bandook | adf598b6e18cc87cdfd38b309e2107054143b6078827878aaa280a30256b5d4e

Analysis

max time kernel
304s
max time network
330s
platform
windows10-2004_x64
resource
win10v2004-20220812-es
resource tags

arch:x64arch:x86image:win10v2004-20220812-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
05-12-2022 15:52

Target

Recibo Pago_01.exe
Size

2.6MB
MD5

b878881a2185be9eaa1ea8e0dd110928
SHA1

f5d02789571a0e77df546cd8b9a7961d8a6d6492
SHA256

adf598b6e18cc87cdfd38b309e2107054143b6078827878aaa280a30256b5d4e
SHA512

9390674a0c3d69af48f6509ab0b37616270d1d370270de137faf3e35e6c33b4e8ef518ba0fbed4859c063b32bcb6660cab424282b6e9fc84e6451fa17dd8a8b9
SSDEEP

24576:PQvIbnxx7gup2pm/+yS5ksdokLm0Nnc9EMiqQmH7zWfDzgWPo/+OxhirK6rQinxu:PG27lSvCkDcnbKfDzl00rtkaYnZtQ3By

Score

10^/10

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 3 IoCs

resource	yara_rule
behavioral2/memory/2760-136-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral2/memory/2760-137-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral2/memory/2760-138-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2760-134-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/2760-135-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/2760-136-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/2760-137-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/2760-138-0x0000000013140000-0x0000000014009000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2760	msinfo32.exe
2760	msinfo32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 2760	3904	Recibo Pago_01.exe	89
PID 3904 wrote to memory of 2760	3904	Recibo Pago_01.exe	89
PID 3904 wrote to memory of 2760	3904	Recibo Pago_01.exe	89
PID 3904 wrote to memory of 2252	3904	Recibo Pago_01.exe	90
PID 3904 wrote to memory of 2252	3904	Recibo Pago_01.exe	90
PID 3904 wrote to memory of 2252	3904	Recibo Pago_01.exe	90
PID 3904 wrote to memory of 2760	3904	Recibo Pago_01.exe	89
PID 3904 wrote to memory of 2760	3904	Recibo Pago_01.exe	89

C:\Users\Admin\AppData\Local\Temp\Recibo Pago_01.exe
"C:\Users\Admin\AppData\Local\Temp\Recibo Pago_01.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3904
- C:\windows\SysWOW64\msinfo32.exe
  C:\windows\syswow64\msinfo32.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2760
- C:\Users\Admin\AppData\Local\Temp\Recibo Pago_01.exe
  "C:\Users\Admin\AppData\Local\Temp\Recibo Pago_01.exe" dkddkdkkdkdd ddd
  2⤵
  PID:2252

memory/2760-134-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/2760-135-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/2760-136-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/2760-137-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/2760-138-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download