Analysis
-
max time kernel
414s -
max time network
428s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26-01-2023 19:31
Static task
static1
Behavioral task
behavioral1
Sample
Confirmar Transferencia lista.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Confirmar Transferencia lista.exe
Resource
win10v2004-20221111-en
General
-
Target
Confirmar Transferencia lista.exe
-
Size
2.9MB
-
MD5
9d62eda2d552cb2f7e1564209de10310
-
SHA1
a0a5da7e38bf029ffa91b7b6f16f4da10f2763b0
-
SHA256
fa031dbd614e7231d329906a6aefdbeea4c6b2ceee847e909ff66126a370ceaa
-
SHA512
189b4905fb991ff3842c539d24617251799d736dde3df40fdd8653fb782736244ce202f760cf9e1c10496f31fda7f9aa20253d4c642a9f22bd27cebfeeb1cfba
-
SSDEEP
49152:vfc6jJzftLicMY1xMHeNBHFAJyye2IwF1q9emDAZ:v0617tLi
Malware Config
Extracted
bandook
bomes.ru
Signatures
-
Bandook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3568-136-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/3568-137-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/3568-138-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/812-144-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook -
Processes:
resource yara_rule behavioral2/memory/3568-134-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/3568-135-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/3568-136-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/3568-137-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/3568-138-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/812-144-0x0000000013140000-0x0000000014009000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msinfo32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run msinfo32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RCY = "C:\\Users\\Admin\\AppData\\Roaming\\RCY\\RCY.exe" msinfo32.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Confirmar Transferencia lista.exedescription pid process target process PID 3256 set thread context of 812 3256 Confirmar Transferencia lista.exe msinfo32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msinfo32.exepid process 3568 msinfo32.exe 3568 msinfo32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Confirmar Transferencia lista.exeConfirmar Transferencia lista.exedescription pid process target process PID 544 wrote to memory of 3568 544 Confirmar Transferencia lista.exe msinfo32.exe PID 544 wrote to memory of 3568 544 Confirmar Transferencia lista.exe msinfo32.exe PID 544 wrote to memory of 3568 544 Confirmar Transferencia lista.exe msinfo32.exe PID 544 wrote to memory of 3256 544 Confirmar Transferencia lista.exe Confirmar Transferencia lista.exe PID 544 wrote to memory of 3256 544 Confirmar Transferencia lista.exe Confirmar Transferencia lista.exe PID 544 wrote to memory of 3256 544 Confirmar Transferencia lista.exe Confirmar Transferencia lista.exe PID 544 wrote to memory of 3568 544 Confirmar Transferencia lista.exe msinfo32.exe PID 544 wrote to memory of 3568 544 Confirmar Transferencia lista.exe msinfo32.exe PID 3256 wrote to memory of 812 3256 Confirmar Transferencia lista.exe msinfo32.exe PID 3256 wrote to memory of 812 3256 Confirmar Transferencia lista.exe msinfo32.exe PID 3256 wrote to memory of 812 3256 Confirmar Transferencia lista.exe msinfo32.exe PID 3256 wrote to memory of 812 3256 Confirmar Transferencia lista.exe msinfo32.exe PID 3256 wrote to memory of 812 3256 Confirmar Transferencia lista.exe msinfo32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Confirmar Transferencia lista.exe"C:\Users\Admin\AppData\Local\Temp\Confirmar Transferencia lista.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\Confirmar Transferencia lista.exe"C:\Users\Admin\AppData\Local\Temp\Confirmar Transferencia lista.exe" ooooooooooooooo2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\msinfo32.exeC:\windows\syswow64\msinfo32.exe3⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/812-139-0x0000000000000000-mapping.dmp
-
memory/812-144-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/3256-132-0x0000000000000000-mapping.dmp
-
memory/3568-133-0x0000000000000000-mapping.dmp
-
memory/3568-134-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/3568-135-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/3568-136-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/3568-137-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/3568-138-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB