Resubmissions

14-11-2023 22:12

231114-14nmwagb55 10

14-11-2023 22:09

231114-12934ahe3x 3

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-11-2023 22:12

General

  • Target

    Hispavox.exe

  • Size

    13.7MB

  • MD5

    1c66b1b3b38b95648efe848c8b0959ca

  • SHA1

    68d245a68b5c5a92c39e13d4bfa8d9b5505f21fd

  • SHA256

    508b4f0404f6a969f8444c5287d532b0fb180e7853b67ddb86f3803f19453d92

  • SHA512

    e8f69d3ab4fc657ea1786afd51e87c4b7b00dccfbe4465698180502bb608f863dff15886d74aa0677b09c1177c4eb22728cc1a5782927ba0cd207d7876b6d8c4

  • SSDEEP

    49152:BTmuEoPcYAfq04PAZysr9AXB37eGIK6Wy/tD78X3JfF0u3zCypYluZs9l0rUKlvY:BTzmq0+8

Score
10/10

Malware Config

Signatures

  • Bandook RAT

    Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

  • Bandook payload 7 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Hispavox.exe
    "C:\Users\Admin\AppData\Local\Temp\Hispavox.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:220
    • C:\windows\SysWOW64\msinfo32.exe
      C:\windows\syswow64\msinfo32.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4572
    • C:\Users\Admin\AppData\Local\Temp\Hispavox.exe
      C:\Users\Admin\AppData\Local\Temp\Hispavox.exe nnchwwghwgehwgewyeywyeywyye
      2⤵
        PID:760

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/220-18-0x0000000000400000-0x00000000011CD000-memory.dmp

      Filesize

      13.8MB

    • memory/220-1-0x0000000000400000-0x00000000011CD000-memory.dmp

      Filesize

      13.8MB

    • memory/220-2-0x0000000000400000-0x00000000011CD000-memory.dmp

      Filesize

      13.8MB

    • memory/220-3-0x00000000013C0000-0x00000000013C1000-memory.dmp

      Filesize

      4KB

    • memory/220-4-0x0000000000400000-0x00000000011CD000-memory.dmp

      Filesize

      13.8MB

    • memory/220-10-0x0000000000400000-0x00000000011CD000-memory.dmp

      Filesize

      13.8MB

    • memory/220-11-0x0000000000400000-0x00000000011CD000-memory.dmp

      Filesize

      13.8MB

    • memory/220-12-0x0000000000400000-0x00000000011CD000-memory.dmp

      Filesize

      13.8MB

    • memory/220-0-0x00000000013C0000-0x00000000013C1000-memory.dmp

      Filesize

      4KB

    • memory/760-13-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

      Filesize

      4KB

    • memory/760-30-0x0000000000400000-0x00000000011CD000-memory.dmp

      Filesize

      13.8MB

    • memory/760-27-0x0000000000400000-0x00000000011CD000-memory.dmp

      Filesize

      13.8MB

    • memory/4572-15-0x0000000013140000-0x0000000015182000-memory.dmp

      Filesize

      32.3MB

    • memory/4572-17-0x0000000013140000-0x0000000015182000-memory.dmp

      Filesize

      32.3MB

    • memory/4572-19-0x0000000013140000-0x0000000015182000-memory.dmp

      Filesize

      32.3MB

    • memory/4572-20-0x0000000013140000-0x0000000015182000-memory.dmp

      Filesize

      32.3MB

    • memory/4572-22-0x0000000013140000-0x0000000015182000-memory.dmp

      Filesize

      32.3MB

    • memory/4572-23-0x0000000013140000-0x0000000015182000-memory.dmp

      Filesize

      32.3MB

    • memory/4572-25-0x0000000013140000-0x0000000015182000-memory.dmp

      Filesize

      32.3MB

    • memory/4572-16-0x0000000013140000-0x0000000015182000-memory.dmp

      Filesize

      32.3MB

    • memory/4572-14-0x0000000013140000-0x0000000015182000-memory.dmp

      Filesize

      32.3MB