Analysis
-
max time kernel
246s -
max time network
267s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-02-2023 15:01
Static task
static1
Behavioral task
behavioral1
Sample
Recibo de pago Banreserva.exe
Resource
win7-20220812-en
5 signatures
300 seconds
General
-
Target
Recibo de pago Banreserva.exe
-
Size
4.4MB
-
MD5
963dc44ec86b6f0e667716a4eafb63b1
-
SHA1
f487e173e2d8ef1c95d33fef82db94ddd2231e48
-
SHA256
14fe82910c2f207c0d0af16adb78beb03b871289d92bfeb52e7d4814b075e126
-
SHA512
6300c982b38242c3d591410672d6872b2e80d675acb421394b78b59f18e9e85c300e12e3bf7bddc82eb6aa86a5dd998064232c90c0c5d164a4c6055dab97cc2e
-
SSDEEP
49152:MxJPhRf0ewejGkahfiJWcSlAerZeWfEhiHECbFkt+aSj982TnUkcNVuV9zwu:MxTGeyk
Malware Config
Signatures
-
Bandook payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1396-63-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral1/memory/1396-64-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook -
Processes:
resource yara_rule behavioral1/memory/1396-60-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1396-62-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1396-63-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1396-64-0x0000000013140000-0x0000000014009000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
msinfo32.exepid process 1396 msinfo32.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Recibo de pago Banreserva.exedescription pid process target process PID 1940 wrote to memory of 1396 1940 Recibo de pago Banreserva.exe msinfo32.exe PID 1940 wrote to memory of 1396 1940 Recibo de pago Banreserva.exe msinfo32.exe PID 1940 wrote to memory of 1396 1940 Recibo de pago Banreserva.exe msinfo32.exe PID 1940 wrote to memory of 1396 1940 Recibo de pago Banreserva.exe msinfo32.exe PID 1940 wrote to memory of 1424 1940 Recibo de pago Banreserva.exe Recibo de pago Banreserva.exe PID 1940 wrote to memory of 1424 1940 Recibo de pago Banreserva.exe Recibo de pago Banreserva.exe PID 1940 wrote to memory of 1424 1940 Recibo de pago Banreserva.exe Recibo de pago Banreserva.exe PID 1940 wrote to memory of 1424 1940 Recibo de pago Banreserva.exe Recibo de pago Banreserva.exe PID 1940 wrote to memory of 1396 1940 Recibo de pago Banreserva.exe msinfo32.exe PID 1940 wrote to memory of 1396 1940 Recibo de pago Banreserva.exe msinfo32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Recibo de pago Banreserva.exe"C:\Users\Admin\AppData\Local\Temp\Recibo de pago Banreserva.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\syswow64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\Recibo de pago Banreserva.exe"C:\Users\Admin\AppData\Local\Temp\Recibo de pago Banreserva.exe" ooooooooooooooo2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1396-57-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1396-59-0x0000000000000000-mapping.dmp
-
memory/1396-60-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1396-62-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1396-63-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1396-64-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1424-55-0x0000000000000000-mapping.dmp
-
memory/1940-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmpFilesize
8KB