bandook | afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734

General

Target

afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe
Size

1002KB
MD5

66e7fff4370f216117c1ab836b43f320
SHA1

68571b2e855fcaf068f73730ac10675128b4f217
SHA256

afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734
SHA512

fe7f11cd216d8be8833f7d99686e94e9d6134772cab878cdef756a2c199fff8f26d88efa108dbc9356ef330a6eeff57a9c90cef80b94da59a16d3210b9ab926c
SSDEEP

24576:dlFlrWrVnrfUEEAXU7PcOeLqkVsD7s/Xl2y:dlKBfTSPcOeLtsnsvl1

Score

10^/10

bandook persistence rat trojan

Malware Config

Extracted

Family

bandook

C2

192.168.31.1

Signatures

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1068-133-0x0000000013140000-0x0000000013B94000-memory.dmp	family_bandook
behavioral2/memory/1068-135-0x0000000013140000-0x0000000013B94000-memory.dmp	family_bandook
behavioral2/memory/1068-136-0x0000000013140000-0x0000000013B94000-memory.dmp	family_bandook
behavioral2/memory/1068-137-0x0000000013140000-0x0000000013B94000-memory.dmp	family_bandook

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lkm = "C:\\Users\\Admin\\AppData\\Roaming\\LKM\\lkm.exe"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lkm = "C:\\Users\\Admin\\AppData\\Roaming\\LKM\\lkm.exe"	iexplore.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe

description	pid	process	target process
PID 2676 set thread context of 1068	2676	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exeafebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe

description	pid	process	target process
PID 2676 wrote to memory of 1068	2676	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe
PID 2676 wrote to memory of 1068	2676	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe
PID 2676 wrote to memory of 1068	2676	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe
PID 2676 wrote to memory of 1068	2676	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe
PID 2676 wrote to memory of 1068	2676	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe
PID 1068 wrote to memory of 3768	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	iexplore.exe
PID 1068 wrote to memory of 3768	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	iexplore.exe
PID 1068 wrote to memory of 3768	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	iexplore.exe
PID 1068 wrote to memory of 3768	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	iexplore.exe
PID 1068 wrote to memory of 1248	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	iexplore.exe
PID 1068 wrote to memory of 1248	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	iexplore.exe
PID 1068 wrote to memory of 1248	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	iexplore.exe
PID 1068 wrote to memory of 1248	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	iexplore.exe
PID 1068 wrote to memory of 4556	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	iexplore.exe
PID 1068 wrote to memory of 4556	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	iexplore.exe
PID 1068 wrote to memory of 4556	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	iexplore.exe
PID 1068 wrote to memory of 4556	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	iexplore.exe
PID 1068 wrote to memory of 1652	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	iexplore.exe
PID 1068 wrote to memory of 1652	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	iexplore.exe
PID 1068 wrote to memory of 1652	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	iexplore.exe
PID 1068 wrote to memory of 1652	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe
"C:\Users\Admin\AppData\Local\Temp\afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2676

C:\Users\Admin\AppData\Local\Temp\afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe
"C:\Users\Admin\AppData\Local\Temp\afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1068

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
PID:3768

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
- Adds Run key to start application
PID:1248

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
PID:4556

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
- Adds Run key to start application
PID:1652

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\LKM\lkm.exe
Filesize
1002KB

MD5
66e7fff4370f216117c1ab836b43f320

SHA1
68571b2e855fcaf068f73730ac10675128b4f217

SHA256
afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734

SHA512
fe7f11cd216d8be8833f7d99686e94e9d6134772cab878cdef756a2c199fff8f26d88efa108dbc9356ef330a6eeff57a9c90cef80b94da59a16d3210b9ab926c

Download Submit
memory/1068-132-0x0000000000000000-mapping.dmp

Download
memory/1068-133-0x0000000013140000-0x0000000013B94000-memory.dmp

Filesize
10.3MB

Download
memory/1068-135-0x0000000013140000-0x0000000013B94000-memory.dmp

Filesize
10.3MB

Download
memory/1068-136-0x0000000013140000-0x0000000013B94000-memory.dmp

Filesize
10.3MB

Download
memory/1068-137-0x0000000013140000-0x0000000013B94000-memory.dmp

Filesize
10.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads