bandook | 78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575

General

Target

78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe
Size

1.5MB
MD5

448aba4a116723c528154cdd23545490
SHA1

04bb39f49e80ae8b23603df44a0b7f857bac9f44
SHA256

78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575
SHA512

1055fed4a85dff3aeb0d88322164680355af8f6e72ec44fc1c07e0310c82d14dd90ac376f1a0d416e1e11482aa1198148b5d2e6a73b8b6a344f3db053a65140f
SSDEEP

24576:aqtusu+tVxHPidqUAIM3CNQgII6SZlCDHh3R5ZdBAq8yN8tMG6:aZwd4MbyZlUBB5xAql

Score

10^/10

bandook rat trojan

Malware Config

Extracted

Family

bandook

C2

sandykarakas.ddns.net

Signatures

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4780-133-0x0000000013140000-0x0000000013B8E000-memory.dmp	family_bandook
behavioral2/memory/4780-135-0x0000000013140000-0x0000000013B8E000-memory.dmp	family_bandook
behavioral2/memory/4780-136-0x0000000013140000-0x0000000013B8E000-memory.dmp	family_bandook

Suspicious use of SetThreadContext 1 IoCs

Processes:

78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe

description	pid	process	target process
PID 5076 set thread context of 4780	5076	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe

description	pid	process	target process
PID 5076 wrote to memory of 4780	5076	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe
PID 5076 wrote to memory of 4780	5076	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe
PID 5076 wrote to memory of 4780	5076	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe
PID 5076 wrote to memory of 4780	5076	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe
PID 5076 wrote to memory of 4780	5076	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe
PID 4780 wrote to memory of 1800	4780	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 4780 wrote to memory of 1800	4780	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 4780 wrote to memory of 1800	4780	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 4780 wrote to memory of 1800	4780	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 4780 wrote to memory of 2784	4780	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 4780 wrote to memory of 2784	4780	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 4780 wrote to memory of 2784	4780	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 4780 wrote to memory of 2784	4780	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 4780 wrote to memory of 2068	4780	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 4780 wrote to memory of 2068	4780	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 4780 wrote to memory of 2068	4780	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 4780 wrote to memory of 2068	4780	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 4780 wrote to memory of 1908	4780	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 4780 wrote to memory of 1908	4780	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 4780 wrote to memory of 1908	4780	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe
PID 4780 wrote to memory of 1908	4780	78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe
"C:\Users\Admin\AppData\Local\Temp\78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5076

C:\Users\Admin\AppData\Local\Temp\78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe
"C:\Users\Admin\AppData\Local\Temp\78d8be0c162fc2ef33a4357a3a1ac82d42e773c8f87406d2e678dcefa80b4575.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4780

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
PID:1800

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
PID:2784

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
PID:2068

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
PID:1908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4780-132-0x0000000000000000-mapping.dmp

Download
memory/4780-133-0x0000000013140000-0x0000000013B8E000-memory.dmp

Filesize
10.3MB

Download
memory/4780-135-0x0000000013140000-0x0000000013B8E000-memory.dmp

Filesize
10.3MB

Download
memory/4780-136-0x0000000013140000-0x0000000013B8E000-memory.dmp

Filesize
10.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads