bandook | fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57 | Triage

Resubmissions

24-03-2022 12:21

220324-pjqqysghd3 10

16-07-2021 18:28

210716-3mtspqxy36 3

Analysis

max time kernel
215s
max time network
272s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
24-03-2022 12:21

Sharing

Report Analysis Logs

General

Target

fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe
Size

788KB
MD5

e2bcd26465f9715da2789febce3bedf7
SHA1

b3bd4d0c84d0751d88eb0343b8e194e499894a98
SHA256

fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57
SHA512

17f6e5ebe109c652a0dce05de7ada1a0e3811f5558cf084398ece367a82f55fe1fd30797e20434db26a7d4245133e674db928c134c80f6e3297974f291c77219

Score

10^/10

bandook rat trojan

Malware Config

Signatures

Bandook Payload 1 IoCs

Processes:

resource	yara_rule
behavioral3/memory/1996-130-0x0000000013140000-0x0000000013C43000-memory.dmp	family_bandook

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

60 1996 WerFault.exe fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe

C:\Users\Admin\AppData\Local\Temp\fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe
"C:\Users\Admin\AppData\Local\Temp\fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe"
1⤵
PID:1996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 480
  2⤵
  - Program crash
  PID:60

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1996 -ip 1996
1⤵
PID:4420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-130-0x0000000013140000-0x0000000013C43000-memory.dmp

Filesize
11.0MB

Download