bandook | bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480

General

Target

bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe
Size

1.6MB
MD5

752e301ae1f726fd98279c779a31ef2e
SHA1

b2dca2b0913cbdc98d652917adcd157c778957c0
SHA256

bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480
SHA512

aaac35a116456d1a06c4e491265fab870ea41b28cdb35d93ba94276b75e1a418754fc9b3f35917ead90ef3959a7c3fab032a69298a8d0c0da6c2d949ad5d9fdd
SSDEEP

49152:ploCs/JrR6MYq4jRUiXXFpBdftBYxnbmFVpQhaYG:plOR96MR4VjLQnbUVpiG

Score

10^/10

bandook evasion persistence rat trojan

Malware Config

Extracted

Family

bandook

C2

bandar123.ddns.net

Signatures

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1452-61-0x0000000013140000-0x0000000013B92000-memory.dmp	family_bandook
behavioral1/memory/1452-62-0x000000001314962C-mapping.dmp	family_bandook
behavioral1/memory/1452-67-0x0000000013140000-0x0000000013B92000-memory.dmp	family_bandook
behavioral1/memory/1452-68-0x0000000013140000-0x0000000013B92000-memory.dmp	family_bandook
behavioral1/memory/1452-69-0x0000000013140000-0x0000000013B92000-memory.dmp	family_bandook

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Wine	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\uis = "C:\\Users\\Admin\\AppData\\Local\\UIS\\uis.exe"	iexplore.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe

description	pid	process	target process
PID 1652 set thread context of 1452	1652	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe

pid process

1652 bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe

pid	process
1652	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exebd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe

description	pid	process	target process
PID 1652 wrote to memory of 1452	1652	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe
PID 1652 wrote to memory of 1452	1652	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe
PID 1652 wrote to memory of 1452	1652	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe
PID 1652 wrote to memory of 1452	1652	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe
PID 1652 wrote to memory of 1452	1652	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe
PID 1652 wrote to memory of 1452	1652	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe
PID 1452 wrote to memory of 1708	1452	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe	iexplore.exe
PID 1452 wrote to memory of 1708	1452	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe	iexplore.exe
PID 1452 wrote to memory of 1708	1452	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe	iexplore.exe
PID 1452 wrote to memory of 1708	1452	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe	iexplore.exe
PID 1452 wrote to memory of 1708	1452	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe	iexplore.exe
PID 1452 wrote to memory of 852	1452	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe	iexplore.exe
PID 1452 wrote to memory of 852	1452	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe	iexplore.exe
PID 1452 wrote to memory of 852	1452	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe	iexplore.exe
PID 1452 wrote to memory of 852	1452	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe	iexplore.exe
PID 1452 wrote to memory of 852	1452	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe	iexplore.exe
PID 1452 wrote to memory of 1036	1452	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe	iexplore.exe
PID 1452 wrote to memory of 1036	1452	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe	iexplore.exe
PID 1452 wrote to memory of 1036	1452	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe	iexplore.exe
PID 1452 wrote to memory of 1036	1452	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe	iexplore.exe
PID 1452 wrote to memory of 1036	1452	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe	iexplore.exe
PID 1452 wrote to memory of 1548	1452	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe	iexplore.exe
PID 1452 wrote to memory of 1548	1452	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe	iexplore.exe
PID 1452 wrote to memory of 1548	1452	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe	iexplore.exe
PID 1452 wrote to memory of 1548	1452	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe	iexplore.exe
PID 1452 wrote to memory of 1548	1452	bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe
"C:\Users\Admin\AppData\Local\Temp\bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe"
1⤵
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652

C:\Users\Admin\AppData\Local\Temp\bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe
"C:\Users\Admin\AppData\Local\Temp\bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1452

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
PID:1708

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
- Adds Run key to start application
PID:852

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
PID:1036

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
PID:1548

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\UIS\uis.exe
Filesize
1.6MB

MD5
752e301ae1f726fd98279c779a31ef2e

SHA1
b2dca2b0913cbdc98d652917adcd157c778957c0

SHA256
bd318d45e08bceab9470b1cfec2e8a9e70c790daff0770a6bb60682653ac9480

SHA512
aaac35a116456d1a06c4e491265fab870ea41b28cdb35d93ba94276b75e1a418754fc9b3f35917ead90ef3959a7c3fab032a69298a8d0c0da6c2d949ad5d9fdd

Download Submit
memory/1452-64-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/1452-69-0x0000000013140000-0x0000000013B92000-memory.dmp

Filesize
10.3MB

Download
memory/1452-68-0x0000000013140000-0x0000000013B92000-memory.dmp

Filesize
10.3MB

Download
memory/1452-67-0x0000000013140000-0x0000000013B92000-memory.dmp

Filesize
10.3MB

Download
memory/1452-59-0x0000000013140000-0x0000000013B92000-memory.dmp

Filesize
10.3MB

Download
memory/1452-61-0x0000000013140000-0x0000000013B92000-memory.dmp

Filesize
10.3MB

Download
memory/1452-62-0x000000001314962C-mapping.dmp

Download
memory/1652-57-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/1652-66-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/1652-58-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/1652-54-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/1652-56-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/1652-55-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads