Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 02:31
Static task
static1
Behavioral task
behavioral1
Sample
719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe
Resource
win10v2004-20220901-en
General
-
Target
719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe
-
Size
1.4MB
-
MD5
fd9433444004d326b35128f6ab7502c7
-
SHA1
af0f10c2ce7d1d083a17654740475a697232a074
-
SHA256
719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b
-
SHA512
5b1c12d645c91eb73ba7ada105f0dea1f80cb4d4143712958d31bc6e337d3aa93c4151ee14afed1c7d5d0eb4b01c7a912bb264081e2191de7905c4d30ef4ad72
-
SSDEEP
24576:8EqTh1sbKKx578K0wRpzeXrI/DYqCJ/lFATG7u258n86SERxpGwWDMKTF:8ErRxRDYpAa7uVn86SEWDM
Malware Config
Extracted
bandook
iamgood.blogdns.net
Signatures
-
Bandook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/5024-133-0x0000000013140000-0x0000000013B93000-memory.dmp family_bandook behavioral2/memory/5024-135-0x0000000013140000-0x0000000013B93000-memory.dmp family_bandook behavioral2/memory/5024-136-0x0000000013140000-0x0000000013B93000-memory.dmp family_bandook behavioral2/memory/5024-137-0x0000000013140000-0x0000000013B93000-memory.dmp family_bandook -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exeiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KLIM = "C:\\Users\\Admin\\AppData\\Roaming\\KLMS\\klim.exe" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KLIM = "C:\\Users\\Admin\\AppData\\Roaming\\KLMS\\klim.exe" iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exedescription pid process target process PID 4284 set thread context of 5024 4284 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exedescription pid process target process PID 4284 wrote to memory of 5024 4284 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe PID 4284 wrote to memory of 5024 4284 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe PID 4284 wrote to memory of 5024 4284 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe PID 4284 wrote to memory of 5024 4284 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe PID 4284 wrote to memory of 5024 4284 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe PID 5024 wrote to memory of 1452 5024 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe iexplore.exe PID 5024 wrote to memory of 1452 5024 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe iexplore.exe PID 5024 wrote to memory of 1452 5024 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe iexplore.exe PID 5024 wrote to memory of 1452 5024 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe iexplore.exe PID 5024 wrote to memory of 2788 5024 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe iexplore.exe PID 5024 wrote to memory of 2788 5024 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe iexplore.exe PID 5024 wrote to memory of 2788 5024 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe iexplore.exe PID 5024 wrote to memory of 2788 5024 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe iexplore.exe PID 5024 wrote to memory of 4004 5024 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe iexplore.exe PID 5024 wrote to memory of 4004 5024 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe iexplore.exe PID 5024 wrote to memory of 4004 5024 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe iexplore.exe PID 5024 wrote to memory of 4004 5024 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe iexplore.exe PID 5024 wrote to memory of 3652 5024 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe iexplore.exe PID 5024 wrote to memory of 3652 5024 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe iexplore.exe PID 5024 wrote to memory of 3652 5024 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe iexplore.exe PID 5024 wrote to memory of 3652 5024 719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe"C:\Users\Admin\AppData\Local\Temp\719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe"C:\Users\Admin\AppData\Local\Temp\719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵PID:1452
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Adds Run key to start application
PID:2788 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵PID:4004
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Adds Run key to start application
PID:3652
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\KLMS\klim.exeFilesize
1.4MB
MD5fd9433444004d326b35128f6ab7502c7
SHA1af0f10c2ce7d1d083a17654740475a697232a074
SHA256719a937b69a64a9f145107ee9353a8e07f5e75ec7c4ae8e1b4aaa339fca3e16b
SHA5125b1c12d645c91eb73ba7ada105f0dea1f80cb4d4143712958d31bc6e337d3aa93c4151ee14afed1c7d5d0eb4b01c7a912bb264081e2191de7905c4d30ef4ad72
-
memory/5024-132-0x0000000000000000-mapping.dmp
-
memory/5024-133-0x0000000013140000-0x0000000013B93000-memory.dmpFilesize
10.3MB
-
memory/5024-135-0x0000000013140000-0x0000000013B93000-memory.dmpFilesize
10.3MB
-
memory/5024-136-0x0000000013140000-0x0000000013B93000-memory.dmpFilesize
10.3MB
-
memory/5024-137-0x0000000013140000-0x0000000013B93000-memory.dmpFilesize
10.3MB