Analysis
-
max time kernel
300s -
max time network
291s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
30-04-2023 08:20
Static task
static1
Behavioral task
behavioral1
Sample
Cotizacion 1.exe
Resource
win7-20230220-en
windows7-x64
5 signatures
300 seconds
General
-
Target
Cotizacion 1.exe
-
Size
1.4MB
-
MD5
13c45a10e3b3f932e2c9e76d33a70eb1
-
SHA1
df49a65c54d3335ad7274ccb7312f07ddfecb48b
-
SHA256
445bc1991044f1852e878421bdd17c5eee091069f11d2107564492435a01182b
-
SHA512
51c49a408c24627996ac30fc3c519f6e77d3ada6f7c924cbacfcd67bd88678ab6423d8acb6ed2953a8fe4a6662081b2f00409b050d61f76678d555e02358edf7
-
SSDEEP
24576:/1RS4xszUmeE6+NbEZlnibawoGif8pk8kjUiuUiBFN6VQu0:/vSIG+xrPjUimlPf
Malware Config
Extracted
Family
bandook
C2
deapproved.ru
Signatures
-
Bandook payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/800-156-0x0000000013140000-0x0000000013C7D000-memory.dmp family_bandook behavioral2/memory/800-157-0x0000000013140000-0x0000000013C7D000-memory.dmp family_bandook behavioral2/memory/800-158-0x0000000013140000-0x0000000013C7D000-memory.dmp family_bandook behavioral2/memory/800-160-0x0000000013140000-0x0000000013C7D000-memory.dmp family_bandook behavioral2/memory/800-161-0x0000000013140000-0x0000000013C7D000-memory.dmp family_bandook behavioral2/memory/800-163-0x0000000013140000-0x0000000013C7D000-memory.dmp family_bandook behavioral2/memory/800-165-0x0000000013140000-0x0000000013C7D000-memory.dmp family_bandook -
Processes:
resource yara_rule behavioral2/memory/800-152-0x0000000013140000-0x0000000013C7D000-memory.dmp upx behavioral2/memory/800-153-0x0000000013140000-0x0000000013C7D000-memory.dmp upx behavioral2/memory/800-156-0x0000000013140000-0x0000000013C7D000-memory.dmp upx behavioral2/memory/800-157-0x0000000013140000-0x0000000013C7D000-memory.dmp upx behavioral2/memory/800-158-0x0000000013140000-0x0000000013C7D000-memory.dmp upx behavioral2/memory/800-160-0x0000000013140000-0x0000000013C7D000-memory.dmp upx behavioral2/memory/800-161-0x0000000013140000-0x0000000013C7D000-memory.dmp upx behavioral2/memory/800-163-0x0000000013140000-0x0000000013C7D000-memory.dmp upx behavioral2/memory/800-165-0x0000000013140000-0x0000000013C7D000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msinfo32.exepid process 800 msinfo32.exe 800 msinfo32.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
Cotizacion 1.exedescription pid process target process PID 1920 wrote to memory of 800 1920 Cotizacion 1.exe msinfo32.exe PID 1920 wrote to memory of 800 1920 Cotizacion 1.exe msinfo32.exe PID 1920 wrote to memory of 800 1920 Cotizacion 1.exe msinfo32.exe PID 1920 wrote to memory of 800 1920 Cotizacion 1.exe msinfo32.exe PID 1920 wrote to memory of 800 1920 Cotizacion 1.exe msinfo32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/800-158-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/800-157-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/800-153-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/800-156-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/800-165-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/800-163-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/800-161-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/800-152-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/800-160-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/1920-150-0x0000000000400000-0x000000000056C000-memory.dmpFilesize
1.4MB
-
memory/1920-137-0x0000000000400000-0x000000000056C000-memory.dmpFilesize
1.4MB
-
memory/1920-135-0x0000000000400000-0x000000000056C000-memory.dmpFilesize
1.4MB
-
memory/1920-133-0x00000000021A0000-0x00000000021A1000-memory.dmpFilesize
4KB
-
memory/1920-171-0x0000000000400000-0x000000000056C000-memory.dmpFilesize
1.4MB
-
memory/1920-151-0x0000000000400000-0x000000000056C000-memory.dmpFilesize
1.4MB
-
memory/1920-134-0x0000000000400000-0x000000000056C000-memory.dmpFilesize
1.4MB
-
memory/1920-149-0x0000000000400000-0x000000000056C000-memory.dmpFilesize
1.4MB
-
memory/1920-154-0x0000000000400000-0x000000000056C000-memory.dmpFilesize
1.4MB