bandook | afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734

General

Target

afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe
Size

1002KB
MD5

66e7fff4370f216117c1ab836b43f320
SHA1

68571b2e855fcaf068f73730ac10675128b4f217
SHA256

afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734
SHA512

fe7f11cd216d8be8833f7d99686e94e9d6134772cab878cdef756a2c199fff8f26d88efa108dbc9356ef330a6eeff57a9c90cef80b94da59a16d3210b9ab926c
SSDEEP

24576:dlFlrWrVnrfUEEAXU7PcOeLqkVsD7s/Xl2y:dlKBfTSPcOeLtsnsvl1

Score

10^/10

bandook persistence rat trojan

Malware Config

Extracted

Family

bandook

C2

192.168.31.1

Signatures

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 5 IoCs

resource	yara_rule
behavioral1/memory/1724-56-0x0000000013140000-0x0000000013B94000-memory.dmp	family_bandook
behavioral1/memory/1724-57-0x0000000013149D61-mapping.dmp	family_bandook
behavioral1/memory/1724-60-0x0000000013140000-0x0000000013B94000-memory.dmp	family_bandook
behavioral1/memory/1724-61-0x0000000013140000-0x0000000013B94000-memory.dmp	family_bandook
behavioral1/memory/1724-62-0x0000000013140000-0x0000000013B94000-memory.dmp	family_bandook

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\lkm = "C:\\Users\\Admin\\AppData\\Roaming\\LKM\\lkm.exe"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\lkm = "C:\\Users\\Admin\\AppData\\Roaming\\LKM\\lkm.exe"	iexplore.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 584 set thread context of 1724	584	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 584 wrote to memory of 1724	584	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	28
PID 584 wrote to memory of 1724	584	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	28
PID 584 wrote to memory of 1724	584	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	28
PID 584 wrote to memory of 1724	584	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	28
PID 584 wrote to memory of 1724	584	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	28
PID 584 wrote to memory of 1724	584	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	28
PID 1724 wrote to memory of 916	1724	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	29
PID 1724 wrote to memory of 916	1724	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	29
PID 1724 wrote to memory of 916	1724	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	29
PID 1724 wrote to memory of 916	1724	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	29
PID 1724 wrote to memory of 916	1724	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	29
PID 1724 wrote to memory of 1184	1724	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	30
PID 1724 wrote to memory of 1184	1724	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	30
PID 1724 wrote to memory of 1184	1724	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	30
PID 1724 wrote to memory of 1184	1724	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	30
PID 1724 wrote to memory of 1184	1724	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	30
PID 1724 wrote to memory of 2044	1724	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	31
PID 1724 wrote to memory of 2044	1724	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	31
PID 1724 wrote to memory of 2044	1724	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	31
PID 1724 wrote to memory of 2044	1724	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	31
PID 1724 wrote to memory of 2044	1724	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	31
PID 1724 wrote to memory of 1224	1724	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	32
PID 1724 wrote to memory of 1224	1724	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	32
PID 1724 wrote to memory of 1224	1724	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	32
PID 1724 wrote to memory of 1224	1724	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	32
PID 1724 wrote to memory of 1224	1724	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	32

C:\Users\Admin\AppData\Local\Temp\afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe
"C:\Users\Admin\AppData\Local\Temp\afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:584
- C:\Users\Admin\AppData\Local\Temp\afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe
  "C:\Users\Admin\AppData\Local\Temp\afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:916
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    - Adds Run key to start application
    PID:1184
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:2044
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    - Adds Run key to start application
    PID:1224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\LKM\lkm.exe

Filesize
1002KB

MD5
66e7fff4370f216117c1ab836b43f320

SHA1
68571b2e855fcaf068f73730ac10675128b4f217

SHA256
afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734

SHA512
fe7f11cd216d8be8833f7d99686e94e9d6134772cab878cdef756a2c199fff8f26d88efa108dbc9356ef330a6eeff57a9c90cef80b94da59a16d3210b9ab926c

Download Submit
memory/1724-54-0x0000000013140000-0x0000000013B94000-memory.dmp

Filesize
10.3MB

Download
memory/1724-56-0x0000000013140000-0x0000000013B94000-memory.dmp

Filesize
10.3MB

Download
memory/1724-59-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/1724-60-0x0000000013140000-0x0000000013B94000-memory.dmp

Filesize
10.3MB

Download
memory/1724-61-0x0000000013140000-0x0000000013B94000-memory.dmp

Filesize
10.3MB

Download
memory/1724-62-0x0000000013140000-0x0000000013B94000-memory.dmp

Filesize
10.3MB

Download

Analysis

Sharing