bandook | afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734

General

Target

afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe
Size

1002KB
MD5

66e7fff4370f216117c1ab836b43f320
SHA1

68571b2e855fcaf068f73730ac10675128b4f217
SHA256

afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734
SHA512

fe7f11cd216d8be8833f7d99686e94e9d6134772cab878cdef756a2c199fff8f26d88efa108dbc9356ef330a6eeff57a9c90cef80b94da59a16d3210b9ab926c
SSDEEP

24576:dlFlrWrVnrfUEEAXU7PcOeLqkVsD7s/Xl2y:dlKBfTSPcOeLtsnsvl1

Score

10^/10

bandook persistence rat trojan

Malware Config

Extracted

Family

bandook

C2

192.168.31.1

Signatures

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 4 IoCs

resource	yara_rule
behavioral2/memory/1068-133-0x0000000013140000-0x0000000013B94000-memory.dmp	family_bandook
behavioral2/memory/1068-135-0x0000000013140000-0x0000000013B94000-memory.dmp	family_bandook
behavioral2/memory/1068-136-0x0000000013140000-0x0000000013B94000-memory.dmp	family_bandook
behavioral2/memory/1068-137-0x0000000013140000-0x0000000013B94000-memory.dmp	family_bandook

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lkm = "C:\\Users\\Admin\\AppData\\Roaming\\LKM\\lkm.exe"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lkm = "C:\\Users\\Admin\\AppData\\Roaming\\LKM\\lkm.exe"	iexplore.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2676 set thread context of 1068	2676	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	88

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 1068	2676	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	88
PID 2676 wrote to memory of 1068	2676	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	88
PID 2676 wrote to memory of 1068	2676	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	88
PID 2676 wrote to memory of 1068	2676	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	88
PID 2676 wrote to memory of 1068	2676	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	88
PID 1068 wrote to memory of 3768	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	89
PID 1068 wrote to memory of 3768	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	89
PID 1068 wrote to memory of 3768	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	89
PID 1068 wrote to memory of 3768	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	89
PID 1068 wrote to memory of 1248	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	90
PID 1068 wrote to memory of 1248	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	90
PID 1068 wrote to memory of 1248	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	90
PID 1068 wrote to memory of 1248	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	90
PID 1068 wrote to memory of 4556	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	91
PID 1068 wrote to memory of 4556	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	91
PID 1068 wrote to memory of 4556	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	91
PID 1068 wrote to memory of 4556	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	91
PID 1068 wrote to memory of 1652	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	92
PID 1068 wrote to memory of 1652	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	92
PID 1068 wrote to memory of 1652	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	92
PID 1068 wrote to memory of 1652	1068	afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe	92

C:\Users\Admin\AppData\Local\Temp\afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe
"C:\Users\Admin\AppData\Local\Temp\afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Users\Admin\AppData\Local\Temp\afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe
  "C:\Users\Admin\AppData\Local\Temp\afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:3768
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    - Adds Run key to start application
    PID:1248
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:4556
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    - Adds Run key to start application
    PID:1652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\LKM\lkm.exe

Filesize
1002KB

MD5
66e7fff4370f216117c1ab836b43f320

SHA1
68571b2e855fcaf068f73730ac10675128b4f217

SHA256
afebfd81e9d3e416598a34053ad27703a1b3a70c1a316d0dab62c51a4d05c734

SHA512
fe7f11cd216d8be8833f7d99686e94e9d6134772cab878cdef756a2c199fff8f26d88efa108dbc9356ef330a6eeff57a9c90cef80b94da59a16d3210b9ab926c

Download Submit
memory/1068-133-0x0000000013140000-0x0000000013B94000-memory.dmp

Filesize
10.3MB

Download
memory/1068-135-0x0000000013140000-0x0000000013B94000-memory.dmp

Filesize
10.3MB

Download
memory/1068-136-0x0000000013140000-0x0000000013B94000-memory.dmp

Filesize
10.3MB

Download
memory/1068-137-0x0000000013140000-0x0000000013B94000-memory.dmp

Filesize
10.3MB

Download

Analysis

Sharing