Analysis
-
max time kernel
300s -
max time network
301s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
27-04-2023 15:21
Static task
static1
Behavioral task
behavioral1
Sample
PRINTDOC-26042023.exe
Resource
win7-20230220-en
5 signatures
300 seconds
General
-
Target
PRINTDOC-26042023.exe
-
Size
4.1MB
-
MD5
51dc4f8ee85bf56c04daf973753d3d69
-
SHA1
d53dc03dfec66f48753c76c9065bc4f60556feac
-
SHA256
f4bd7128b8c371149045062f195fc732b74893fb67a7238457e4b4b599c33329
-
SHA512
e9a82f1559afcf9d7931cb32b0d03e2cffef3fdd074ee8e4f783fa23752854c5bb69ca853a91a9f2d99bdecd2221abe9d8cd059c7d99491866c7ca26300687a0
-
SSDEEP
49152:ibVNUatVC8ne36/1o764I2TiFD0ca4E1HFUgim9sTUqUynZsX259LhZ4p:iW
Malware Config
Extracted
Family
bandook
C2
gombos.ru
Signatures
-
Bandook payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/1864-81-0x0000000013140000-0x0000000013F1F000-memory.dmp family_bandook behavioral1/memory/1864-82-0x0000000013140000-0x0000000013F1F000-memory.dmp family_bandook behavioral1/memory/1864-88-0x0000000013140000-0x0000000013F1F000-memory.dmp family_bandook behavioral1/memory/1864-91-0x0000000013140000-0x0000000013F1F000-memory.dmp family_bandook behavioral1/memory/1864-92-0x0000000013140000-0x0000000013F1F000-memory.dmp family_bandook behavioral1/memory/1864-93-0x0000000013140000-0x0000000013F1F000-memory.dmp family_bandook behavioral1/memory/1864-95-0x0000000013140000-0x0000000013F1F000-memory.dmp family_bandook behavioral1/memory/1864-97-0x0000000013140000-0x0000000013F1F000-memory.dmp family_bandook -
Processes:
resource yara_rule behavioral1/memory/1864-79-0x0000000013140000-0x0000000013F1F000-memory.dmp upx behavioral1/memory/1864-80-0x0000000013140000-0x0000000013F1F000-memory.dmp upx behavioral1/memory/1864-81-0x0000000013140000-0x0000000013F1F000-memory.dmp upx behavioral1/memory/1864-82-0x0000000013140000-0x0000000013F1F000-memory.dmp upx behavioral1/memory/1864-88-0x0000000013140000-0x0000000013F1F000-memory.dmp upx behavioral1/memory/1864-91-0x0000000013140000-0x0000000013F1F000-memory.dmp upx behavioral1/memory/1864-92-0x0000000013140000-0x0000000013F1F000-memory.dmp upx behavioral1/memory/1864-93-0x0000000013140000-0x0000000013F1F000-memory.dmp upx behavioral1/memory/1864-95-0x0000000013140000-0x0000000013F1F000-memory.dmp upx behavioral1/memory/1864-97-0x0000000013140000-0x0000000013F1F000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
msinfo32.exepid process 1864 msinfo32.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
PRINTDOC-26042023.exedescription pid process target process PID 836 wrote to memory of 1864 836 PRINTDOC-26042023.exe msinfo32.exe PID 836 wrote to memory of 1864 836 PRINTDOC-26042023.exe msinfo32.exe PID 836 wrote to memory of 1864 836 PRINTDOC-26042023.exe msinfo32.exe PID 836 wrote to memory of 1864 836 PRINTDOC-26042023.exe msinfo32.exe PID 836 wrote to memory of 612 836 PRINTDOC-26042023.exe PRINTDOC-26042023.exe PID 836 wrote to memory of 612 836 PRINTDOC-26042023.exe PRINTDOC-26042023.exe PID 836 wrote to memory of 612 836 PRINTDOC-26042023.exe PRINTDOC-26042023.exe PID 836 wrote to memory of 612 836 PRINTDOC-26042023.exe PRINTDOC-26042023.exe PID 836 wrote to memory of 1864 836 PRINTDOC-26042023.exe msinfo32.exe PID 836 wrote to memory of 1864 836 PRINTDOC-26042023.exe msinfo32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PRINTDOC-26042023.exe"C:\Users\Admin\AppData\Local\Temp\PRINTDOC-26042023.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\syswow64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\PRINTDOC-26042023.exeC:\Users\Admin\AppData\Local\Temp\PRINTDOC-26042023.exe ooooooooooooooo2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/612-76-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/612-84-0x0000000000400000-0x0000000000832000-memory.dmpFilesize
4.2MB
-
memory/612-86-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/612-90-0x0000000000400000-0x0000000000832000-memory.dmpFilesize
4.2MB
-
memory/612-99-0x0000000000400000-0x0000000000832000-memory.dmpFilesize
4.2MB
-
memory/836-73-0x0000000000400000-0x0000000000832000-memory.dmpFilesize
4.2MB
-
memory/836-83-0x0000000000400000-0x0000000000832000-memory.dmpFilesize
4.2MB
-
memory/836-74-0x0000000000400000-0x0000000000832000-memory.dmpFilesize
4.2MB
-
memory/836-72-0x0000000000400000-0x0000000000832000-memory.dmpFilesize
4.2MB
-
memory/836-106-0x0000000000400000-0x0000000000832000-memory.dmpFilesize
4.2MB
-
memory/836-59-0x0000000000400000-0x0000000000832000-memory.dmpFilesize
4.2MB
-
memory/836-58-0x0000000000400000-0x0000000000832000-memory.dmpFilesize
4.2MB
-
memory/836-54-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/836-56-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/836-55-0x0000000000400000-0x0000000000832000-memory.dmpFilesize
4.2MB
-
memory/1864-80-0x0000000013140000-0x0000000013F1F000-memory.dmpFilesize
13.9MB
-
memory/1864-82-0x0000000013140000-0x0000000013F1F000-memory.dmpFilesize
13.9MB
-
memory/1864-81-0x0000000013140000-0x0000000013F1F000-memory.dmpFilesize
13.9MB
-
memory/1864-88-0x0000000013140000-0x0000000013F1F000-memory.dmpFilesize
13.9MB
-
memory/1864-79-0x0000000013140000-0x0000000013F1F000-memory.dmpFilesize
13.9MB
-
memory/1864-91-0x0000000013140000-0x0000000013F1F000-memory.dmpFilesize
13.9MB
-
memory/1864-92-0x0000000013140000-0x0000000013F1F000-memory.dmpFilesize
13.9MB
-
memory/1864-93-0x0000000013140000-0x0000000013F1F000-memory.dmpFilesize
13.9MB
-
memory/1864-95-0x0000000013140000-0x0000000013F1F000-memory.dmpFilesize
13.9MB
-
memory/1864-97-0x0000000013140000-0x0000000013F1F000-memory.dmpFilesize
13.9MB
-
memory/1864-78-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1864-77-0x0000000013140000-0x0000000013F1F000-memory.dmpFilesize
13.9MB