Analysis
-
max time kernel
599s -
max time network
560s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
22-06-2023 13:11
Static task
static1
Behavioral task
behavioral1
Sample
Envio de pago.exe
Resource
win7-20230621-en
5 signatures
600 seconds
General
-
Target
Envio de pago.exe
-
Size
5.9MB
-
MD5
186de479f8aaff2ed18aac1acf54b591
-
SHA1
84c43ddbd5eed1dac30374ac44cebb0adf1b52e8
-
SHA256
83b4e3a3f52a7fae6ca3ca2a955a6e1b13e9769248cb75b8561b5d60c26a18a0
-
SHA512
e88821331ff02e0b96769e9314291f920a0bb8d04bc7224dcd5638c3e11247203ed9d00ddbcd02e32368ef36175593fd475f50191092b65e1befd0544fe32c48
-
SSDEEP
49152:JFQPSP5e1ObxxpYflUaqtuu49nVaD/4H0lzDvQFEqLuhXJxs9Rp0D5zKDOmaQShr:JaPfe
Malware Config
Extracted
Family
bandook
C2
humut.su
Signatures
-
Bandook payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/1408-174-0x0000000013140000-0x0000000014751000-memory.dmp family_bandook behavioral2/memory/1408-175-0x0000000013140000-0x0000000014751000-memory.dmp family_bandook behavioral2/memory/1408-176-0x0000000013140000-0x0000000014751000-memory.dmp family_bandook behavioral2/memory/1408-177-0x0000000013140000-0x0000000014751000-memory.dmp family_bandook behavioral2/memory/1408-179-0x0000000013140000-0x0000000014751000-memory.dmp family_bandook behavioral2/memory/1408-181-0x0000000013140000-0x0000000014751000-memory.dmp family_bandook behavioral2/memory/1408-187-0x0000000013140000-0x0000000014751000-memory.dmp family_bandook -
Processes:
resource yara_rule behavioral2/memory/1408-172-0x0000000013140000-0x0000000014751000-memory.dmp upx behavioral2/memory/1408-173-0x0000000013140000-0x0000000014751000-memory.dmp upx behavioral2/memory/1408-174-0x0000000013140000-0x0000000014751000-memory.dmp upx behavioral2/memory/1408-175-0x0000000013140000-0x0000000014751000-memory.dmp upx behavioral2/memory/1408-176-0x0000000013140000-0x0000000014751000-memory.dmp upx behavioral2/memory/1408-177-0x0000000013140000-0x0000000014751000-memory.dmp upx behavioral2/memory/1408-179-0x0000000013140000-0x0000000014751000-memory.dmp upx behavioral2/memory/1408-181-0x0000000013140000-0x0000000014751000-memory.dmp upx behavioral2/memory/1408-187-0x0000000013140000-0x0000000014751000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msinfo32.exepid process 1408 msinfo32.exe 1408 msinfo32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Envio de pago.exedescription pid process target process PID 4324 wrote to memory of 1408 4324 Envio de pago.exe msinfo32.exe PID 4324 wrote to memory of 1408 4324 Envio de pago.exe msinfo32.exe PID 4324 wrote to memory of 1408 4324 Envio de pago.exe msinfo32.exe PID 4324 wrote to memory of 2112 4324 Envio de pago.exe Envio de pago.exe PID 4324 wrote to memory of 2112 4324 Envio de pago.exe Envio de pago.exe PID 4324 wrote to memory of 2112 4324 Envio de pago.exe Envio de pago.exe PID 4324 wrote to memory of 1408 4324 Envio de pago.exe msinfo32.exe PID 4324 wrote to memory of 1408 4324 Envio de pago.exe msinfo32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Envio de pago.exe"C:\Users\Admin\AppData\Local\Temp\Envio de pago.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\Envio de pago.exe"C:\Users\Admin\AppData\Local\Temp\Envio de pago.exe" ooooooooooooooo2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1408-172-0x0000000013140000-0x0000000014751000-memory.dmpFilesize
22.1MB
-
memory/1408-187-0x0000000013140000-0x0000000014751000-memory.dmpFilesize
22.1MB
-
memory/1408-181-0x0000000013140000-0x0000000014751000-memory.dmpFilesize
22.1MB
-
memory/1408-179-0x0000000013140000-0x0000000014751000-memory.dmpFilesize
22.1MB
-
memory/1408-177-0x0000000013140000-0x0000000014751000-memory.dmpFilesize
22.1MB
-
memory/1408-176-0x0000000013140000-0x0000000014751000-memory.dmpFilesize
22.1MB
-
memory/1408-175-0x0000000013140000-0x0000000014751000-memory.dmpFilesize
22.1MB
-
memory/1408-174-0x0000000013140000-0x0000000014751000-memory.dmpFilesize
22.1MB
-
memory/1408-173-0x0000000013140000-0x0000000014751000-memory.dmpFilesize
22.1MB
-
memory/2112-183-0x0000000000400000-0x00000000009FD000-memory.dmpFilesize
6.0MB
-
memory/2112-185-0x0000000002660000-0x0000000002661000-memory.dmpFilesize
4KB
-
memory/2112-170-0x0000000002660000-0x0000000002661000-memory.dmpFilesize
4KB
-
memory/2112-190-0x0000000000400000-0x00000000009FD000-memory.dmpFilesize
6.0MB
-
memory/2112-188-0x0000000000400000-0x00000000009FD000-memory.dmpFilesize
6.0MB
-
memory/4324-168-0x0000000000400000-0x00000000009FD000-memory.dmpFilesize
6.0MB
-
memory/4324-137-0x0000000000400000-0x00000000009FD000-memory.dmpFilesize
6.0MB
-
memory/4324-135-0x0000000000400000-0x00000000009FD000-memory.dmpFilesize
6.0MB
-
memory/4324-182-0x0000000000400000-0x00000000009FD000-memory.dmpFilesize
6.0MB
-
memory/4324-133-0x0000000000B90000-0x0000000000B91000-memory.dmpFilesize
4KB
-
memory/4324-167-0x0000000000400000-0x00000000009FD000-memory.dmpFilesize
6.0MB
-
memory/4324-134-0x0000000000400000-0x00000000009FD000-memory.dmpFilesize
6.0MB
-
memory/4324-171-0x0000000000400000-0x00000000009FD000-memory.dmpFilesize
6.0MB
-
memory/4324-169-0x0000000000400000-0x00000000009FD000-memory.dmpFilesize
6.0MB
-
memory/4324-197-0x0000000000400000-0x00000000009FD000-memory.dmpFilesize
6.0MB