Analysis
-
max time kernel
158s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 15:52
Static task
static1
Behavioral task
behavioral1
Sample
a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe
Resource
win10v2004-20221111-en
General
-
Target
a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe
-
Size
1.5MB
-
MD5
4c8a864510cb59db7f3c0b3bf2fd7fa1
-
SHA1
42e05975cd4450852970958ba675ac42032eccae
-
SHA256
a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934
-
SHA512
191e1f81a271a44cc992ea474fc425c2cd7aa6c8a12b189b77a98ac7747d8dcbffa8876a5ca31e61bbf779a5d0ff9f080e0dd52af25aff961391932e48f3e45f
-
SSDEEP
24576:Yqtusu+tVxHPidqUAIM3CNQgII6SZlCDHh3R5OdBAXO9kE:YZwd4MbyZlUBB58Ae9
Malware Config
Extracted
bandook
ezeigbo.ddns.net
Signatures
-
Bandook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3800-133-0x0000000013140000-0x0000000013B8F000-memory.dmp family_bandook behavioral2/memory/3800-135-0x0000000013140000-0x0000000013B8F000-memory.dmp family_bandook behavioral2/memory/3800-136-0x0000000013140000-0x0000000013B8F000-memory.dmp family_bandook behavioral2/memory/3800-137-0x0000000013140000-0x0000000013B8F000-memory.dmp family_bandook -
Executes dropped EXE 1 IoCs
Processes:
svtm.exepid process 2212 svtm.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exeiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svtm = "C:\\Users\\Admin\\AppData\\Local\\svtm\\svtm.exe" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svtm = "C:\\Users\\Admin\\AppData\\Local\\svtm\\svtm.exe" iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exedescription pid process target process PID 2512 set thread context of 3800 2512 a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exea7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exeiexplore.exedescription pid process target process PID 2512 wrote to memory of 3800 2512 a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe PID 2512 wrote to memory of 3800 2512 a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe PID 2512 wrote to memory of 3800 2512 a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe PID 2512 wrote to memory of 3800 2512 a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe PID 2512 wrote to memory of 3800 2512 a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe PID 3800 wrote to memory of 4676 3800 a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe iexplore.exe PID 3800 wrote to memory of 4676 3800 a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe iexplore.exe PID 3800 wrote to memory of 4676 3800 a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe iexplore.exe PID 3800 wrote to memory of 4676 3800 a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe iexplore.exe PID 3800 wrote to memory of 1656 3800 a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe iexplore.exe PID 3800 wrote to memory of 1656 3800 a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe iexplore.exe PID 3800 wrote to memory of 1656 3800 a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe iexplore.exe PID 3800 wrote to memory of 1656 3800 a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe iexplore.exe PID 3800 wrote to memory of 2448 3800 a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe iexplore.exe PID 3800 wrote to memory of 2448 3800 a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe iexplore.exe PID 3800 wrote to memory of 2448 3800 a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe iexplore.exe PID 3800 wrote to memory of 2448 3800 a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe iexplore.exe PID 3800 wrote to memory of 3128 3800 a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe iexplore.exe PID 3800 wrote to memory of 3128 3800 a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe iexplore.exe PID 3800 wrote to memory of 3128 3800 a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe iexplore.exe PID 3800 wrote to memory of 3128 3800 a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe iexplore.exe PID 3128 wrote to memory of 2212 3128 iexplore.exe svtm.exe PID 3128 wrote to memory of 2212 3128 iexplore.exe svtm.exe PID 3128 wrote to memory of 2212 3128 iexplore.exe svtm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe"C:\Users\Admin\AppData\Local\Temp\a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe"C:\Users\Admin\AppData\Local\Temp\a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Adds Run key to start application
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\svtm\svtm.exe"C:\Users\Admin\AppData\Local\svtm\svtm.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\svtm\svtm.exeFilesize
1.5MB
MD54c8a864510cb59db7f3c0b3bf2fd7fa1
SHA142e05975cd4450852970958ba675ac42032eccae
SHA256a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934
SHA512191e1f81a271a44cc992ea474fc425c2cd7aa6c8a12b189b77a98ac7747d8dcbffa8876a5ca31e61bbf779a5d0ff9f080e0dd52af25aff961391932e48f3e45f
-
C:\Users\Admin\AppData\Local\svtm\svtm.exeFilesize
1.5MB
MD54c8a864510cb59db7f3c0b3bf2fd7fa1
SHA142e05975cd4450852970958ba675ac42032eccae
SHA256a7320e7ada292831538aaee3559dc0139b3222208dfe9271e74d080125b5c934
SHA512191e1f81a271a44cc992ea474fc425c2cd7aa6c8a12b189b77a98ac7747d8dcbffa8876a5ca31e61bbf779a5d0ff9f080e0dd52af25aff961391932e48f3e45f
-
memory/2212-139-0x0000000000000000-mapping.dmp
-
memory/3800-132-0x0000000000000000-mapping.dmp
-
memory/3800-133-0x0000000013140000-0x0000000013B8F000-memory.dmpFilesize
10.3MB
-
memory/3800-135-0x0000000013140000-0x0000000013B8F000-memory.dmpFilesize
10.3MB
-
memory/3800-136-0x0000000013140000-0x0000000013B8F000-memory.dmpFilesize
10.3MB
-
memory/3800-137-0x0000000013140000-0x0000000013B8F000-memory.dmpFilesize
10.3MB