bandook | 7b83f7ae321518f05b4216d8c23b4132530b1703b059652cec3e9df66a43e75b

General

Target

Factura de Cobro.exe
Size

4.6MB
MD5

b92d890067c0e30dc98ba8d20058dbb4
SHA1

6b783fe7cfa093c9a77b7637fb86a0bf7a637bce
SHA256

7b83f7ae321518f05b4216d8c23b4132530b1703b059652cec3e9df66a43e75b
SHA512

38353072bbd0642e86574284b086321892800357b8abc9821447b9776a8da50d2ba9ff137c4e1e3b3f4592245aa32f1a95c4da8d8a4917d565f66199f687abf9
SSDEEP

49152:RlZfI2n9LIRJzCj5z3kPONwwo98TMCXWqmDHtUjdTMh68H7VJVeoUBcTnUkcNVuL:RlZQip3AONw

Score

10^/10

bandook rat trojan upx

Malware Config

Extracted

Family

bandook

C2

bomes.ru

Signatures

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1880-80-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral1/memory/1880-81-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral1/memory/1880-92-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral1/memory/1880-93-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral1/memory/1880-94-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral1/memory/1880-97-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral1/memory/1880-99-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1880-78-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral1/memory/1880-79-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral1/memory/1880-80-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral1/memory/1880-81-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral1/memory/1880-92-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral1/memory/1880-93-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral1/memory/1880-94-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral1/memory/1880-97-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral1/memory/1880-99-0x0000000013140000-0x0000000014009000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

msinfo32.exe

pid process

1880 msinfo32.exe

pid	process
1880	msinfo32.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

Factura de Cobro.exe

description	pid	process	target process
PID 364 wrote to memory of 1880	364	Factura de Cobro.exe	msinfo32.exe
PID 364 wrote to memory of 1880	364	Factura de Cobro.exe	msinfo32.exe
PID 364 wrote to memory of 1880	364	Factura de Cobro.exe	msinfo32.exe
PID 364 wrote to memory of 1880	364	Factura de Cobro.exe	msinfo32.exe
PID 364 wrote to memory of 1876	364	Factura de Cobro.exe	Factura de Cobro.exe
PID 364 wrote to memory of 1876	364	Factura de Cobro.exe	Factura de Cobro.exe
PID 364 wrote to memory of 1876	364	Factura de Cobro.exe	Factura de Cobro.exe
PID 364 wrote to memory of 1876	364	Factura de Cobro.exe	Factura de Cobro.exe
PID 364 wrote to memory of 1880	364	Factura de Cobro.exe	msinfo32.exe
PID 364 wrote to memory of 1880	364	Factura de Cobro.exe	msinfo32.exe

C:\Users\Admin\AppData\Local\Temp\Factura de Cobro.exe
"C:\Users\Admin\AppData\Local\Temp\Factura de Cobro.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:364

C:\windows\syswow64\msinfo32.exe
C:\windows\syswow64\msinfo32.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1880

C:\Users\Admin\AppData\Local\Temp\Factura de Cobro.exe
"C:\Users\Admin\AppData\Local\Temp\Factura de Cobro.exe" ooooooooooooooo
2⤵
PID:1876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/364-82-0x0000000000400000-0x00000000008A2000-memory.dmp

Filesize
4.6MB

Download
memory/364-55-0x0000000000400000-0x00000000008A2000-memory.dmp

Filesize
4.6MB

Download
memory/364-56-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/364-58-0x0000000000400000-0x00000000008A2000-memory.dmp

Filesize
4.6MB

Download
memory/364-59-0x0000000000400000-0x00000000008A2000-memory.dmp

Filesize
4.6MB

Download
memory/364-71-0x0000000000400000-0x00000000008A2000-memory.dmp

Filesize
4.6MB

Download
memory/364-72-0x0000000000400000-0x00000000008A2000-memory.dmp

Filesize
4.6MB

Download
memory/364-73-0x0000000000400000-0x00000000008A2000-memory.dmp

Filesize
4.6MB

Download
memory/364-104-0x0000000000400000-0x00000000008A2000-memory.dmp

Filesize
4.6MB

Download
memory/364-54-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1876-86-0x0000000000400000-0x00000000008A2000-memory.dmp

Filesize
4.6MB

Download
memory/1876-83-0x0000000000400000-0x00000000008A2000-memory.dmp

Filesize
4.6MB

Download
memory/1876-75-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1876-90-0x0000000000400000-0x00000000008A2000-memory.dmp

Filesize
4.6MB

Download
memory/1876-88-0x0000000000400000-0x00000000008A2000-memory.dmp

Filesize
4.6MB

Download
memory/1876-84-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1880-77-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1880-78-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/1880-76-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/1880-81-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/1880-80-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/1880-92-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/1880-93-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/1880-94-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/1880-97-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/1880-99-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/1880-79-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads