Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
15-12-2023 15:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
52H5G7F46.exe
Resource
win7-20231020-en
6 signatures
150 seconds
General
-
Target
52H5G7F46.exe
-
Size
16.2MB
-
MD5
16a4f6e01cfcd72dbc87f939428be5af
-
SHA1
a0358b84506c1b74b5e681de4d1b009832f61b8a
-
SHA256
7271bfe93c41ef4ffd9b94194de6eaa3849c68055cca2fe4507b11c85a86afae
-
SHA512
23b131cb8e9034d3da35f25025b3a8bb8f72ef6c39aa9fe32f9bef009bdb07170e9cc8116c86ecb645e6b6bcb6d6f8122823a2eb07bb1929d94d7bcf4f0d6f9b
-
SSDEEP
49152:QTmuEoPcYA4tSvagQTP1U2XTKKw/4rH4tVgCrpJU12GM6FoOLjwgpL6hf+CiTACa:QTzV
Malware Config
Signatures
-
Bandook payload 8 IoCs
Processes:
resource yara_rule behavioral2/memory/4156-17-0x0000000013140000-0x0000000014E33000-memory.dmp family_bandook behavioral2/memory/4156-16-0x0000000013140000-0x0000000014E33000-memory.dmp family_bandook behavioral2/memory/4156-19-0x0000000013140000-0x0000000014E33000-memory.dmp family_bandook behavioral2/memory/4156-20-0x0000000013140000-0x0000000014E33000-memory.dmp family_bandook behavioral2/memory/4156-21-0x0000000013140000-0x0000000014E33000-memory.dmp family_bandook behavioral2/memory/4156-24-0x0000000013140000-0x0000000014E33000-memory.dmp family_bandook behavioral2/memory/4156-25-0x0000000013140000-0x0000000014E33000-memory.dmp family_bandook behavioral2/memory/4156-31-0x0000000013140000-0x0000000014E33000-memory.dmp family_bandook -
Processes:
resource yara_rule behavioral2/memory/4156-14-0x0000000013140000-0x0000000014E33000-memory.dmp upx behavioral2/memory/4156-15-0x0000000013140000-0x0000000014E33000-memory.dmp upx behavioral2/memory/4156-17-0x0000000013140000-0x0000000014E33000-memory.dmp upx behavioral2/memory/4156-16-0x0000000013140000-0x0000000014E33000-memory.dmp upx behavioral2/memory/4156-19-0x0000000013140000-0x0000000014E33000-memory.dmp upx behavioral2/memory/4156-20-0x0000000013140000-0x0000000014E33000-memory.dmp upx behavioral2/memory/4156-21-0x0000000013140000-0x0000000014E33000-memory.dmp upx behavioral2/memory/4156-24-0x0000000013140000-0x0000000014E33000-memory.dmp upx behavioral2/memory/4156-25-0x0000000013140000-0x0000000014E33000-memory.dmp upx behavioral2/memory/4156-31-0x0000000013140000-0x0000000014E33000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msinfo32.exepid process 4156 msinfo32.exe 4156 msinfo32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
52H5G7F46.exedescription pid process target process PID 3204 wrote to memory of 4156 3204 52H5G7F46.exe msinfo32.exe PID 3204 wrote to memory of 4156 3204 52H5G7F46.exe msinfo32.exe PID 3204 wrote to memory of 4156 3204 52H5G7F46.exe msinfo32.exe PID 3204 wrote to memory of 1740 3204 52H5G7F46.exe 52H5G7F46.exe PID 3204 wrote to memory of 1740 3204 52H5G7F46.exe 52H5G7F46.exe PID 3204 wrote to memory of 1740 3204 52H5G7F46.exe 52H5G7F46.exe PID 3204 wrote to memory of 4156 3204 52H5G7F46.exe msinfo32.exe PID 3204 wrote to memory of 4156 3204 52H5G7F46.exe msinfo32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\52H5G7F46.exe"C:\Users\Admin\AppData\Local\Temp\52H5G7F46.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\52H5G7F46.exeC:\Users\Admin\AppData\Local\Temp\52H5G7F46.exe nnchwwghwgehwgewyeywyeywyye2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1740-13-0x0000000001600000-0x0000000001601000-memory.dmpFilesize
4KB
-
memory/1740-28-0x0000000000400000-0x0000000001447000-memory.dmpFilesize
16.3MB
-
memory/1740-30-0x0000000001600000-0x0000000001601000-memory.dmpFilesize
4KB
-
memory/1740-26-0x0000000000400000-0x0000000001447000-memory.dmpFilesize
16.3MB
-
memory/1740-32-0x0000000000400000-0x0000000001447000-memory.dmpFilesize
16.3MB
-
memory/3204-3-0x00000000032B0000-0x00000000032B1000-memory.dmpFilesize
4KB
-
memory/3204-11-0x0000000000400000-0x0000000001447000-memory.dmpFilesize
16.3MB
-
memory/3204-12-0x0000000000400000-0x0000000001447000-memory.dmpFilesize
16.3MB
-
memory/3204-10-0x0000000000400000-0x0000000001447000-memory.dmpFilesize
16.3MB
-
memory/3204-4-0x0000000000400000-0x0000000001447000-memory.dmpFilesize
16.3MB
-
memory/3204-2-0x0000000000400000-0x0000000001447000-memory.dmpFilesize
16.3MB
-
memory/3204-1-0x0000000000400000-0x0000000001447000-memory.dmpFilesize
16.3MB
-
memory/3204-0-0x00000000032B0000-0x00000000032B1000-memory.dmpFilesize
4KB
-
memory/3204-18-0x0000000000400000-0x0000000001447000-memory.dmpFilesize
16.3MB
-
memory/4156-16-0x0000000013140000-0x0000000014E33000-memory.dmpFilesize
28.9MB
-
memory/4156-20-0x0000000013140000-0x0000000014E33000-memory.dmpFilesize
28.9MB
-
memory/4156-21-0x0000000013140000-0x0000000014E33000-memory.dmpFilesize
28.9MB
-
memory/4156-24-0x0000000013140000-0x0000000014E33000-memory.dmpFilesize
28.9MB
-
memory/4156-25-0x0000000013140000-0x0000000014E33000-memory.dmpFilesize
28.9MB
-
memory/4156-19-0x0000000013140000-0x0000000014E33000-memory.dmpFilesize
28.9MB
-
memory/4156-17-0x0000000013140000-0x0000000014E33000-memory.dmpFilesize
28.9MB
-
memory/4156-15-0x0000000013140000-0x0000000014E33000-memory.dmpFilesize
28.9MB
-
memory/4156-31-0x0000000013140000-0x0000000014E33000-memory.dmpFilesize
28.9MB
-
memory/4156-14-0x0000000013140000-0x0000000014E33000-memory.dmpFilesize
28.9MB