bandook | b4920df90b188b3b3cf63423aa18d50adf6606f538075515bd466a9570d784b2

Analysis

max time kernel
199s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-01-2023 09:12

Target

Factura_Reporte.exe
Size

2.8MB
MD5

aa572e73d2e8dd37ca43ca7d8a046840
SHA1

de467ab0c6078e92a5e0a659c2c81c42870d0f4c
SHA256

7101fa8a59eee4118980fac6c580e435b0e838b8dd3546ad9e87bb26cbdd66c5
SHA512

9b8d8c2fb83bfc704f63711cce75ccbf427e08f8c15d40fe1e3d92a18188ff3df572cda29e98c64ae2b955708ebcb4babad6cc41c7db9e5eaa3c7363eec53dde
SSDEEP

24576:tf4VBO+XL5EtJhVTp+52oIYwF2BT6rk9PsMdb0DPRyMm3F9UAv0r2xp4loQGS7MR:tfQcmTNrSwPXcr1GPDBGXTP1z5uM+W8/

Score

10^/10

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2012-63-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral1/memory/2012-64-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/2012-60-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral1/memory/2012-62-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral1/memory/2012-63-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral1/memory/2012-64-0x0000000013140000-0x0000000014009000-memory.dmp	upx

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

Factura_Reporte.exe

description	pid	process	target process
PID 2008 wrote to memory of 2012	2008	Factura_Reporte.exe	msinfo32.exe
PID 2008 wrote to memory of 2012	2008	Factura_Reporte.exe	msinfo32.exe
PID 2008 wrote to memory of 2012	2008	Factura_Reporte.exe	msinfo32.exe
PID 2008 wrote to memory of 2012	2008	Factura_Reporte.exe	msinfo32.exe
PID 2008 wrote to memory of 240	2008	Factura_Reporte.exe	Factura_Reporte.exe
PID 2008 wrote to memory of 240	2008	Factura_Reporte.exe	Factura_Reporte.exe
PID 2008 wrote to memory of 240	2008	Factura_Reporte.exe	Factura_Reporte.exe
PID 2008 wrote to memory of 240	2008	Factura_Reporte.exe	Factura_Reporte.exe
PID 2008 wrote to memory of 2012	2008	Factura_Reporte.exe	msinfo32.exe
PID 2008 wrote to memory of 2012	2008	Factura_Reporte.exe	msinfo32.exe

C:\Users\Admin\AppData\Local\Temp\Factura_Reporte.exe
"C:\Users\Admin\AppData\Local\Temp\Factura_Reporte.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2008

C:\Users\Admin\AppData\Local\Temp\Factura_Reporte.exe
C:\Users\Admin\AppData\Local\Temp\Factura_Reporte.exe ooooooooooooooo
2⤵
PID:240

memory/240-55-0x0000000000000000-mapping.dmp

Download
memory/2008-54-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/2012-57-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/2012-59-0x0000000000000000-mapping.dmp

Download
memory/2012-60-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/2012-62-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/2012-63-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/2012-64-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download