bandook | 2c619d413f80a76a0b727dd88599c6e4120183cd07fdf04a3303ce64952f62c3

Analysis

max time kernel
290s
max time network
256s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 23:05

Target

2c619d413f80a76a0b727dd88599c6e4120183cd07fdf04a3303ce64952f62c3.exe
Size

1.3MB
MD5

b3a99ca4931d97592b6011f47f80855e
SHA1

76484423af9d832e5ac4c45a8567092bf83aa247
SHA256

2c619d413f80a76a0b727dd88599c6e4120183cd07fdf04a3303ce64952f62c3
SHA512

d6bb94d6efe726ebbc5b75f851d622878991b593988d2df896cbdcee6ad0e8106160d40592cb046e325083f3ed8fc362bf55d143dfaa001aa4f3500b894a7460
SSDEEP

24576:Bi0jbZw96tmhNSaWPxEQo10+6hd13IvcI71ctt08kIy:BrwxKxEQoX63dpE

Score

10^/10

bandook rat trojan

Family

bandook

jaysonj.no-ip.biz

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 2 IoCs

resource	yara_rule
behavioral2/memory/3380-133-0x0000000013140000-0x0000000013B93000-memory.dmp	family_bandook
behavioral2/memory/3380-135-0x0000000013140000-0x0000000013B93000-memory.dmp	family_bandook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 216 set thread context of 3380	216	2c619d413f80a76a0b727dd88599c6e4120183cd07fdf04a3303ce64952f62c3.exe	81

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 3380	216	2c619d413f80a76a0b727dd88599c6e4120183cd07fdf04a3303ce64952f62c3.exe	81
PID 216 wrote to memory of 3380	216	2c619d413f80a76a0b727dd88599c6e4120183cd07fdf04a3303ce64952f62c3.exe	81
PID 216 wrote to memory of 3380	216	2c619d413f80a76a0b727dd88599c6e4120183cd07fdf04a3303ce64952f62c3.exe	81
PID 216 wrote to memory of 3380	216	2c619d413f80a76a0b727dd88599c6e4120183cd07fdf04a3303ce64952f62c3.exe	81
PID 216 wrote to memory of 3380	216	2c619d413f80a76a0b727dd88599c6e4120183cd07fdf04a3303ce64952f62c3.exe	81

C:\Users\Admin\AppData\Local\Temp\2c619d413f80a76a0b727dd88599c6e4120183cd07fdf04a3303ce64952f62c3.exe
"C:\Users\Admin\AppData\Local\Temp\2c619d413f80a76a0b727dd88599c6e4120183cd07fdf04a3303ce64952f62c3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:216
- C:\Users\Admin\AppData\Local\Temp\2c619d413f80a76a0b727dd88599c6e4120183cd07fdf04a3303ce64952f62c3.exe
  "C:\Users\Admin\AppData\Local\Temp\2c619d413f80a76a0b727dd88599c6e4120183cd07fdf04a3303ce64952f62c3.exe"
  2⤵
  PID:3380

memory/3380-133-0x0000000013140000-0x0000000013B93000-memory.dmp

Filesize
10.3MB

Download
memory/3380-135-0x0000000013140000-0x0000000013B93000-memory.dmp

Filesize
10.3MB

Download