Analysis
-
max time kernel
298s -
max time network
288s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
30-04-2023 08:22
Static task
static1
Behavioral task
behavioral1
Sample
Factura_Cancelada #9665.exe
Resource
win7-20230220-en
6 signatures
300 seconds
General
-
Target
Factura_Cancelada #9665.exe
-
Size
2.5MB
-
MD5
1364bf7f610d63e3acae29a01fa7fc42
-
SHA1
d172088d17333c8547c887776bb202612a99cdf3
-
SHA256
c6cc299e6844352e287014b48ab1d2ee4963e3c19c2c108404344e0c02a204f4
-
SHA512
6af13f82dc2701d889ca402d25f20a1fdc564ade14fb00a57cbe4045bf509a9350decea951a6737a94a1d45a4c22786a6c8720d99f40e028eff9ff55cffbe65e
-
SSDEEP
24576:L1bMBO5V78tQYqSb8mvc68VQhQ1pMj0DRq+5xHsWVBYIpf8FVpE4mlTFXv/+XmJX:LbVOO16wDRN5DKBtBmzXMZhqkX9S
Malware Config
Extracted
Family
bandook
C2
gombos.ru
Signatures
-
Bandook payload 8 IoCs
Processes:
resource yara_rule behavioral2/memory/4164-156-0x0000000013140000-0x0000000013D94000-memory.dmp family_bandook behavioral2/memory/4164-158-0x0000000013140000-0x0000000013D94000-memory.dmp family_bandook behavioral2/memory/4164-159-0x0000000013140000-0x0000000013D94000-memory.dmp family_bandook behavioral2/memory/4164-160-0x0000000013140000-0x0000000013D94000-memory.dmp family_bandook behavioral2/memory/4164-161-0x0000000013140000-0x0000000013D94000-memory.dmp family_bandook behavioral2/memory/4164-163-0x0000000013140000-0x0000000013D94000-memory.dmp family_bandook behavioral2/memory/4164-165-0x0000000013140000-0x0000000013D94000-memory.dmp family_bandook behavioral2/memory/4164-169-0x0000000013140000-0x0000000013D94000-memory.dmp family_bandook -
Processes:
resource yara_rule behavioral2/memory/4164-154-0x0000000013140000-0x0000000013D94000-memory.dmp upx behavioral2/memory/4164-155-0x0000000013140000-0x0000000013D94000-memory.dmp upx behavioral2/memory/4164-156-0x0000000013140000-0x0000000013D94000-memory.dmp upx behavioral2/memory/4164-158-0x0000000013140000-0x0000000013D94000-memory.dmp upx behavioral2/memory/4164-159-0x0000000013140000-0x0000000013D94000-memory.dmp upx behavioral2/memory/4164-160-0x0000000013140000-0x0000000013D94000-memory.dmp upx behavioral2/memory/4164-161-0x0000000013140000-0x0000000013D94000-memory.dmp upx behavioral2/memory/4164-163-0x0000000013140000-0x0000000013D94000-memory.dmp upx behavioral2/memory/4164-165-0x0000000013140000-0x0000000013D94000-memory.dmp upx behavioral2/memory/4164-169-0x0000000013140000-0x0000000013D94000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msinfo32.exepid process 4164 msinfo32.exe 4164 msinfo32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Factura_Cancelada #9665.exedescription pid process target process PID 4668 wrote to memory of 4164 4668 Factura_Cancelada #9665.exe msinfo32.exe PID 4668 wrote to memory of 4164 4668 Factura_Cancelada #9665.exe msinfo32.exe PID 4668 wrote to memory of 4164 4668 Factura_Cancelada #9665.exe msinfo32.exe PID 4668 wrote to memory of 4916 4668 Factura_Cancelada #9665.exe Factura_Cancelada #9665.exe PID 4668 wrote to memory of 4916 4668 Factura_Cancelada #9665.exe Factura_Cancelada #9665.exe PID 4668 wrote to memory of 4916 4668 Factura_Cancelada #9665.exe Factura_Cancelada #9665.exe PID 4668 wrote to memory of 4164 4668 Factura_Cancelada #9665.exe msinfo32.exe PID 4668 wrote to memory of 4164 4668 Factura_Cancelada #9665.exe msinfo32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Factura_Cancelada #9665.exe"C:\Users\Admin\AppData\Local\Temp\Factura_Cancelada #9665.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\Factura_Cancelada #9665.exe"C:\Users\Admin\AppData\Local\Temp\Factura_Cancelada #9665.exe" ooooooooooooooo2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4164-161-0x0000000013140000-0x0000000013D94000-memory.dmpFilesize
12.3MB
-
memory/4164-155-0x0000000013140000-0x0000000013D94000-memory.dmpFilesize
12.3MB
-
memory/4164-156-0x0000000013140000-0x0000000013D94000-memory.dmpFilesize
12.3MB
-
memory/4164-169-0x0000000013140000-0x0000000013D94000-memory.dmpFilesize
12.3MB
-
memory/4164-165-0x0000000013140000-0x0000000013D94000-memory.dmpFilesize
12.3MB
-
memory/4164-163-0x0000000013140000-0x0000000013D94000-memory.dmpFilesize
12.3MB
-
memory/4164-160-0x0000000013140000-0x0000000013D94000-memory.dmpFilesize
12.3MB
-
memory/4164-159-0x0000000013140000-0x0000000013D94000-memory.dmpFilesize
12.3MB
-
memory/4164-154-0x0000000013140000-0x0000000013D94000-memory.dmpFilesize
12.3MB
-
memory/4164-158-0x0000000013140000-0x0000000013D94000-memory.dmpFilesize
12.3MB
-
memory/4668-152-0x0000000000400000-0x0000000000685000-memory.dmpFilesize
2.5MB
-
memory/4668-181-0x0000000000400000-0x0000000000685000-memory.dmpFilesize
2.5MB
-
memory/4668-135-0x0000000000400000-0x0000000000685000-memory.dmpFilesize
2.5MB
-
memory/4668-134-0x0000000000400000-0x0000000000685000-memory.dmpFilesize
2.5MB
-
memory/4668-133-0x00000000022E0000-0x00000000022E1000-memory.dmpFilesize
4KB
-
memory/4668-151-0x0000000000400000-0x0000000000685000-memory.dmpFilesize
2.5MB
-
memory/4668-150-0x0000000000400000-0x0000000000685000-memory.dmpFilesize
2.5MB
-
memory/4668-136-0x0000000000400000-0x0000000000685000-memory.dmpFilesize
2.5MB
-
memory/4668-157-0x0000000000400000-0x0000000000685000-memory.dmpFilesize
2.5MB
-
memory/4916-153-0x00000000022C0000-0x00000000022C1000-memory.dmpFilesize
4KB
-
memory/4916-166-0x0000000000400000-0x0000000000685000-memory.dmpFilesize
2.5MB
-
memory/4916-168-0x00000000022C0000-0x00000000022C1000-memory.dmpFilesize
4KB
-
memory/4916-172-0x0000000000400000-0x0000000000685000-memory.dmpFilesize
2.5MB