bandook | ca255e39475e03fab80314b13b95219d8143d9689fdcdff7e4c2c9aeab39c010

General

Target

cotizacion digital.exe
Size

2.6MB
MD5

54aad82a97089ca95a8e04bdf725e571
SHA1

769f5daaae9eb3256dc3f8937329a5c996b0f4df
SHA256

ca255e39475e03fab80314b13b95219d8143d9689fdcdff7e4c2c9aeab39c010
SHA512

553dfc6c11e58e2e2fbb4d5f2fbcd110107a70a9b53f4f4e0ab29645af09e2c39e30090f7710f640f3e2891f9300f535bba5b825c517809b4b1b03ad69870ccf
SSDEEP

49152:0G2ZPpGVQpuux0xj8sFUUM+rERWGRsknWjOEa1GUB1g6D:0H

Score

10^/10

bandook rat trojan upx

Malware Config

Extracted

Family

bandook

C2

deapproved.ru

Signatures

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 8 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1796-80-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral1/memory/1796-81-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral1/memory/1796-87-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral1/memory/1796-92-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral1/memory/1796-93-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral1/memory/1796-95-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral1/memory/1796-96-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral1/memory/1796-98-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1796-78-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral1/memory/1796-79-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral1/memory/1796-80-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral1/memory/1796-81-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral1/memory/1796-87-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral1/memory/1796-92-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral1/memory/1796-93-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral1/memory/1796-95-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral1/memory/1796-96-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral1/memory/1796-98-0x0000000013140000-0x0000000014009000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

msinfo32.exe

pid process

1796 msinfo32.exe

pid	process
1796	msinfo32.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

cotizacion digital.exe

description	pid	process	target process
PID 2012 wrote to memory of 1796	2012	cotizacion digital.exe	msinfo32.exe
PID 2012 wrote to memory of 1796	2012	cotizacion digital.exe	msinfo32.exe
PID 2012 wrote to memory of 1796	2012	cotizacion digital.exe	msinfo32.exe
PID 2012 wrote to memory of 1796	2012	cotizacion digital.exe	msinfo32.exe
PID 2012 wrote to memory of 852	2012	cotizacion digital.exe	cotizacion digital.exe
PID 2012 wrote to memory of 852	2012	cotizacion digital.exe	cotizacion digital.exe
PID 2012 wrote to memory of 852	2012	cotizacion digital.exe	cotizacion digital.exe
PID 2012 wrote to memory of 852	2012	cotizacion digital.exe	cotizacion digital.exe
PID 2012 wrote to memory of 1796	2012	cotizacion digital.exe	msinfo32.exe
PID 2012 wrote to memory of 1796	2012	cotizacion digital.exe	msinfo32.exe

C:\Users\Admin\AppData\Local\Temp\cotizacion digital.exe
"C:\Users\Admin\AppData\Local\Temp\cotizacion digital.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\windows\syswow64\msinfo32.exe
C:\windows\syswow64\msinfo32.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1796

C:\Users\Admin\AppData\Local\Temp\cotizacion digital.exe
"C:\Users\Admin\AppData\Local\Temp\cotizacion digital.exe" dkddkdkkdkdd ddd
2⤵
PID:852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-75-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/852-91-0x0000000000400000-0x00000000006AE000-memory.dmp

Filesize
2.7MB

Download
memory/852-89-0x0000000000400000-0x00000000006AE000-memory.dmp

Filesize
2.7MB

Download
memory/852-84-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/852-83-0x0000000000400000-0x00000000006AE000-memory.dmp

Filesize
2.7MB

Download
memory/1796-87-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/1796-92-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/1796-98-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/1796-96-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/1796-76-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/1796-77-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1796-78-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/1796-79-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/1796-80-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/1796-81-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/1796-95-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/1796-93-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/2012-58-0x0000000000400000-0x00000000006AE000-memory.dmp

Filesize
2.7MB

Download
memory/2012-54-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2012-56-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2012-55-0x0000000000400000-0x00000000006AE000-memory.dmp

Filesize
2.7MB

Download
memory/2012-72-0x0000000000400000-0x00000000006AE000-memory.dmp

Filesize
2.7MB

Download
memory/2012-59-0x0000000000400000-0x00000000006AE000-memory.dmp

Filesize
2.7MB

Download
memory/2012-82-0x0000000000400000-0x00000000006AE000-memory.dmp

Filesize
2.7MB

Download
memory/2012-71-0x0000000000400000-0x00000000006AE000-memory.dmp

Filesize
2.7MB

Download
memory/2012-73-0x0000000000400000-0x00000000006AE000-memory.dmp

Filesize
2.7MB

Download
memory/2012-105-0x0000000000400000-0x00000000006AE000-memory.dmp

Filesize
2.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads