bandook | 78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575

General

Target

78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe
Size

1.5MB
MD5

448aba4a116723c528154cdd23545490
SHA1

04bb39f49e80ae8b23603df44a0b7f857bac9f44
SHA256

78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575
SHA512

1055fed4a85dff3aeb0d88322164680355af8f6e72ec44fc1c07e0310c82d14dd90ac376f1a0d416e1e11482aa1198148b5d2e6a73b8b6a344f3db053a65140f
SSDEEP

24576:aqtusu+tVxHPidqUAIM3CNQgII6SZlCDHh3R5ZdBAq8yN8tMG6:aZwd4MbyZlUBB5xAql

Score

10^/10

bandook persistence rat trojan

Malware Config

Extracted

Family

bandook

C2

sandykarakas.ddns.net

Signatures

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1728-56-0x0000000013140000-0x0000000013B8E000-memory.dmp	family_bandook
behavioral1/memory/1728-57-0x0000000013148315-mapping.dmp	family_bandook
behavioral1/memory/1728-60-0x0000000013140000-0x0000000013B8E000-memory.dmp	family_bandook
behavioral1/memory/1728-61-0x0000000013140000-0x0000000013B8E000-memory.dmp	family_bandook

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\obm = "C:\\Users\\Admin\\AppData\\Local\\obm\\obm.exe"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\obm = "C:\\Users\\Admin\\AppData\\Local\\obm\\obm.exe"	iexplore.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe

description	pid	process	target process
PID 832 set thread context of 1728	832	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe

description	pid	process	target process
PID 832 wrote to memory of 1728	832	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe
PID 832 wrote to memory of 1728	832	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe
PID 832 wrote to memory of 1728	832	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe
PID 832 wrote to memory of 1728	832	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe
PID 832 wrote to memory of 1728	832	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe
PID 832 wrote to memory of 1728	832	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe
PID 1728 wrote to memory of 1072	1728	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 1728 wrote to memory of 1072	1728	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 1728 wrote to memory of 1072	1728	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 1728 wrote to memory of 1072	1728	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 1728 wrote to memory of 1072	1728	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 1728 wrote to memory of 1164	1728	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 1728 wrote to memory of 1164	1728	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 1728 wrote to memory of 1164	1728	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 1728 wrote to memory of 1164	1728	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 1728 wrote to memory of 1164	1728	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 1728 wrote to memory of 1284	1728	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 1728 wrote to memory of 1284	1728	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 1728 wrote to memory of 1284	1728	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 1728 wrote to memory of 1284	1728	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 1728 wrote to memory of 1284	1728	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 1728 wrote to memory of 724	1728	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 1728 wrote to memory of 724	1728	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 1728 wrote to memory of 724	1728	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 1728 wrote to memory of 724	1728	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 1728 wrote to memory of 724	1728	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe
"C:\Users\Admin\AppData\Local\Temp\78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:832

C:\Users\Admin\AppData\Local\Temp\78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe
"C:\Users\Admin\AppData\Local\Temp\78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
PID:1072

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
- Adds Run key to start application
PID:1164

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
PID:1284

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
- Adds Run key to start application
PID:724

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\obm\obm.exe
Filesize
1.5MB

MD5
448aba4a116723c528154cdd23545490

SHA1
04bb39f49e80ae8b23603df44a0b7f857bac9f44

SHA256
78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575

SHA512
1055fed4a85dff3aeb0d88322164680355af8f6e72ec44fc1c07e0310c82d14dd90ac376f1a0d416e1e11482aa1198148b5d2e6a73b8b6a344f3db053a65140f

Download Submit
memory/1728-54-0x0000000013140000-0x0000000013B8E000-memory.dmp

Filesize
10.3MB

Download
memory/1728-56-0x0000000013140000-0x0000000013B8E000-memory.dmp

Filesize
10.3MB

Download
memory/1728-57-0x0000000013148315-mapping.dmp

Download
memory/1728-59-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1728-60-0x0000000013140000-0x0000000013B8E000-memory.dmp

Filesize
10.3MB

Download
memory/1728-61-0x0000000013140000-0x0000000013B8E000-memory.dmp

Filesize
10.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads