        SHA1

        fc2fc7010739c22050d0ebb8d5d5212083fbbc5e

        SHA256

        c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e

        SHA512

        0d2b76bb65139de7ee2b2412f885fd8af7e60c61489a05ce3e7d99a91ad3f4d3b4a310c67bcb9897b29a5937dc0bc685712fc89fae25e03a59d0c424c9df1569

      • memory/1892-54-0x0000000013140000-0x0000000013B8E000-memory.dmp
        Filesize

        10.3MB

      • memory/1892-56-0x0000000013140000-0x0000000013B8E000-memory.dmp
        Filesize

        10.3MB

      • memory/1892-57-0x0000000013148315-mapping.dmp
      • memory/1892-59-0x00000000760B1000-0x00000000760B3000-memory.dmp
        Filesize

        8KB

      • memory/1892-60-0x0000000013140000-0x0000000013B8E000-memory.dmp
        Filesize

        10.3MB

      • memory/1892-61-0x0000000013140000-0x0000000013B8E000-memory.dmp
        Filesize

        10.3MB

      • memory/1892-62-0x0000000013140000-0x0000000013B8E000-memory.dmp
        Filesize

        10.3MB