Analysis
-
max time kernel
294s -
max time network
293s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
30-04-2023 08:24
General
-
Target
Retenciones_6895.exe
-
Size
3.2MB
-
MD5
c38819df2bfc368c78294786b0d7fbcb
-
SHA1
0f5956f49fad93bc051453ad1a71fed9a87283b3
-
SHA256
76b7aa41d3cf3ba45d6f32adeedb9453c5592013a45113ebdc8be1733930ec69
-
SHA512
0d6a33521606b444db3a33594d098de6c95240bb1d2a442ec23542ff51595af84c777df230ef8f7b8dd24f8988ae4915b682cc41fa4920c5481f1ae27c30da2f
-
SSDEEP
49152:r+Laj3LjNKar72uOjQDt7S7W9zlSVDtM4FKrKS0J6T0vEnV5:aLANKa5
Score
10/10
Malware Config
Extracted
Family
bandook
C2
deapproved.ru
Signatures
-
Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
-
Bandook payload 8 IoCs
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Retenciones_6895.exe"C:\Users\Admin\AppData\Local\Temp\Retenciones_6895.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB