Analysis
-
max time kernel
1201s -
max time network
1186s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18-07-2023 20:24
Static task
static1
Behavioral task
behavioral1
Sample
7d4dcff5a13e4ae85a620e5bf234af39f55ce0cc.exe
Resource
win10v2004-20230703-en
General
-
Target
7d4dcff5a13e4ae85a620e5bf234af39f55ce0cc.exe
-
Size
5.4MB
-
MD5
e81aef3c68dcdbd2fa9f34cdf438069d
-
SHA1
7d4dcff5a13e4ae85a620e5bf234af39f55ce0cc
-
SHA256
4171d999ac09b358f1ecdeb7ff4bdd1fe368e8d2beab2b34d1b3a9ae165e6005
-
SHA512
01beb65f1acd99ea753a9ac903591240960733d927fa99fce34ae411843fa2f4225212d7e901edacc137fd2c8e8a97efb54018db8ace417f258d2f8e4d19e3e2
-
SSDEEP
49152:XcJ48N5owU9jYLEGPsuVZe1GAMXC4ll+8iBMmARC6y+9Vsl8DW7YeQv/53TGdwiI:sq8AwIU
Malware Config
Extracted
bandook
185.10.68.52
Signatures
-
Bandook payload 16 IoCs
Processes:
resource yara_rule behavioral1/memory/2916-175-0x0000000013140000-0x0000000014246000-memory.dmp family_bandook behavioral1/memory/2916-176-0x0000000013140000-0x0000000014246000-memory.dmp family_bandook behavioral1/memory/2916-177-0x0000000013140000-0x0000000014246000-memory.dmp family_bandook behavioral1/memory/2916-178-0x0000000013140000-0x0000000014246000-memory.dmp family_bandook behavioral1/memory/2916-179-0x0000000013140000-0x0000000014246000-memory.dmp family_bandook behavioral1/memory/2916-181-0x0000000013140000-0x0000000014246000-memory.dmp family_bandook behavioral1/memory/2916-184-0x0000000013140000-0x0000000014246000-memory.dmp family_bandook behavioral1/memory/2916-187-0x0000000013140000-0x0000000014246000-memory.dmp family_bandook behavioral1/memory/2916-194-0x0000000013140000-0x0000000014246000-memory.dmp family_bandook behavioral1/memory/2916-195-0x0000000013140000-0x0000000014246000-memory.dmp family_bandook behavioral1/memory/2916-196-0x0000000013140000-0x0000000014246000-memory.dmp family_bandook behavioral1/memory/2916-197-0x0000000013140000-0x0000000014246000-memory.dmp family_bandook behavioral1/memory/2916-199-0x0000000013140000-0x0000000014246000-memory.dmp family_bandook behavioral1/memory/2916-200-0x0000000013140000-0x0000000014246000-memory.dmp family_bandook behavioral1/memory/232-286-0x0000000013140000-0x0000000014246000-memory.dmp family_bandook behavioral1/memory/232-289-0x0000000013140000-0x0000000014246000-memory.dmp family_bandook -
Processes:
resource yara_rule behavioral1/memory/2916-172-0x0000000013140000-0x0000000014246000-memory.dmp upx behavioral1/memory/2916-174-0x0000000013140000-0x0000000014246000-memory.dmp upx behavioral1/memory/2916-175-0x0000000013140000-0x0000000014246000-memory.dmp upx behavioral1/memory/2916-176-0x0000000013140000-0x0000000014246000-memory.dmp upx behavioral1/memory/2916-177-0x0000000013140000-0x0000000014246000-memory.dmp upx behavioral1/memory/2916-178-0x0000000013140000-0x0000000014246000-memory.dmp upx behavioral1/memory/2916-179-0x0000000013140000-0x0000000014246000-memory.dmp upx behavioral1/memory/2916-181-0x0000000013140000-0x0000000014246000-memory.dmp upx behavioral1/memory/2916-184-0x0000000013140000-0x0000000014246000-memory.dmp upx behavioral1/memory/2916-187-0x0000000013140000-0x0000000014246000-memory.dmp upx behavioral1/memory/2916-194-0x0000000013140000-0x0000000014246000-memory.dmp upx behavioral1/memory/2916-195-0x0000000013140000-0x0000000014246000-memory.dmp upx behavioral1/memory/2916-196-0x0000000013140000-0x0000000014246000-memory.dmp upx behavioral1/memory/2916-197-0x0000000013140000-0x0000000014246000-memory.dmp upx behavioral1/memory/2916-199-0x0000000013140000-0x0000000014246000-memory.dmp upx behavioral1/memory/2916-200-0x0000000013140000-0x0000000014246000-memory.dmp upx behavioral1/memory/232-286-0x0000000013140000-0x0000000014246000-memory.dmp upx behavioral1/memory/232-289-0x0000000013140000-0x0000000014246000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msinfo32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Windows\CurrentVersion\Run msinfo32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TGS = "C:\\Users\\Admin\\AppData\\Roaming\\TGS\\TGS.exe" msinfo32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msinfo32.exepid process 2916 msinfo32.exe 2916 msinfo32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
7d4dcff5a13e4ae85a620e5bf234af39f55ce0cc.exe7d4dcff5a13e4ae85a620e5bf234af39f55ce0cc.exedescription pid process target process PID 1484 wrote to memory of 2916 1484 7d4dcff5a13e4ae85a620e5bf234af39f55ce0cc.exe msinfo32.exe PID 1484 wrote to memory of 2916 1484 7d4dcff5a13e4ae85a620e5bf234af39f55ce0cc.exe msinfo32.exe PID 1484 wrote to memory of 2916 1484 7d4dcff5a13e4ae85a620e5bf234af39f55ce0cc.exe msinfo32.exe PID 1484 wrote to memory of 4820 1484 7d4dcff5a13e4ae85a620e5bf234af39f55ce0cc.exe 7d4dcff5a13e4ae85a620e5bf234af39f55ce0cc.exe PID 1484 wrote to memory of 4820 1484 7d4dcff5a13e4ae85a620e5bf234af39f55ce0cc.exe 7d4dcff5a13e4ae85a620e5bf234af39f55ce0cc.exe PID 1484 wrote to memory of 4820 1484 7d4dcff5a13e4ae85a620e5bf234af39f55ce0cc.exe 7d4dcff5a13e4ae85a620e5bf234af39f55ce0cc.exe PID 1484 wrote to memory of 2916 1484 7d4dcff5a13e4ae85a620e5bf234af39f55ce0cc.exe msinfo32.exe PID 1484 wrote to memory of 2916 1484 7d4dcff5a13e4ae85a620e5bf234af39f55ce0cc.exe msinfo32.exe PID 4820 wrote to memory of 232 4820 7d4dcff5a13e4ae85a620e5bf234af39f55ce0cc.exe msinfo32.exe PID 4820 wrote to memory of 232 4820 7d4dcff5a13e4ae85a620e5bf234af39f55ce0cc.exe msinfo32.exe PID 4820 wrote to memory of 232 4820 7d4dcff5a13e4ae85a620e5bf234af39f55ce0cc.exe msinfo32.exe PID 4820 wrote to memory of 232 4820 7d4dcff5a13e4ae85a620e5bf234af39f55ce0cc.exe msinfo32.exe PID 4820 wrote to memory of 232 4820 7d4dcff5a13e4ae85a620e5bf234af39f55ce0cc.exe msinfo32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d4dcff5a13e4ae85a620e5bf234af39f55ce0cc.exe"C:\Users\Admin\AppData\Local\Temp\7d4dcff5a13e4ae85a620e5bf234af39f55ce0cc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\7d4dcff5a13e4ae85a620e5bf234af39f55ce0cc.exeC:\Users\Admin\AppData\Local\Temp\7d4dcff5a13e4ae85a620e5bf234af39f55ce0cc.exe ooooooooooooooo2⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\msinfo32.exeC:\windows\syswow64\msinfo32.exe3⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/232-289-0x0000000013140000-0x0000000014246000-memory.dmpFilesize
17.0MB
-
memory/232-286-0x0000000013140000-0x0000000014246000-memory.dmpFilesize
17.0MB
-
memory/1484-133-0x0000000000B00000-0x0000000000B01000-memory.dmpFilesize
4KB
-
memory/1484-134-0x0000000000400000-0x000000000097F000-memory.dmpFilesize
5.5MB
-
memory/1484-135-0x0000000000B00000-0x0000000000B01000-memory.dmpFilesize
4KB
-
memory/1484-136-0x0000000000400000-0x000000000097F000-memory.dmpFilesize
5.5MB
-
memory/1484-137-0x0000000000400000-0x000000000097F000-memory.dmpFilesize
5.5MB
-
memory/1484-168-0x0000000000400000-0x000000000097F000-memory.dmpFilesize
5.5MB
-
memory/1484-169-0x0000000000400000-0x000000000097F000-memory.dmpFilesize
5.5MB
-
memory/1484-170-0x0000000000400000-0x000000000097F000-memory.dmpFilesize
5.5MB
-
memory/1484-173-0x0000000000400000-0x000000000097F000-memory.dmpFilesize
5.5MB
-
memory/2916-194-0x0000000013140000-0x0000000014246000-memory.dmpFilesize
17.0MB
-
memory/2916-197-0x0000000013140000-0x0000000014246000-memory.dmpFilesize
17.0MB
-
memory/2916-176-0x0000000013140000-0x0000000014246000-memory.dmpFilesize
17.0MB
-
memory/2916-177-0x0000000013140000-0x0000000014246000-memory.dmpFilesize
17.0MB
-
memory/2916-178-0x0000000013140000-0x0000000014246000-memory.dmpFilesize
17.0MB
-
memory/2916-179-0x0000000013140000-0x0000000014246000-memory.dmpFilesize
17.0MB
-
memory/2916-181-0x0000000013140000-0x0000000014246000-memory.dmpFilesize
17.0MB
-
memory/2916-172-0x0000000013140000-0x0000000014246000-memory.dmpFilesize
17.0MB
-
memory/2916-184-0x0000000013140000-0x0000000014246000-memory.dmpFilesize
17.0MB
-
memory/2916-200-0x0000000013140000-0x0000000014246000-memory.dmpFilesize
17.0MB
-
memory/2916-187-0x0000000013140000-0x0000000014246000-memory.dmpFilesize
17.0MB
-
memory/2916-199-0x0000000013140000-0x0000000014246000-memory.dmpFilesize
17.0MB
-
memory/2916-175-0x0000000013140000-0x0000000014246000-memory.dmpFilesize
17.0MB
-
memory/2916-174-0x0000000013140000-0x0000000014246000-memory.dmpFilesize
17.0MB
-
memory/2916-195-0x0000000013140000-0x0000000014246000-memory.dmpFilesize
17.0MB
-
memory/2916-196-0x0000000013140000-0x0000000014246000-memory.dmpFilesize
17.0MB
-
memory/4820-192-0x0000000000400000-0x000000000097F000-memory.dmpFilesize
5.5MB
-
memory/4820-190-0x0000000000400000-0x000000000097F000-memory.dmpFilesize
5.5MB
-
memory/4820-186-0x0000000000B40000-0x0000000000B41000-memory.dmpFilesize
4KB
-
memory/4820-185-0x0000000000400000-0x000000000097F000-memory.dmpFilesize
5.5MB
-
memory/4820-171-0x0000000000B40000-0x0000000000B41000-memory.dmpFilesize
4KB