bandook | fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57 | Triage

Resubmissions

24-03-2022 12:21

220324-pjqqysghd3 10

16-07-2021 18:28

210716-3mtspqxy36 3

Analysis

max time kernel
4294663s
max time network
618s
platform
windows7_x64
resource
win7-20220310-en
submitted
24-03-2022 12:21

Sharing

Report Analysis Logs

General

Target

fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe
Size

788KB
MD5

e2bcd26465f9715da2789febce3bedf7
SHA1

b3bd4d0c84d0751d88eb0343b8e194e499894a98
SHA256

fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57
SHA512

17f6e5ebe109c652a0dce05de7ada1a0e3811f5558cf084398ece367a82f55fe1fd30797e20434db26a7d4245133e674db928c134c80f6e3297974f291c77219

Score

10^/10

bandook rat trojan

Malware Config

Signatures

Bandook Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1752-55-0x0000000013140000-0x0000000013C43000-memory.dmp	family_bandook

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

736 1752 WerFault.exe fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe

description	pid	process	target process
PID 1752 wrote to memory of 736	1752	fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe	WerFault.exe
PID 1752 wrote to memory of 736	1752	fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe	WerFault.exe
PID 1752 wrote to memory of 736	1752	fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe	WerFault.exe
PID 1752 wrote to memory of 736	1752	fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe
"C:\Users\Admin\AppData\Local\Temp\fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 212
  2⤵
  - Program crash
  PID:736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/736-56-0x0000000000000000-mapping.dmp

Download
memory/1752-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1752-55-0x0000000013140000-0x0000000013C43000-memory.dmp

Filesize
11.0MB

Download