Analysis
-
max time kernel
298s -
max time network
301s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
30-04-2023 08:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1Factura de Cobro.exe
Resource
win7-20230220-en
5 signatures
300 seconds
General
-
Target
1Factura de Cobro.exe
-
Size
4.4MB
-
MD5
963dc44ec86b6f0e667716a4eafb63b1
-
SHA1
f487e173e2d8ef1c95d33fef82db94ddd2231e48
-
SHA256
14fe82910c2f207c0d0af16adb78beb03b871289d92bfeb52e7d4814b075e126
-
SHA512
6300c982b38242c3d591410672d6872b2e80d675acb421394b78b59f18e9e85c300e12e3bf7bddc82eb6aa86a5dd998064232c90c0c5d164a4c6055dab97cc2e
-
SSDEEP
49152:MxJPhRf0ewejGkahfiJWcSlAerZeWfEhiHECbFkt+aSj982TnUkcNVuV9zwu:MxTGeyk
Malware Config
Extracted
Family
bandook
C2
bomes.ru
Signatures
-
Bandook payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1808-81-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral1/memory/1808-86-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral1/memory/1808-93-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral1/memory/1808-95-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral1/memory/1808-96-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral1/memory/1808-98-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral1/memory/1808-100-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook -
Processes:
resource yara_rule behavioral1/memory/1808-78-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1808-79-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1808-81-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1808-86-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1808-93-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1808-95-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1808-96-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1808-98-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1808-100-0x0000000013140000-0x0000000014009000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
msinfo32.exepid process 1808 msinfo32.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
1Factura de Cobro.exedescription pid process target process PID 1376 wrote to memory of 1808 1376 1Factura de Cobro.exe msinfo32.exe PID 1376 wrote to memory of 1808 1376 1Factura de Cobro.exe msinfo32.exe PID 1376 wrote to memory of 1808 1376 1Factura de Cobro.exe msinfo32.exe PID 1376 wrote to memory of 1808 1376 1Factura de Cobro.exe msinfo32.exe PID 1376 wrote to memory of 1592 1376 1Factura de Cobro.exe 1Factura de Cobro.exe PID 1376 wrote to memory of 1592 1376 1Factura de Cobro.exe 1Factura de Cobro.exe PID 1376 wrote to memory of 1592 1376 1Factura de Cobro.exe 1Factura de Cobro.exe PID 1376 wrote to memory of 1592 1376 1Factura de Cobro.exe 1Factura de Cobro.exe PID 1376 wrote to memory of 1808 1376 1Factura de Cobro.exe msinfo32.exe PID 1376 wrote to memory of 1808 1376 1Factura de Cobro.exe msinfo32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1Factura de Cobro.exe"C:\Users\Admin\AppData\Local\Temp\1Factura de Cobro.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\syswow64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1Factura de Cobro.exe"C:\Users\Admin\AppData\Local\Temp\1Factura de Cobro.exe" ooooooooooooooo2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1376-73-0x0000000000400000-0x0000000000869000-memory.dmpFilesize
4.4MB
-
memory/1376-105-0x0000000000400000-0x0000000000869000-memory.dmpFilesize
4.4MB
-
memory/1376-56-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1376-57-0x0000000000400000-0x0000000000869000-memory.dmpFilesize
4.4MB
-
memory/1376-82-0x0000000000400000-0x0000000000869000-memory.dmpFilesize
4.4MB
-
memory/1376-59-0x0000000000400000-0x0000000000869000-memory.dmpFilesize
4.4MB
-
memory/1376-55-0x0000000000400000-0x0000000000869000-memory.dmpFilesize
4.4MB
-
memory/1376-71-0x0000000000400000-0x0000000000869000-memory.dmpFilesize
4.4MB
-
memory/1376-58-0x0000000000400000-0x0000000000869000-memory.dmpFilesize
4.4MB
-
memory/1376-54-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1376-72-0x0000000000400000-0x0000000000869000-memory.dmpFilesize
4.4MB
-
memory/1592-91-0x0000000000400000-0x0000000000869000-memory.dmpFilesize
4.4MB
-
memory/1592-75-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1592-87-0x0000000000400000-0x0000000000869000-memory.dmpFilesize
4.4MB
-
memory/1592-84-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1592-83-0x0000000000400000-0x0000000000869000-memory.dmpFilesize
4.4MB
-
memory/1808-78-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1808-81-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1808-86-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1808-79-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1808-77-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1808-93-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1808-95-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1808-96-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1808-98-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1808-100-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1808-76-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB