Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
14-11-2023 22:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Hispavox.exe
Resource
win7-20231020-en
windows7-x64
2 signatures
150 seconds
General
-
Target
Hispavox.exe
-
Size
13.7MB
-
MD5
1c66b1b3b38b95648efe848c8b0959ca
-
SHA1
68d245a68b5c5a92c39e13d4bfa8d9b5505f21fd
-
SHA256
508b4f0404f6a969f8444c5287d532b0fb180e7853b67ddb86f3803f19453d92
-
SHA512
e8f69d3ab4fc657ea1786afd51e87c4b7b00dccfbe4465698180502bb608f863dff15886d74aa0677b09c1177c4eb22728cc1a5782927ba0cd207d7876b6d8c4
-
SSDEEP
49152:BTmuEoPcYAfq04PAZysr9AXB37eGIK6Wy/tD78X3JfF0u3zCypYluZs9l0rUKlvY:BTzmq0+8
Malware Config
Signatures
-
Bandook payload 7 IoCs
resource yara_rule behavioral2/memory/4572-16-0x0000000013140000-0x0000000015182000-memory.dmp family_bandook behavioral2/memory/4572-17-0x0000000013140000-0x0000000015182000-memory.dmp family_bandook behavioral2/memory/4572-19-0x0000000013140000-0x0000000015182000-memory.dmp family_bandook behavioral2/memory/4572-20-0x0000000013140000-0x0000000015182000-memory.dmp family_bandook behavioral2/memory/4572-22-0x0000000013140000-0x0000000015182000-memory.dmp family_bandook behavioral2/memory/4572-23-0x0000000013140000-0x0000000015182000-memory.dmp family_bandook behavioral2/memory/4572-25-0x0000000013140000-0x0000000015182000-memory.dmp family_bandook -
resource yara_rule behavioral2/memory/4572-14-0x0000000013140000-0x0000000015182000-memory.dmp upx behavioral2/memory/4572-15-0x0000000013140000-0x0000000015182000-memory.dmp upx behavioral2/memory/4572-16-0x0000000013140000-0x0000000015182000-memory.dmp upx behavioral2/memory/4572-17-0x0000000013140000-0x0000000015182000-memory.dmp upx behavioral2/memory/4572-19-0x0000000013140000-0x0000000015182000-memory.dmp upx behavioral2/memory/4572-20-0x0000000013140000-0x0000000015182000-memory.dmp upx behavioral2/memory/4572-22-0x0000000013140000-0x0000000015182000-memory.dmp upx behavioral2/memory/4572-23-0x0000000013140000-0x0000000015182000-memory.dmp upx behavioral2/memory/4572-25-0x0000000013140000-0x0000000015182000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4572 msinfo32.exe 4572 msinfo32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 220 wrote to memory of 4572 220 Hispavox.exe 107 PID 220 wrote to memory of 4572 220 Hispavox.exe 107 PID 220 wrote to memory of 4572 220 Hispavox.exe 107 PID 220 wrote to memory of 760 220 Hispavox.exe 108 PID 220 wrote to memory of 760 220 Hispavox.exe 108 PID 220 wrote to memory of 760 220 Hispavox.exe 108 PID 220 wrote to memory of 4572 220 Hispavox.exe 107 PID 220 wrote to memory of 4572 220 Hispavox.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\Hispavox.exe"C:\Users\Admin\AppData\Local\Temp\Hispavox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:220 -
C:\windows\SysWOW64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4572
-
-
C:\Users\Admin\AppData\Local\Temp\Hispavox.exeC:\Users\Admin\AppData\Local\Temp\Hispavox.exe nnchwwghwgehwgewyeywyeywyye2⤵PID:760
-