bandook | fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327

General

Target

fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe
Size

3.4MB
MD5

6d90d9eece4cd65d0b56ba05d11d5a2b
SHA1

ab84229f8a010e0856ee7a73728a08b0f6406fae
SHA256

fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327
SHA512

3dc1e335469461ac49adb11a0ee4d5d59b1f0ed397ce37f7c900e80342c3e127d046e6d7b6f0f2cb111b6437fd2f5d25826b763c58d91eca1c9190d1b29d6dc5

Score

10^/10

bandook rat trojan upx

Malware Config

Signatures

Bandook Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/696-5-0x0000000013140000-0x000000001329F000-memory.dmp	family_bandook

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/696-2-0x0000000013140000-0x000000001329F000-memory.dmp	upx
behavioral2/memory/696-4-0x0000000013140000-0x000000001329F000-memory.dmp	upx
behavioral2/memory/696-5-0x0000000013140000-0x000000001329F000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

Processes:

fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe

description	pid	process	target process
PID 428 set thread context of 696	428	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe	iexplore.exe
PID 428 set thread context of 3616	428	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe	iexplore.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exeiexplore.exeiexplore.exe

pid	process
428	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe
428	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe
428	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe
428	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe
696	iexplore.exe
696	iexplore.exe
3616	iexplore.exe
3616	iexplore.exe
428	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe
428	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe

description	pid	process	target process
PID 428 wrote to memory of 696	428	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe	iexplore.exe
PID 428 wrote to memory of 696	428	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe	iexplore.exe
PID 428 wrote to memory of 696	428	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe	iexplore.exe
PID 428 wrote to memory of 696	428	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe	iexplore.exe
PID 428 wrote to memory of 696	428	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe	iexplore.exe
PID 428 wrote to memory of 3616	428	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe	iexplore.exe
PID 428 wrote to memory of 3616	428	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe	iexplore.exe
PID 428 wrote to memory of 3616	428	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe	iexplore.exe
PID 428 wrote to memory of 3616	428	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe	iexplore.exe
PID 428 wrote to memory of 3616	428	fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe
"C:\Users\Admin\AppData\Local\Temp\fa8c9f9a9fd083ba012d7365669f41301dbf76d88a5806d993a45a289a00a327.bin.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:428
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:696
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/696-2-0x0000000013140000-0x000000001329F000-memory.dmp

Filesize
1.4MB

Download
memory/696-3-0x0000000013243280-mapping.dmp

Download
memory/696-4-0x0000000013140000-0x000000001329F000-memory.dmp

Filesize
1.4MB

Download
memory/696-5-0x0000000013140000-0x000000001329F000-memory.dmp

Filesize
1.4MB

Download
memory/3616-7-0x0000000013243280-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads