Analysis
-
max time kernel
299s -
max time network
266s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
30-04-2023 08:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Confirmar Transferencia lista.exe
Resource
win7-20230220-en
5 signatures
300 seconds
General
-
Target
Confirmar Transferencia lista.exe
-
Size
2.9MB
-
MD5
9d62eda2d552cb2f7e1564209de10310
-
SHA1
a0a5da7e38bf029ffa91b7b6f16f4da10f2763b0
-
SHA256
fa031dbd614e7231d329906a6aefdbeea4c6b2ceee847e909ff66126a370ceaa
-
SHA512
189b4905fb991ff3842c539d24617251799d736dde3df40fdd8653fb782736244ce202f760cf9e1c10496f31fda7f9aa20253d4c642a9f22bd27cebfeeb1cfba
-
SSDEEP
49152:vfc6jJzftLicMY1xMHeNBHFAJyye2IwF1q9emDAZ:v0617tLi
Malware Config
Extracted
Family
bandook
C2
bomes.ru
Signatures
-
Bandook payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/1808-157-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/1808-158-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/1808-159-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/1808-160-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/1808-162-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/1808-164-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/1808-168-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook -
Processes:
resource yara_rule behavioral2/memory/1808-153-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/1808-154-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/1808-157-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/1808-158-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/1808-159-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/1808-160-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/1808-162-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/1808-164-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/1808-168-0x0000000013140000-0x0000000014009000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msinfo32.exepid process 1808 msinfo32.exe 1808 msinfo32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Confirmar Transferencia lista.exedescription pid process target process PID 1168 wrote to memory of 1808 1168 Confirmar Transferencia lista.exe msinfo32.exe PID 1168 wrote to memory of 1808 1168 Confirmar Transferencia lista.exe msinfo32.exe PID 1168 wrote to memory of 1808 1168 Confirmar Transferencia lista.exe msinfo32.exe PID 1168 wrote to memory of 3196 1168 Confirmar Transferencia lista.exe Confirmar Transferencia lista.exe PID 1168 wrote to memory of 3196 1168 Confirmar Transferencia lista.exe Confirmar Transferencia lista.exe PID 1168 wrote to memory of 3196 1168 Confirmar Transferencia lista.exe Confirmar Transferencia lista.exe PID 1168 wrote to memory of 1808 1168 Confirmar Transferencia lista.exe msinfo32.exe PID 1168 wrote to memory of 1808 1168 Confirmar Transferencia lista.exe msinfo32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Confirmar Transferencia lista.exe"C:\Users\Admin\AppData\Local\Temp\Confirmar Transferencia lista.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\Confirmar Transferencia lista.exe"C:\Users\Admin\AppData\Local\Temp\Confirmar Transferencia lista.exe" ooooooooooooooo2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1168-155-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/1168-135-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/1168-133-0x0000000002490000-0x0000000002491000-memory.dmpFilesize
4KB
-
memory/1168-136-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/1168-149-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/1168-150-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/1168-151-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/1168-134-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/1168-180-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/1808-160-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1808-158-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1808-153-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1808-159-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1808-154-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1808-162-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1808-164-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1808-168-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1808-157-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/3196-152-0x0000000002340000-0x0000000002341000-memory.dmpFilesize
4KB
-
memory/3196-167-0x0000000002340000-0x0000000002341000-memory.dmpFilesize
4KB
-
memory/3196-165-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/3196-171-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB