Analysis
-
max time kernel
291s -
max time network
289s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
30-04-2023 08:24
Static task
static1
Behavioral task
behavioral1
Sample
Retenciones.exe
Resource
win7-20230220-en
5 signatures
300 seconds
General
-
Target
Retenciones.exe
-
Size
3.2MB
-
MD5
6bd530a8417b6ab6b5ea0230ebe16857
-
SHA1
9e7cdf3192707cd06ef9626d3d1867a7e419b23e
-
SHA256
ab8d1ee87ac5dc2adb51e45588ea7934aa3a50ceb4033ac2aca4d16f320ab609
-
SHA512
8c7d0317d2112f79b062fc73bd8f45c8475dece6d624a3721e4b14d84b13eb40b4ff27259dfb5f29e129c3d714a33d12695bf134463b565beb5698d5dbe45104
-
SSDEEP
49152:N+Laj3TXU7Ni5AacXjIuqGvGNP0FWtK7zI70l:ULATX0
Malware Config
Extracted
Family
bandook
C2
deapproved.ru
Signatures
-
Bandook payload 8 IoCs
Processes:
resource yara_rule behavioral2/memory/2480-155-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/2480-156-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/2480-157-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/2480-158-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/2480-159-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/2480-161-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/2480-163-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral2/memory/2480-165-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook -
Processes:
resource yara_rule behavioral2/memory/2480-152-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/2480-153-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/2480-155-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/2480-156-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/2480-157-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/2480-158-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/2480-159-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/2480-161-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/2480-163-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral2/memory/2480-165-0x0000000013140000-0x0000000014009000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msinfo32.exepid process 2480 msinfo32.exe 2480 msinfo32.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
Retenciones.exedescription pid process target process PID 1796 wrote to memory of 2480 1796 Retenciones.exe msinfo32.exe PID 1796 wrote to memory of 2480 1796 Retenciones.exe msinfo32.exe PID 1796 wrote to memory of 2480 1796 Retenciones.exe msinfo32.exe PID 1796 wrote to memory of 2480 1796 Retenciones.exe msinfo32.exe PID 1796 wrote to memory of 2480 1796 Retenciones.exe msinfo32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1796-154-0x0000000000400000-0x0000000000738000-memory.dmpFilesize
3.2MB
-
memory/1796-134-0x0000000000400000-0x0000000000738000-memory.dmpFilesize
3.2MB
-
memory/1796-135-0x0000000000400000-0x0000000000738000-memory.dmpFilesize
3.2MB
-
memory/1796-136-0x0000000000400000-0x0000000000738000-memory.dmpFilesize
3.2MB
-
memory/1796-149-0x0000000000400000-0x0000000000738000-memory.dmpFilesize
3.2MB
-
memory/1796-150-0x0000000000400000-0x0000000000738000-memory.dmpFilesize
3.2MB
-
memory/1796-151-0x0000000000400000-0x0000000000738000-memory.dmpFilesize
3.2MB
-
memory/1796-171-0x0000000000400000-0x0000000000738000-memory.dmpFilesize
3.2MB
-
memory/1796-133-0x00000000008C0000-0x00000000008C1000-memory.dmpFilesize
4KB
-
memory/2480-153-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/2480-155-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/2480-156-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/2480-157-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/2480-158-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/2480-159-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/2480-161-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/2480-163-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/2480-165-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/2480-152-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB