Analysis
-
max time kernel
300s -
max time network
287s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
30-04-2023 08:23
Static task
static1
Behavioral task
behavioral1
Sample
RECORDATORIO URGENTE #R003258.exe
Resource
win7-20230220-en
5 signatures
300 seconds
General
-
Target
RECORDATORIO URGENTE #R003258.exe
-
Size
2.9MB
-
MD5
3ab9edd32c0fc1022350dc0a271ac6f8
-
SHA1
de93c9347e371249709bffddf9a1772b92233121
-
SHA256
be3f588ae0fad0cb211a1a054c1f1dea5376dea47f0eda3ab6209cf45bc84181
-
SHA512
77ccbc06b026494dae053824d6f9f2b1f010fbad5feca6c26ff0c7a9d95136bb7d64650dfd3bd6cc122dd7cd8cee477514ea3905ebd311c2ca22a771bf7ce023
-
SSDEEP
49152:MbQ/ZpxAzCdiOip/DD5KELwr8zhDgb2Chlvvs:MbipxAB
Malware Config
Extracted
Family
bandook
C2
deapproved.ru
Signatures
-
Bandook payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1508-80-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral1/memory/1508-85-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral1/memory/1508-92-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral1/memory/1508-93-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral1/memory/1508-94-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral1/memory/1508-96-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook behavioral1/memory/1508-98-0x0000000013140000-0x0000000014009000-memory.dmp family_bandook -
Processes:
resource yara_rule behavioral1/memory/1508-78-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1508-79-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1508-80-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1508-85-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1508-92-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1508-93-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1508-94-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1508-96-0x0000000013140000-0x0000000014009000-memory.dmp upx behavioral1/memory/1508-98-0x0000000013140000-0x0000000014009000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
msinfo32.exepid process 1508 msinfo32.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
RECORDATORIO URGENTE #R003258.exedescription pid process target process PID 1300 wrote to memory of 1508 1300 RECORDATORIO URGENTE #R003258.exe msinfo32.exe PID 1300 wrote to memory of 1508 1300 RECORDATORIO URGENTE #R003258.exe msinfo32.exe PID 1300 wrote to memory of 1508 1300 RECORDATORIO URGENTE #R003258.exe msinfo32.exe PID 1300 wrote to memory of 1508 1300 RECORDATORIO URGENTE #R003258.exe msinfo32.exe PID 1300 wrote to memory of 568 1300 RECORDATORIO URGENTE #R003258.exe RECORDATORIO URGENTE #R003258.exe PID 1300 wrote to memory of 568 1300 RECORDATORIO URGENTE #R003258.exe RECORDATORIO URGENTE #R003258.exe PID 1300 wrote to memory of 568 1300 RECORDATORIO URGENTE #R003258.exe RECORDATORIO URGENTE #R003258.exe PID 1300 wrote to memory of 568 1300 RECORDATORIO URGENTE #R003258.exe RECORDATORIO URGENTE #R003258.exe PID 1300 wrote to memory of 1508 1300 RECORDATORIO URGENTE #R003258.exe msinfo32.exe PID 1300 wrote to memory of 1508 1300 RECORDATORIO URGENTE #R003258.exe msinfo32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RECORDATORIO URGENTE #R003258.exe"C:\Users\Admin\AppData\Local\Temp\RECORDATORIO URGENTE #R003258.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\syswow64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\RECORDATORIO URGENTE #R003258.exe"C:\Users\Admin\AppData\Local\Temp\RECORDATORIO URGENTE #R003258.exe" dkddkdkkdkdd ddd2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/568-75-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/568-90-0x0000000000400000-0x00000000006E9000-memory.dmpFilesize
2.9MB
-
memory/568-88-0x0000000000400000-0x00000000006E9000-memory.dmpFilesize
2.9MB
-
memory/568-84-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/568-82-0x0000000000400000-0x00000000006E9000-memory.dmpFilesize
2.9MB
-
memory/1300-72-0x0000000000400000-0x00000000006E9000-memory.dmpFilesize
2.9MB
-
memory/1300-59-0x0000000000400000-0x00000000006E9000-memory.dmpFilesize
2.9MB
-
memory/1300-73-0x0000000000400000-0x00000000006E9000-memory.dmpFilesize
2.9MB
-
memory/1300-71-0x0000000000400000-0x00000000006E9000-memory.dmpFilesize
2.9MB
-
memory/1300-104-0x0000000000400000-0x00000000006E9000-memory.dmpFilesize
2.9MB
-
memory/1300-55-0x0000000000400000-0x00000000006E9000-memory.dmpFilesize
2.9MB
-
memory/1300-54-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/1300-56-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/1300-58-0x0000000000400000-0x00000000006E9000-memory.dmpFilesize
2.9MB
-
memory/1300-81-0x0000000000400000-0x00000000006E9000-memory.dmpFilesize
2.9MB
-
memory/1508-78-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1508-80-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1508-85-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1508-79-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1508-77-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1508-92-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1508-93-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1508-94-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1508-96-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1508-98-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB
-
memory/1508-76-0x0000000013140000-0x0000000014009000-memory.dmpFilesize
14.8MB