Analysis
-
max time kernel
300s -
max time network
275s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
30-04-2023 08:19
Static task
static1
Behavioral task
behavioral1
Sample
Cancelar Factura.exe
Resource
win7-20230220-en
5 signatures
300 seconds
General
-
Target
Cancelar Factura.exe
-
Size
2.9MB
-
MD5
5c3cb19563848d0bee7238a6bf55abc9
-
SHA1
766737ca6149bcd018ef7cfce49b3b90fe0325d9
-
SHA256
c1c7a5fe3203fe7ecd6b4581a12f85803174d5e2b8df2e98cccb8a5d740b1d36
-
SHA512
bbf31136b59edfc1c630a96e348a20d7f494e999534e19aea565ca9c2f074f27be8bac27ccf07165c5f025daa955741a131424250a543d83e6e46fed2af44341
-
SSDEEP
49152:Ofc6jhQyaOKBcZt7MUt0dfwwWC1R9Jbl8/u5K:O062yaOt
Malware Config
Extracted
Family
bandook
C2
bomes.ru
Signatures
-
Bandook payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1740-80-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral1/memory/1740-81-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral1/memory/1740-91-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral1/memory/1740-92-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral1/memory/1740-93-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral1/memory/1740-95-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral1/memory/1740-97-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook -
Processes:
resource yara_rule behavioral1/memory/1740-78-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1740-79-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1740-80-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1740-81-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1740-91-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1740-92-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1740-93-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1740-95-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1740-97-0x0000000013140000-0x0000000014009000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
msinfo32.exepid process 1740 msinfo32.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Cancelar Factura.exedescription pid process target process PID 1992 wrote to memory of 1740 1992 Cancelar Factura.exe msinfo32.exe PID 1992 wrote to memory of 1740 1992 Cancelar Factura.exe msinfo32.exe PID 1992 wrote to memory of 1740 1992 Cancelar Factura.exe msinfo32.exe PID 1992 wrote to memory of 1740 1992 Cancelar Factura.exe msinfo32.exe PID 1992 wrote to memory of 636 1992 Cancelar Factura.exe Cancelar Factura.exe PID 1992 wrote to memory of 636 1992 Cancelar Factura.exe Cancelar Factura.exe PID 1992 wrote to memory of 636 1992 Cancelar Factura.exe Cancelar Factura.exe PID 1992 wrote to memory of 636 1992 Cancelar Factura.exe Cancelar Factura.exe PID 1992 wrote to memory of 1740 1992 Cancelar Factura.exe msinfo32.exe PID 1992 wrote to memory of 1740 1992 Cancelar Factura.exe msinfo32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cancelar Factura.exe"C:\Users\Admin\AppData\Local\Temp\Cancelar Factura.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\syswow64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\Cancelar Factura.exe"C:\Users\Admin\AppData\Local\Temp\Cancelar Factura.exe" ooooooooooooooo2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/636-75-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/636-90-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/636-88-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/636-85-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/636-83-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/1740-79-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1740-92-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1740-97-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1740-95-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1740-76-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1740-77-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1740-78-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1740-93-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1740-80-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1740-81-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1740-91-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1992-59-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/1992-58-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/1992-56-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1992-55-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/1992-82-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/1992-72-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/1992-54-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1992-71-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/1992-73-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/1992-104-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB