bandook | b4920df90b188b3b3cf63423aa18d50adf6606f538075515bd466a9570d784b2

Analysis

max time kernel
204s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2023 09:12

Target

Factura_Reporte.exe
Size

2.8MB
MD5

aa572e73d2e8dd37ca43ca7d8a046840
SHA1

de467ab0c6078e92a5e0a659c2c81c42870d0f4c
SHA256

7101fa8a59eee4118980fac6c580e435b0e838b8dd3546ad9e87bb26cbdd66c5
SHA512

9b8d8c2fb83bfc704f63711cce75ccbf427e08f8c15d40fe1e3d92a18188ff3df572cda29e98c64ae2b955708ebcb4babad6cc41c7db9e5eaa3c7363eec53dde
SSDEEP

24576:tf4VBO+XL5EtJhVTp+52oIYwF2BT6rk9PsMdb0DPRyMm3F9UAv0r2xp4loQGS7MR:tfQcmTNrSwPXcr1GPDBGXTP1z5uM+W8/

Score

10^/10

Family

bandook

deapproved.ru

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3476-136-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral2/memory/3476-137-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral2/memory/3476-138-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/3476-134-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/3476-135-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/3476-136-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/3476-137-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/3476-138-0x0000000013140000-0x0000000014009000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msinfo32.exe

pid process

3476 msinfo32.exe
3476 msinfo32.exe

pid	process
3476	msinfo32.exe
3476	msinfo32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Factura_Reporte.exe

description	pid	process	target process
PID 2632 wrote to memory of 3476	2632	Factura_Reporte.exe	msinfo32.exe
PID 2632 wrote to memory of 3476	2632	Factura_Reporte.exe	msinfo32.exe
PID 2632 wrote to memory of 3476	2632	Factura_Reporte.exe	msinfo32.exe
PID 2632 wrote to memory of 2068	2632	Factura_Reporte.exe	Factura_Reporte.exe
PID 2632 wrote to memory of 2068	2632	Factura_Reporte.exe	Factura_Reporte.exe
PID 2632 wrote to memory of 2068	2632	Factura_Reporte.exe	Factura_Reporte.exe
PID 2632 wrote to memory of 3476	2632	Factura_Reporte.exe	msinfo32.exe
PID 2632 wrote to memory of 3476	2632	Factura_Reporte.exe	msinfo32.exe

C:\Users\Admin\AppData\Local\Temp\Factura_Reporte.exe
"C:\Users\Admin\AppData\Local\Temp\Factura_Reporte.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2632

C:\windows\SysWOW64\msinfo32.exe
C:\windows\syswow64\msinfo32.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3476

C:\Users\Admin\AppData\Local\Temp\Factura_Reporte.exe
C:\Users\Admin\AppData\Local\Temp\Factura_Reporte.exe ooooooooooooooo
2⤵
PID:2068

memory/2068-132-0x0000000000000000-mapping.dmp

Download
memory/3476-133-0x0000000000000000-mapping.dmp

Download
memory/3476-134-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/3476-135-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/3476-136-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/3476-137-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/3476-138-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download