Resubmissions
09-10-2024 15:26
241009-sveplssdjh 10Analysis
-
max time kernel
34s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-10-2024 15:26
Behavioral task
behavioral1
Sample
BanDPI.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
General
-
Target
BanDPI.exe
-
Size
229KB
-
MD5
b480a45c37b268cc917a54cdefea620c
-
SHA1
e68857ab8b0d589056bbc571d9e95ebee78b198a
-
SHA256
07e10c35d0ba5cdb655370b4be54924e4c5a291cc5130ac35fcc1701b342cc39
-
SHA512
f68afd7bf02052bbb0b3589b4963eda82e3412ed3695c9834dc7400a5b6e658b26c3c5bcb18cbb0f4eab360bcb9d4412a2cdd3e7c1f5f84010bf7f978359f3a8
-
SSDEEP
6144:9loZM+rIkd8g+EtXHkv/iD4Ua88vFuW5l8VHCCHfHb8e1m5Qi:foZtL+EP8Ua88vFuW5l8VHCCH7c
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2108-1-0x0000000000890000-0x00000000008D0000-memory.dmp family_umbral -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2532 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeDebugPrivilege 2108 BanDPI.exe Token: SeIncreaseQuotaPrivilege 2260 wmic.exe Token: SeSecurityPrivilege 2260 wmic.exe Token: SeTakeOwnershipPrivilege 2260 wmic.exe Token: SeLoadDriverPrivilege 2260 wmic.exe Token: SeSystemProfilePrivilege 2260 wmic.exe Token: SeSystemtimePrivilege 2260 wmic.exe Token: SeProfSingleProcessPrivilege 2260 wmic.exe Token: SeIncBasePriorityPrivilege 2260 wmic.exe Token: SeCreatePagefilePrivilege 2260 wmic.exe Token: SeBackupPrivilege 2260 wmic.exe Token: SeRestorePrivilege 2260 wmic.exe Token: SeShutdownPrivilege 2260 wmic.exe Token: SeDebugPrivilege 2260 wmic.exe Token: SeSystemEnvironmentPrivilege 2260 wmic.exe Token: SeRemoteShutdownPrivilege 2260 wmic.exe Token: SeUndockPrivilege 2260 wmic.exe Token: SeManageVolumePrivilege 2260 wmic.exe Token: 33 2260 wmic.exe Token: 34 2260 wmic.exe Token: 35 2260 wmic.exe Token: SeIncreaseQuotaPrivilege 2260 wmic.exe Token: SeSecurityPrivilege 2260 wmic.exe Token: SeTakeOwnershipPrivilege 2260 wmic.exe Token: SeLoadDriverPrivilege 2260 wmic.exe Token: SeSystemProfilePrivilege 2260 wmic.exe Token: SeSystemtimePrivilege 2260 wmic.exe Token: SeProfSingleProcessPrivilege 2260 wmic.exe Token: SeIncBasePriorityPrivilege 2260 wmic.exe Token: SeCreatePagefilePrivilege 2260 wmic.exe Token: SeBackupPrivilege 2260 wmic.exe Token: SeRestorePrivilege 2260 wmic.exe Token: SeShutdownPrivilege 2260 wmic.exe Token: SeDebugPrivilege 2260 wmic.exe Token: SeSystemEnvironmentPrivilege 2260 wmic.exe Token: SeRemoteShutdownPrivilege 2260 wmic.exe Token: SeUndockPrivilege 2260 wmic.exe Token: SeManageVolumePrivilege 2260 wmic.exe Token: 33 2260 wmic.exe Token: 34 2260 wmic.exe Token: 35 2260 wmic.exe Token: SeDebugPrivilege 2532 taskmgr.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe -
Suspicious use of SendNotifyMessage 35 IoCs
pid Process 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe 2532 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2260 2108 BanDPI.exe 30 PID 2108 wrote to memory of 2260 2108 BanDPI.exe 30 PID 2108 wrote to memory of 2260 2108 BanDPI.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\BanDPI.exe"C:\Users\Admin\AppData\Local\Temp\BanDPI.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2260
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2532