bandook | adf598b6e18cc87cdfd38b309e2107054143b6078827878aaa280a30256b5d4e

Analysis

max time kernel
300s
max time network
312s
platform
windows10-2004_x64
resource
win10v2004-20220812-es
resource tags

arch:x64arch:x86image:win10v2004-20220812-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
05-12-2022 15:44

Target

Recibo Pago_01.exe
Size

2.6MB
MD5

b878881a2185be9eaa1ea8e0dd110928
SHA1

f5d02789571a0e77df546cd8b9a7961d8a6d6492
SHA256

adf598b6e18cc87cdfd38b309e2107054143b6078827878aaa280a30256b5d4e
SHA512

9390674a0c3d69af48f6509ab0b37616270d1d370270de137faf3e35e6c33b4e8ef518ba0fbed4859c063b32bcb6660cab424282b6e9fc84e6451fa17dd8a8b9
SSDEEP

24576:PQvIbnxx7gup2pm/+yS5ksdokLm0Nnc9EMiqQmH7zWfDzgWPo/+OxhirK6rQinxu:PG27lSvCkDcnbKfDzl00rtkaYnZtQ3By

Score

10^/10

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2564-136-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral2/memory/2564-137-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral2/memory/2564-138-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/2564-134-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/2564-135-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/2564-136-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/2564-137-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/2564-138-0x0000000013140000-0x0000000014009000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msinfo32.exe

pid process

2564 msinfo32.exe
2564 msinfo32.exe

pid	process
2564	msinfo32.exe
2564	msinfo32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Recibo Pago_01.exe

description	pid	process	target process
PID 632 wrote to memory of 2564	632	Recibo Pago_01.exe	msinfo32.exe
PID 632 wrote to memory of 2564	632	Recibo Pago_01.exe	msinfo32.exe
PID 632 wrote to memory of 2564	632	Recibo Pago_01.exe	msinfo32.exe
PID 632 wrote to memory of 1980	632	Recibo Pago_01.exe	Recibo Pago_01.exe
PID 632 wrote to memory of 1980	632	Recibo Pago_01.exe	Recibo Pago_01.exe
PID 632 wrote to memory of 1980	632	Recibo Pago_01.exe	Recibo Pago_01.exe
PID 632 wrote to memory of 2564	632	Recibo Pago_01.exe	msinfo32.exe
PID 632 wrote to memory of 2564	632	Recibo Pago_01.exe	msinfo32.exe

C:\Users\Admin\AppData\Local\Temp\Recibo Pago_01.exe
"C:\Users\Admin\AppData\Local\Temp\Recibo Pago_01.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:632

C:\windows\SysWOW64\msinfo32.exe
C:\windows\syswow64\msinfo32.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2564

C:\Users\Admin\AppData\Local\Temp\Recibo Pago_01.exe
"C:\Users\Admin\AppData\Local\Temp\Recibo Pago_01.exe" dkddkdkkdkdd ddd
2⤵
PID:1980

memory/1980-132-0x0000000000000000-mapping.dmp

Download
memory/2564-133-0x0000000000000000-mapping.dmp

Download
memory/2564-134-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/2564-135-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/2564-136-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/2564-137-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/2564-138-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download