Analysis
-
max time kernel
291s -
max time network
291s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
01-03-2023 17:23
Static task
static1
Behavioral task
behavioral1
Sample
Solicitud de comprá.exe
Resource
win7-20230220-en
windows7-x64
5 signatures
300 seconds
General
-
Target
Solicitud de comprá.exe
-
Size
4.6MB
-
MD5
795d1f81ac926d3e071eacef70e595c1
-
SHA1
73301458ce9c775e6416fbe9f1921ecc4f69d099
-
SHA256
e2e984b3044ab8f96ec284dc2af339923fb6cdded37a551125c899a1c60376a3
-
SHA512
c436fd1ebc99d384c434e2b6b6494fefa7f18ccae6de755491ae03b234b6f08fcb616a5a60e89b6e80356cbf00c39ddc8e350e6bad8f23285498a906b9df5a85
-
SSDEEP
49152:nvPLNuoyGZVhMfUhJKehyrNru0bqMpjgK9aSN6wtiGe50oO6z7YYA698nTnUkcNW:nvPRBIsTKehy3
Malware Config
Extracted
Family
bandook
C2
gombos.ru
Signatures
-
Bandook payload 8 IoCs
Processes:
resource yara_rule behavioral2/memory/1416-156-0x0000000013140000-0x000000001400A000-memory.dmp family_bandook behavioral2/memory/1416-157-0x0000000013140000-0x000000001400A000-memory.dmp family_bandook behavioral2/memory/1416-158-0x0000000013140000-0x000000001400A000-memory.dmp family_bandook behavioral2/memory/1416-159-0x0000000013140000-0x000000001400A000-memory.dmp family_bandook behavioral2/memory/1416-160-0x0000000013140000-0x000000001400A000-memory.dmp family_bandook behavioral2/memory/1416-162-0x0000000013140000-0x000000001400A000-memory.dmp family_bandook behavioral2/memory/1416-164-0x0000000013140000-0x000000001400A000-memory.dmp family_bandook behavioral2/memory/1416-166-0x0000000013140000-0x000000001400A000-memory.dmp family_bandook -
Processes:
resource yara_rule behavioral2/memory/1416-153-0x0000000013140000-0x000000001400A000-memory.dmp upx behavioral2/memory/1416-154-0x0000000013140000-0x000000001400A000-memory.dmp upx behavioral2/memory/1416-156-0x0000000013140000-0x000000001400A000-memory.dmp upx behavioral2/memory/1416-157-0x0000000013140000-0x000000001400A000-memory.dmp upx behavioral2/memory/1416-158-0x0000000013140000-0x000000001400A000-memory.dmp upx behavioral2/memory/1416-159-0x0000000013140000-0x000000001400A000-memory.dmp upx behavioral2/memory/1416-160-0x0000000013140000-0x000000001400A000-memory.dmp upx behavioral2/memory/1416-162-0x0000000013140000-0x000000001400A000-memory.dmp upx behavioral2/memory/1416-164-0x0000000013140000-0x000000001400A000-memory.dmp upx behavioral2/memory/1416-166-0x0000000013140000-0x000000001400A000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msinfo32.exepid process 1416 msinfo32.exe 1416 msinfo32.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
Solicitud de comprá.exedescription pid process target process PID 2464 wrote to memory of 1416 2464 Solicitud de comprá.exe msinfo32.exe PID 2464 wrote to memory of 1416 2464 Solicitud de comprá.exe msinfo32.exe PID 2464 wrote to memory of 1416 2464 Solicitud de comprá.exe msinfo32.exe PID 2464 wrote to memory of 1416 2464 Solicitud de comprá.exe msinfo32.exe PID 2464 wrote to memory of 1416 2464 Solicitud de comprá.exe msinfo32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Solicitud de comprá.exe"C:\Users\Admin\AppData\Local\Temp\Solicitud de comprá.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1416-156-0x0000000013140000-0x000000001400A000-memory.dmpFilesize
14.8MB
-
memory/1416-166-0x0000000013140000-0x000000001400A000-memory.dmpFilesize
14.8MB
-
memory/1416-164-0x0000000013140000-0x000000001400A000-memory.dmpFilesize
14.8MB
-
memory/1416-162-0x0000000013140000-0x000000001400A000-memory.dmpFilesize
14.8MB
-
memory/1416-160-0x0000000013140000-0x000000001400A000-memory.dmpFilesize
14.8MB
-
memory/1416-159-0x0000000013140000-0x000000001400A000-memory.dmpFilesize
14.8MB
-
memory/1416-158-0x0000000013140000-0x000000001400A000-memory.dmpFilesize
14.8MB
-
memory/1416-157-0x0000000013140000-0x000000001400A000-memory.dmpFilesize
14.8MB
-
memory/1416-153-0x0000000013140000-0x000000001400A000-memory.dmpFilesize
14.8MB
-
memory/1416-154-0x0000000013140000-0x000000001400A000-memory.dmpFilesize
14.8MB
-
memory/2464-150-0x0000000000400000-0x00000000008A4000-memory.dmpFilesize
4.6MB
-
memory/2464-155-0x0000000000400000-0x00000000008A4000-memory.dmpFilesize
4.6MB
-
memory/2464-152-0x0000000000400000-0x00000000008A4000-memory.dmpFilesize
4.6MB
-
memory/2464-151-0x0000000000400000-0x00000000008A4000-memory.dmpFilesize
4.6MB
-
memory/2464-133-0x0000000000A60000-0x0000000000A61000-memory.dmpFilesize
4KB
-
memory/2464-138-0x0000000000400000-0x00000000008A4000-memory.dmpFilesize
4.6MB
-
memory/2464-136-0x0000000000400000-0x00000000008A4000-memory.dmpFilesize
4.6MB
-
memory/2464-135-0x0000000000A60000-0x0000000000A61000-memory.dmpFilesize
4KB
-
memory/2464-134-0x0000000000400000-0x00000000008A4000-memory.dmpFilesize
4.6MB
-
memory/2464-172-0x0000000000400000-0x00000000008A4000-memory.dmpFilesize
4.6MB