Analysis
-
max time kernel
439s -
max time network
423s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-01-2023 19:31
Static task
static1
Behavioral task
behavioral1
Sample
Confirmar Transferencia lista.exe
Resource
win7-20220812-en
6 signatures
600 seconds
Behavioral task
behavioral2
Sample
Confirmar Transferencia lista.exe
Resource
win10v2004-20221111-en
7 signatures
600 seconds
General
-
Target
Confirmar Transferencia lista.exe
-
Size
2.9MB
-
MD5
9d62eda2d552cb2f7e1564209de10310
-
SHA1
a0a5da7e38bf029ffa91b7b6f16f4da10f2763b0
-
SHA256
fa031dbd614e7231d329906a6aefdbeea4c6b2ceee847e909ff66126a370ceaa
-
SHA512
189b4905fb991ff3842c539d24617251799d736dde3df40fdd8653fb782736244ce202f760cf9e1c10496f31fda7f9aa20253d4c642a9f22bd27cebfeeb1cfba
-
SSDEEP
49152:vfc6jJzftLicMY1xMHeNBHFAJyye2IwF1q9emDAZ:v0617tLi
Score
10/10
Malware Config
Signatures
-
Bandook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1312-63-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral1/memory/1312-64-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral1/memory/1796-72-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral1/memory/1796-73-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook -
Processes:
resource yara_rule behavioral1/memory/1312-60-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1312-62-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1312-63-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1312-64-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1796-72-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1796-73-0x0000000013140000-0x0000000014009000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msinfo32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run msinfo32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\RCY = "C:\\Users\\Admin\\AppData\\Roaming\\RCY\\RCY.exe" msinfo32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
msinfo32.exepid process 1312 msinfo32.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Confirmar Transferencia lista.exeConfirmar Transferencia lista.exedescription pid process target process PID 1948 wrote to memory of 1312 1948 Confirmar Transferencia lista.exe msinfo32.exe PID 1948 wrote to memory of 1312 1948 Confirmar Transferencia lista.exe msinfo32.exe PID 1948 wrote to memory of 1312 1948 Confirmar Transferencia lista.exe msinfo32.exe PID 1948 wrote to memory of 1312 1948 Confirmar Transferencia lista.exe msinfo32.exe PID 1948 wrote to memory of 280 1948 Confirmar Transferencia lista.exe Confirmar Transferencia lista.exe PID 1948 wrote to memory of 280 1948 Confirmar Transferencia lista.exe Confirmar Transferencia lista.exe PID 1948 wrote to memory of 280 1948 Confirmar Transferencia lista.exe Confirmar Transferencia lista.exe PID 1948 wrote to memory of 280 1948 Confirmar Transferencia lista.exe Confirmar Transferencia lista.exe PID 1948 wrote to memory of 1312 1948 Confirmar Transferencia lista.exe msinfo32.exe PID 1948 wrote to memory of 1312 1948 Confirmar Transferencia lista.exe msinfo32.exe PID 280 wrote to memory of 1796 280 Confirmar Transferencia lista.exe msinfo32.exe PID 280 wrote to memory of 1796 280 Confirmar Transferencia lista.exe msinfo32.exe PID 280 wrote to memory of 1796 280 Confirmar Transferencia lista.exe msinfo32.exe PID 280 wrote to memory of 1796 280 Confirmar Transferencia lista.exe msinfo32.exe PID 280 wrote to memory of 1796 280 Confirmar Transferencia lista.exe msinfo32.exe PID 280 wrote to memory of 1796 280 Confirmar Transferencia lista.exe msinfo32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Confirmar Transferencia lista.exe"C:\Users\Admin\AppData\Local\Temp\Confirmar Transferencia lista.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\syswow64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\Confirmar Transferencia lista.exe"C:\Users\Admin\AppData\Local\Temp\Confirmar Transferencia lista.exe" ooooooooooooooo2⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\syswow64\msinfo32.exeC:\windows\syswow64\msinfo32.exe3⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/280-55-0x0000000000000000-mapping.dmp
-
memory/1312-57-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1312-59-0x0000000000000000-mapping.dmp
-
memory/1312-60-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1312-62-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1312-63-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1312-64-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1796-67-0x0000000000000000-mapping.dmp
-
memory/1796-72-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1796-73-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1948-54-0x0000000074F01000-0x0000000074F03000-memory.dmpFilesize
8KB