bandook | fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57 | Triage

Resubmissions

24-03-2022 12:21

220324-pjqqysghd3 10

16-07-2021 18:28

210716-3mtspqxy36 3

Analysis

max time kernel
314s
max time network
618s
platform
windows10_x64
resource
win10-20220223-en
submitted
24-03-2022 12:21

Sharing

Report Analysis Logs

General

Target

fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe
Size

788KB
MD5

e2bcd26465f9715da2789febce3bedf7
SHA1

b3bd4d0c84d0751d88eb0343b8e194e499894a98
SHA256

fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57
SHA512

17f6e5ebe109c652a0dce05de7ada1a0e3811f5558cf084398ece367a82f55fe1fd30797e20434db26a7d4245133e674db928c134c80f6e3297974f291c77219

Score

10^/10

bandook rat trojan

Malware Config

Signatures

Bandook Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2068-114-0x0000000013140000-0x0000000013C43000-memory.dmp	family_bandook

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3880 2068 WerFault.exe fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe

C:\Users\Admin\AppData\Local\Temp\fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe
"C:\Users\Admin\AppData\Local\Temp\fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe"
1⤵
PID:2068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 620
  2⤵
  - Program crash
  PID:3880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2068-114-0x0000000013140000-0x0000000013C43000-memory.dmp

Filesize
11.0MB

Download