Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 15:52
Static task
static1
Behavioral task
behavioral1
Sample
c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe
Resource
win10v2004-20220812-en
General
-
Target
c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe
-
Size
1.5MB
-
MD5
8a3559d0186867422bdeda233c42e837
-
SHA1
fc2fc7010739c22050d0ebb8d5d5212083fbbc5e
-
SHA256
c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e
-
SHA512
0d2b76bb65139de7ee2b2412f885fd8af7e60c61489a05ce3e7d99a91ad3f4d3b4a310c67bcb9897b29a5937dc0bc685712fc89fae25e03a59d0c424c9df1569
-
SSDEEP
24576:bqtusu+tVxHPidqUAIM3CNQgII6SZlCDHh3R5IdBAJ58:bZwd4MbyZlUBB5mA
Malware Config
Extracted
bandook
soniaswiss.ddns.net
Signatures
-
Bandook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3688-133-0x0000000013140000-0x0000000013B8E000-memory.dmp family_bandook behavioral2/memory/3688-135-0x0000000013140000-0x0000000013B8E000-memory.dmp family_bandook behavioral2/memory/3688-136-0x0000000013140000-0x0000000013B8E000-memory.dmp family_bandook behavioral2/memory/3688-137-0x0000000013140000-0x0000000013B8E000-memory.dmp family_bandook -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exeiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\obm = "C:\\Users\\Admin\\AppData\\Local\\obm\\obm.exe" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\obm = "C:\\Users\\Admin\\AppData\\Local\\obm\\obm.exe" iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exedescription pid process target process PID 1984 set thread context of 3688 1984 c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exec980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exedescription pid process target process PID 1984 wrote to memory of 3688 1984 c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe PID 1984 wrote to memory of 3688 1984 c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe PID 1984 wrote to memory of 3688 1984 c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe PID 1984 wrote to memory of 3688 1984 c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe PID 1984 wrote to memory of 3688 1984 c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe PID 3688 wrote to memory of 5028 3688 c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe iexplore.exe PID 3688 wrote to memory of 5028 3688 c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe iexplore.exe PID 3688 wrote to memory of 5028 3688 c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe iexplore.exe PID 3688 wrote to memory of 5028 3688 c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe iexplore.exe PID 3688 wrote to memory of 2680 3688 c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe iexplore.exe PID 3688 wrote to memory of 2680 3688 c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe iexplore.exe PID 3688 wrote to memory of 2680 3688 c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe iexplore.exe PID 3688 wrote to memory of 2680 3688 c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe iexplore.exe PID 3688 wrote to memory of 5100 3688 c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe iexplore.exe PID 3688 wrote to memory of 5100 3688 c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe iexplore.exe PID 3688 wrote to memory of 5100 3688 c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe iexplore.exe PID 3688 wrote to memory of 5100 3688 c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe iexplore.exe PID 3688 wrote to memory of 1104 3688 c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe iexplore.exe PID 3688 wrote to memory of 1104 3688 c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe iexplore.exe PID 3688 wrote to memory of 1104 3688 c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe iexplore.exe PID 3688 wrote to memory of 1104 3688 c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe"C:\Users\Admin\AppData\Local\Temp\c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe"C:\Users\Admin\AppData\Local\Temp\c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Adds Run key to start application
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\obm\obm.exeFilesize
1.5MB
MD58a3559d0186867422bdeda233c42e837
SHA1fc2fc7010739c22050d0ebb8d5d5212083fbbc5e
SHA256c980f24533ca7c2e289191ff09a941d3dd1dfd5ebf6c884ff6c65641e3454b6e
SHA5120d2b76bb65139de7ee2b2412f885fd8af7e60c61489a05ce3e7d99a91ad3f4d3b4a310c67bcb9897b29a5937dc0bc685712fc89fae25e03a59d0c424c9df1569
-
memory/3688-132-0x0000000000000000-mapping.dmp
-
memory/3688-133-0x0000000013140000-0x0000000013B8E000-memory.dmpFilesize
10.3MB
-
memory/3688-135-0x0000000013140000-0x0000000013B8E000-memory.dmpFilesize
10.3MB
-
memory/3688-136-0x0000000013140000-0x0000000013B8E000-memory.dmpFilesize
10.3MB
-
memory/3688-137-0x0000000013140000-0x0000000013B8E000-memory.dmpFilesize
10.3MB