bandook | fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327

General

Target

fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe
Size

3.4MB
MD5

6d90d9eece4cd65d0b56ba05d11d5a2b
SHA1

ab84229f8a010e0856ee7a73728a08b0f6406fae
SHA256

fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327
SHA512

3dc1e335469461ac49adb11a0ee4d5d59b1f0ed397ce37f7c900e80342c3e127d046e6d7b6f0f2cb111b6437fd2f5d25826b763c58d91eca1c9190d1b29d6dc5

Score

10^/10

Malware Config

Signatures

Bandook Payload 2 IoCs

resource	yara_rule
behavioral1/memory/1632-3-0x0000000013243280-mapping.dmp	family_bandook
behavioral1/memory/1632-5-0x0000000013140000-0x000000001329F000-memory.dmp	family_bandook

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1632-2-0x0000000013140000-0x000000001329F000-memory.dmp	upx
behavioral1/memory/1632-4-0x0000000013140000-0x000000001329F000-memory.dmp	upx
behavioral1/memory/1632-5-0x0000000013140000-0x000000001329F000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1080 set thread context of 1632	1080	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe	29
PID 1080 set thread context of 268	1080	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1080	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe
1080	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe
1632	iexplore.exe
268	iexplore.exe
1080	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1632	1080	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe	29
PID 1080 wrote to memory of 1632	1080	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe	29
PID 1080 wrote to memory of 1632	1080	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe	29
PID 1080 wrote to memory of 1632	1080	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe	29
PID 1080 wrote to memory of 1632	1080	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe	29
PID 1080 wrote to memory of 1632	1080	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe	29
PID 1080 wrote to memory of 268	1080	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe	30
PID 1080 wrote to memory of 268	1080	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe	30
PID 1080 wrote to memory of 268	1080	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe	30
PID 1080 wrote to memory of 268	1080	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe	30
PID 1080 wrote to memory of 268	1080	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe	30
PID 1080 wrote to memory of 268	1080	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe	30

C:\Users\Admin\AppData\Local\Temp\fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe
"C:\Users\Admin\AppData\Local\Temp\fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1632
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1632-2-0x0000000013140000-0x000000001329F000-memory.dmp

Filesize
1.4MB

Download
memory/1632-4-0x0000000013140000-0x000000001329F000-memory.dmp

Filesize
1.4MB

Download
memory/1632-5-0x0000000013140000-0x000000001329F000-memory.dmp

Filesize
1.4MB

Download

Resubmissions

Analysis

Sharing