Analysis
-
max time kernel
291s -
max time network
267s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
30-04-2023 08:23
Static task
static1
Behavioral task
behavioral1
Sample
Recibo de Pago.exe
Resource
win7-20230220-en
5 signatures
300 seconds
General
-
Target
Recibo de Pago.exe
-
Size
1.4MB
-
MD5
12465080fde8aa8db77de10490fa946c
-
SHA1
b9578f8c1d998932fe80859f82fce4000e926d51
-
SHA256
4a877cf00bbca9242c045fe0e7fb67b130f4d6d46dcc56504395e2b12ab28437
-
SHA512
1412a35e3608a1d15a52fc46bd5d4664527df1c7db785624c159bd4fba400f8fd1c1fc87fa220daea882f9b34af889b9a0899e07adc5b9f1f1f99e4f2ba632a7
-
SSDEEP
24576:C1RS4xszUmeE6+NbEZlnibawoGifZr4N8vcUh5RRQTgUi:CvSIG+xrZpRqkUi
Malware Config
Extracted
Family
bandook
C2
deapproved.ru
Signatures
-
Bandook payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/2680-155-0x0000000013140000-0x0000000013C7D000-memory.dmp family_bandook behavioral2/memory/2680-156-0x0000000013140000-0x0000000013C7D000-memory.dmp family_bandook behavioral2/memory/2680-157-0x0000000013140000-0x0000000013C7D000-memory.dmp family_bandook behavioral2/memory/2680-158-0x0000000013140000-0x0000000013C7D000-memory.dmp family_bandook behavioral2/memory/2680-160-0x0000000013140000-0x0000000013C7D000-memory.dmp family_bandook behavioral2/memory/2680-162-0x0000000013140000-0x0000000013C7D000-memory.dmp family_bandook behavioral2/memory/2680-164-0x0000000013140000-0x0000000013C7D000-memory.dmp family_bandook -
Processes:
resource yara_rule behavioral2/memory/2680-152-0x0000000013140000-0x0000000013C7D000-memory.dmp upx behavioral2/memory/2680-153-0x0000000013140000-0x0000000013C7D000-memory.dmp upx behavioral2/memory/2680-155-0x0000000013140000-0x0000000013C7D000-memory.dmp upx behavioral2/memory/2680-156-0x0000000013140000-0x0000000013C7D000-memory.dmp upx behavioral2/memory/2680-157-0x0000000013140000-0x0000000013C7D000-memory.dmp upx behavioral2/memory/2680-158-0x0000000013140000-0x0000000013C7D000-memory.dmp upx behavioral2/memory/2680-160-0x0000000013140000-0x0000000013C7D000-memory.dmp upx behavioral2/memory/2680-162-0x0000000013140000-0x0000000013C7D000-memory.dmp upx behavioral2/memory/2680-164-0x0000000013140000-0x0000000013C7D000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msinfo32.exepid process 2680 msinfo32.exe 2680 msinfo32.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
Recibo de Pago.exedescription pid process target process PID 1628 wrote to memory of 2680 1628 Recibo de Pago.exe msinfo32.exe PID 1628 wrote to memory of 2680 1628 Recibo de Pago.exe msinfo32.exe PID 1628 wrote to memory of 2680 1628 Recibo de Pago.exe msinfo32.exe PID 1628 wrote to memory of 2680 1628 Recibo de Pago.exe msinfo32.exe PID 1628 wrote to memory of 2680 1628 Recibo de Pago.exe msinfo32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1628-154-0x0000000000400000-0x000000000056C000-memory.dmpFilesize
1.4MB
-
memory/1628-134-0x0000000000400000-0x000000000056C000-memory.dmpFilesize
1.4MB
-
memory/1628-135-0x0000000000400000-0x000000000056C000-memory.dmpFilesize
1.4MB
-
memory/1628-136-0x0000000000400000-0x000000000056C000-memory.dmpFilesize
1.4MB
-
memory/1628-149-0x0000000000400000-0x000000000056C000-memory.dmpFilesize
1.4MB
-
memory/1628-150-0x0000000000400000-0x000000000056C000-memory.dmpFilesize
1.4MB
-
memory/1628-151-0x0000000000400000-0x000000000056C000-memory.dmpFilesize
1.4MB
-
memory/1628-170-0x0000000000400000-0x000000000056C000-memory.dmpFilesize
1.4MB
-
memory/1628-133-0x0000000000840000-0x0000000000841000-memory.dmpFilesize
4KB
-
memory/2680-153-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/2680-155-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/2680-156-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/2680-157-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/2680-158-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/2680-160-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/2680-162-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/2680-164-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB
-
memory/2680-152-0x0000000013140000-0x0000000013C7D000-memory.dmpFilesize
11.2MB