Analysis
-
max time kernel
300s -
max time network
295s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
30-04-2023 08:19
Static task
static1
Behavioral task
behavioral1
Sample
COMUNICADO VLN0000785623.exe
Resource
win7-20230220-en
General
-
Target
COMUNICADO VLN0000785623.exe
-
Size
3.0MB
-
MD5
b138dcc6464dde265d945d48cdb91c03
-
SHA1
97127548381b5d53ef4adc9a79b47738f9f0e240
-
SHA256
ffc28b05a322c5214cf30408f07bd29aba88930d1225a75626bbd08dc2b6e883
-
SHA512
0b16c4e66114ab32710ebfab16845508455c914a97fb3b064f7b556deddc289fe9e959bbf98c76fb5c44905d586bae5454f41f9099cab723d58f036b92dd6960
-
SSDEEP
24576:6h/AD1U14A8jpwmlYbPN5UGhsqp9EuNQ2YDcJm22C/0fqUb+Vhn7dv+6SSoec/SD:6JaBAeVgm5x2PAehtqSVyX4r2ecXY
Malware Config
Extracted
bandook
deapproved.ru
Signatures
-
Bandook payload 8 IoCs
Processes:
resource yara_rule behavioral2/memory/4524-156-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/4524-158-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/4524-157-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/4524-159-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/4524-160-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/4524-162-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/4524-164-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/4524-168-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook -
Processes:
resource yara_rule behavioral2/memory/4524-154-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/4524-155-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/4524-156-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/4524-158-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/4524-157-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/4524-159-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/4524-160-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/4524-162-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/4524-164-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/4524-168-0x0000000013140000-0x0000000014009000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msinfo32.exepid process 4524 msinfo32.exe 4524 msinfo32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
COMUNICADO VLN0000785623.exedescription pid process target process PID 932 wrote to memory of 4524 932 COMUNICADO VLN0000785623.exe msinfo32.exe PID 932 wrote to memory of 4524 932 COMUNICADO VLN0000785623.exe msinfo32.exe PID 932 wrote to memory of 4524 932 COMUNICADO VLN0000785623.exe msinfo32.exe PID 932 wrote to memory of 1048 932 COMUNICADO VLN0000785623.exe COMUNICADO VLN0000785623.exe PID 932 wrote to memory of 1048 932 COMUNICADO VLN0000785623.exe COMUNICADO VLN0000785623.exe PID 932 wrote to memory of 1048 932 COMUNICADO VLN0000785623.exe COMUNICADO VLN0000785623.exe PID 932 wrote to memory of 4524 932 COMUNICADO VLN0000785623.exe msinfo32.exe PID 932 wrote to memory of 4524 932 COMUNICADO VLN0000785623.exe msinfo32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\COMUNICADO VLN0000785623.exe"C:\Users\Admin\AppData\Local\Temp\COMUNICADO VLN0000785623.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\COMUNICADO VLN0000785623.exe"C:\Users\Admin\AppData\Local\Temp\COMUNICADO VLN0000785623.exe" dkddkdkkdkdd ddd2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/932-133-0x0000000002370000-0x0000000002371000-memory.dmpFilesize
4KB
-
memory/932-180-0x0000000000400000-0x000000000070A000-memory.dmpFilesize
3.0MB
-
memory/932-135-0x0000000000400000-0x000000000070A000-memory.dmpFilesize
3.0MB
-
memory/932-136-0x0000000000400000-0x000000000070A000-memory.dmpFilesize
3.0MB
-
memory/932-166-0x0000000000400000-0x000000000070A000-memory.dmpFilesize
3.0MB
-
memory/932-149-0x0000000000400000-0x000000000070A000-memory.dmpFilesize
3.0MB
-
memory/932-134-0x0000000000400000-0x000000000070A000-memory.dmpFilesize
3.0MB
-
memory/932-150-0x0000000000400000-0x000000000070A000-memory.dmpFilesize
3.0MB
-
memory/932-137-0x0000000000400000-0x000000000070A000-memory.dmpFilesize
3.0MB
-
memory/932-153-0x0000000000400000-0x000000000070A000-memory.dmpFilesize
3.0MB
-
memory/932-151-0x0000000000400000-0x000000000070A000-memory.dmpFilesize
3.0MB
-
memory/1048-173-0x0000000000400000-0x000000000070A000-memory.dmpFilesize
3.0MB
-
memory/1048-165-0x0000000000400000-0x000000000070A000-memory.dmpFilesize
3.0MB
-
memory/1048-169-0x0000000000400000-0x000000000070A000-memory.dmpFilesize
3.0MB
-
memory/1048-167-0x00000000024C0000-0x00000000024C1000-memory.dmpFilesize
4KB
-
memory/1048-152-0x00000000024C0000-0x00000000024C1000-memory.dmpFilesize
4KB
-
memory/4524-156-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/4524-162-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/4524-164-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/4524-160-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/4524-159-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/4524-157-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/4524-168-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/4524-158-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/4524-155-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/4524-154-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB