bandook | 3c7ac3ea998e016326798b83af0d9d7f87ba79b9dfdb25f649d3ae7753ec6231

Analysis

max time kernel
422s
max time network
565s
platform
windows7_x64
resource
win7-20220718-es
resource tags

arch:x64arch:x86image:win7-20220718-eslocale:es-esos:windows7-x64systemwindows
submitted
10-08-2022 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RECIBO DE TRANSFERENCIA-N08.exe
Size

1.8MB
MD5

f43da7a7ea38479b025c754a09ec10ed
SHA1

5a6c17f037e7db6c512d351d763ab01a8f944bdc
SHA256

4136b980fcb12ab481555721ab307d6ec3c5b3e775e728561490078f869fed52
SHA512

9a03d153d2cf69e2c2917c9efbcfe5907133f7d429369752d018d7893402fe640d09cd00f50f50ded95c4e776d1636ab6e84c5d2838545cb4773c270a8927025

Score

10^/10

bandook persistence rat trojan upx

Malware Config

Signatures

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1192-61-0x0000000013140000-0x0000000013C7D000-memory.dmp	family_bandook
behavioral1/memory/1192-62-0x0000000013140000-0x0000000013C7D000-memory.dmp	family_bandook
behavioral1/memory/1440-70-0x0000000013140000-0x0000000013C7D000-memory.dmp	family_bandook
behavioral1/memory/1440-71-0x0000000013140000-0x0000000013C7D000-memory.dmp	family_bandook

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1192-58-0x0000000013140000-0x0000000013C7D000-memory.dmp	upx
behavioral1/memory/1192-60-0x0000000013140000-0x0000000013C7D000-memory.dmp	upx
behavioral1/memory/1192-61-0x0000000013140000-0x0000000013C7D000-memory.dmp	upx
behavioral1/memory/1192-62-0x0000000013140000-0x0000000013C7D000-memory.dmp	upx
behavioral1/memory/1440-70-0x0000000013140000-0x0000000013C7D000-memory.dmp	upx
behavioral1/memory/1440-71-0x0000000013140000-0x0000000013C7D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msinfo32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run	msinfo32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\XKS = "C:\\Users\\Admin\\AppData\\Roaming\\XKS\\XKS.exe"	msinfo32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

msinfo32.exe

pid process

1192 msinfo32.exe

pid	process
1192	msinfo32.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

RECIBO DE TRANSFERENCIA-N08.exe

description	pid	process	target process
PID 1768 wrote to memory of 1192	1768	RECIBO DE TRANSFERENCIA-N08.exe	msinfo32.exe
PID 1768 wrote to memory of 1192	1768	RECIBO DE TRANSFERENCIA-N08.exe	msinfo32.exe
PID 1768 wrote to memory of 1192	1768	RECIBO DE TRANSFERENCIA-N08.exe	msinfo32.exe
PID 1768 wrote to memory of 1192	1768	RECIBO DE TRANSFERENCIA-N08.exe	msinfo32.exe
PID 1768 wrote to memory of 1192	1768	RECIBO DE TRANSFERENCIA-N08.exe	msinfo32.exe
PID 1768 wrote to memory of 1192	1768	RECIBO DE TRANSFERENCIA-N08.exe	msinfo32.exe
PID 1768 wrote to memory of 1440	1768	RECIBO DE TRANSFERENCIA-N08.exe	msinfo32.exe
PID 1768 wrote to memory of 1440	1768	RECIBO DE TRANSFERENCIA-N08.exe	msinfo32.exe
PID 1768 wrote to memory of 1440	1768	RECIBO DE TRANSFERENCIA-N08.exe	msinfo32.exe
PID 1768 wrote to memory of 1440	1768	RECIBO DE TRANSFERENCIA-N08.exe	msinfo32.exe
PID 1768 wrote to memory of 1440	1768	RECIBO DE TRANSFERENCIA-N08.exe	msinfo32.exe
PID 1768 wrote to memory of 1440	1768	RECIBO DE TRANSFERENCIA-N08.exe	msinfo32.exe

C:\Users\Admin\AppData\Local\Temp\RECIBO DE TRANSFERENCIA-N08.exe
"C:\Users\Admin\AppData\Local\Temp\RECIBO DE TRANSFERENCIA-N08.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1768

C:\windows\syswow64\msinfo32.exe
C:\windows\syswow64\msinfo32.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1192

C:\windows\syswow64\msinfo32.exe
C:\windows\syswow64\msinfo32.exe
2⤵
- Adds Run key to start application
PID:1440

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1192-55-0x0000000013140000-0x0000000013C7D000-memory.dmp

Filesize
11.2MB

Download
memory/1192-57-0x0000000000000000-mapping.dmp

Download
memory/1192-58-0x0000000013140000-0x0000000013C7D000-memory.dmp

Filesize
11.2MB

Download
memory/1192-60-0x0000000013140000-0x0000000013C7D000-memory.dmp

Filesize
11.2MB

Download
memory/1192-61-0x0000000013140000-0x0000000013C7D000-memory.dmp

Filesize
11.2MB

Download
memory/1192-62-0x0000000013140000-0x0000000013C7D000-memory.dmp

Filesize
11.2MB

Download
memory/1440-65-0x0000000000000000-mapping.dmp

Download
memory/1440-70-0x0000000013140000-0x0000000013C7D000-memory.dmp

Filesize
11.2MB

Download
memory/1440-71-0x0000000013140000-0x0000000013C7D000-memory.dmp

Filesize
11.2MB

Download
memory/1768-54-0x00000000760E1000-0x00000000760E3000-memory.dmp

Filesize
8KB

Download