Analysis
-
max time kernel
498s -
max time network
581s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-01-2023 19:33
Static task
static1
Behavioral task
behavioral1
Sample
Cancelar Factura.exe
Resource
win7-20221111-en
6 signatures
600 seconds
Behavioral task
behavioral2
Sample
Cancelar Factura.exe
Resource
win10v2004-20221111-en
6 signatures
600 seconds
General
-
Target
Cancelar Factura.exe
-
Size
2.9MB
-
MD5
5c3cb19563848d0bee7238a6bf55abc9
-
SHA1
766737ca6149bcd018ef7cfce49b3b90fe0325d9
-
SHA256
c1c7a5fe3203fe7ecd6b4581a12f85803174d5e2b8df2e98cccb8a5d740b1d36
-
SHA512
bbf31136b59edfc1c630a96e348a20d7f494e999534e19aea565ca9c2f074f27be8bac27ccf07165c5f025daa955741a131424250a543d83e6e46fed2af44341
-
SSDEEP
49152:Ofc6jhQyaOKBcZt7MUt0dfwwWC1R9Jbl8/u5K:O062yaOt
Score
10/10
Malware Config
Extracted
Family
bandook
C2
bomes.ru
Signatures
-
Bandook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2172-136-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/2172-137-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/2172-138-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/4960-143-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook -
Processes:
resource yara_rule behavioral2/memory/2172-134-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/2172-135-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/2172-136-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/2172-137-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/2172-138-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/4960-143-0x0000000013140000-0x0000000014009000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msinfo32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run msinfo32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\QPW = "C:\\Users\\Admin\\AppData\\Roaming\\QPW\\QPW.exe" msinfo32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msinfo32.exepid process 2172 msinfo32.exe 2172 msinfo32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Cancelar Factura.exeCancelar Factura.exedescription pid process target process PID 4924 wrote to memory of 2172 4924 Cancelar Factura.exe msinfo32.exe PID 4924 wrote to memory of 2172 4924 Cancelar Factura.exe msinfo32.exe PID 4924 wrote to memory of 2172 4924 Cancelar Factura.exe msinfo32.exe PID 4924 wrote to memory of 3512 4924 Cancelar Factura.exe Cancelar Factura.exe PID 4924 wrote to memory of 3512 4924 Cancelar Factura.exe Cancelar Factura.exe PID 4924 wrote to memory of 3512 4924 Cancelar Factura.exe Cancelar Factura.exe PID 4924 wrote to memory of 2172 4924 Cancelar Factura.exe msinfo32.exe PID 4924 wrote to memory of 2172 4924 Cancelar Factura.exe msinfo32.exe PID 3512 wrote to memory of 4960 3512 Cancelar Factura.exe msinfo32.exe PID 3512 wrote to memory of 4960 3512 Cancelar Factura.exe msinfo32.exe PID 3512 wrote to memory of 4960 3512 Cancelar Factura.exe msinfo32.exe PID 3512 wrote to memory of 4960 3512 Cancelar Factura.exe msinfo32.exe PID 3512 wrote to memory of 4960 3512 Cancelar Factura.exe msinfo32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cancelar Factura.exe"C:\Users\Admin\AppData\Local\Temp\Cancelar Factura.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\Cancelar Factura.exe"C:\Users\Admin\AppData\Local\Temp\Cancelar Factura.exe" ooooooooooooooo2⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\msinfo32.exeC:\windows\syswow64\msinfo32.exe3⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2172-133-0x0000000000000000-mapping.dmp
-
memory/2172-134-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/2172-135-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/2172-136-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/2172-137-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/2172-138-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/3512-132-0x0000000000000000-mapping.dmp
-
memory/4960-139-0x0000000000000000-mapping.dmp
-
memory/4960-143-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB