Analysis
-
max time kernel
300s -
max time network
275s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
30-04-2023 08:19
Static task
static1
Behavioral task
behavioral1
Sample
Cancelar Factura.exe
Resource
win7-20230220-en
5 signatures
300 seconds
General
-
Target
Cancelar Factura.exe
-
Size
2.9MB
-
MD5
5c3cb19563848d0bee7238a6bf55abc9
-
SHA1
766737ca6149bcd018ef7cfce49b3b90fe0325d9
-
SHA256
c1c7a5fe3203fe7ecd6b4581a12f85803174d5e2b8df2e98cccb8a5d740b1d36
-
SHA512
bbf31136b59edfc1c630a96e348a20d7f494e999534e19aea565ca9c2f074f27be8bac27ccf07165c5f025daa955741a131424250a543d83e6e46fed2af44341
-
SSDEEP
49152:Ofc6jhQyaOKBcZt7MUt0dfwwWC1R9Jbl8/u5K:O062yaOt
Malware Config
Extracted
Family
bandook
C2
bomes.ru
Signatures
-
Bandook payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/4620-159-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/4620-160-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/4620-161-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/4620-163-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/4620-164-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/4620-166-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/4620-170-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook -
Processes:
resource yara_rule behavioral2/memory/4620-154-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/4620-156-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/4620-159-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/4620-160-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/4620-161-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/4620-163-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/4620-164-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/4620-166-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/4620-170-0x0000000013140000-0x0000000014009000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Cancelar Factura.exedescription pid process target process PID 4592 set thread context of 4620 4592 Cancelar Factura.exe msinfo32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msinfo32.exepid process 4620 msinfo32.exe 4620 msinfo32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Cancelar Factura.exedescription pid process target process PID 4592 wrote to memory of 4620 4592 Cancelar Factura.exe msinfo32.exe PID 4592 wrote to memory of 4620 4592 Cancelar Factura.exe msinfo32.exe PID 4592 wrote to memory of 4620 4592 Cancelar Factura.exe msinfo32.exe PID 4592 wrote to memory of 2544 4592 Cancelar Factura.exe Cancelar Factura.exe PID 4592 wrote to memory of 2544 4592 Cancelar Factura.exe Cancelar Factura.exe PID 4592 wrote to memory of 2544 4592 Cancelar Factura.exe Cancelar Factura.exe PID 4592 wrote to memory of 4620 4592 Cancelar Factura.exe msinfo32.exe PID 4592 wrote to memory of 4620 4592 Cancelar Factura.exe msinfo32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cancelar Factura.exe"C:\Users\Admin\AppData\Local\Temp\Cancelar Factura.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\Cancelar Factura.exe"C:\Users\Admin\AppData\Local\Temp\Cancelar Factura.exe" ooooooooooooooo2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2544-153-0x00000000009C0000-0x00000000009C1000-memory.dmpFilesize
4KB
-
memory/2544-173-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/2544-171-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/2544-169-0x00000000009C0000-0x00000000009C1000-memory.dmpFilesize
4KB
-
memory/2544-167-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/4592-157-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/4592-137-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/4592-151-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/4592-152-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/4592-138-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/4592-182-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/4592-134-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/4592-133-0x0000000000990000-0x0000000000991000-memory.dmpFilesize
4KB
-
memory/4592-135-0x0000000000990000-0x0000000000991000-memory.dmpFilesize
4KB
-
memory/4592-150-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/4592-136-0x0000000000400000-0x00000000006EA000-memory.dmpFilesize
2.9MB
-
memory/4620-160-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/4620-164-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/4620-166-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/4620-163-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/4620-161-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/4620-170-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/4620-159-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/4620-156-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/4620-154-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB