Analysis
-
max time kernel
290s -
max time network
276s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
01-05-2023 09:01
General
-
Target
COMPROBANTE DE PAGO MES SEPTIEMBRE-06T1.exe
-
Size
3.2MB
-
MD5
fb4fc5d42c4ef25aa2c03acf8ff50341
-
SHA1
fac0d2c08fd458f2900b44a52812de829857ec67
-
SHA256
970928c0e98061583e086cc6bf53675946b11e323e53fa2abd6f0218645378b7
-
SHA512
ef1c6ec81c0945f19aa44a26cb2ae63d8721a04ff9defd07430afbffbbf3b7ab25c134998d76a437bdb43bb552d121f92bc4bc3b7535aa331ebdcacc5c0b8289
-
SSDEEP
49152:6+Laj3yT7ywgoTx/OuR1DjKszq5rjraDv7c93OhlZ:XLAyB
Score
10/10
Malware Config
Extracted
Family
bandook
C2
deapproved.ru
Signatures
-
Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
-
Bandook payload 7 IoCs
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\COMPROBANTE DE PAGO MES SEPTIEMBRE-06T1.exe"C:\Users\Admin\AppData\Local\Temp\COMPROBANTE DE PAGO MES SEPTIEMBRE-06T1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\syswow64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
4KB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
4KB
-
Filesize
3.2MB
-
Filesize
4KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB