bandook | ca255e39475e03fab80314b13b95219d8143d9689fdcdff7e4c2c9aeab39c010

General

Target

cotizacion digital.exe
Size

2.6MB
MD5

54aad82a97089ca95a8e04bdf725e571
SHA1

769f5daaae9eb3256dc3f8937329a5c996b0f4df
SHA256

ca255e39475e03fab80314b13b95219d8143d9689fdcdff7e4c2c9aeab39c010
SHA512

553dfc6c11e58e2e2fbb4d5f2fbcd110107a70a9b53f4f4e0ab29645af09e2c39e30090f7710f640f3e2891f9300f535bba5b825c517809b4b1b03ad69870ccf
SSDEEP

49152:0G2ZPpGVQpuux0xj8sFUUM+rERWGRsknWjOEa1GUB1g6D:0H

Score

10^/10

bandook rat trojan upx

Malware Config

Extracted

Family

bandook

C2

deapproved.ru

Signatures

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1832-156-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral2/memory/1832-157-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral2/memory/1832-158-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral2/memory/1832-159-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral2/memory/1832-162-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral2/memory/1832-163-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral2/memory/1832-167-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1832-153-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/1832-154-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/1832-156-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/1832-157-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/1832-158-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/1832-159-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/1832-162-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/1832-163-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/1832-167-0x0000000013140000-0x0000000014009000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msinfo32.exe

pid process

1832 msinfo32.exe
1832 msinfo32.exe

pid	process
1832	msinfo32.exe
1832	msinfo32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

cotizacion digital.exe

description	pid	process	target process
PID 3076 wrote to memory of 1832	3076	cotizacion digital.exe	msinfo32.exe
PID 3076 wrote to memory of 1832	3076	cotizacion digital.exe	msinfo32.exe
PID 3076 wrote to memory of 1832	3076	cotizacion digital.exe	msinfo32.exe
PID 3076 wrote to memory of 3688	3076	cotizacion digital.exe	cotizacion digital.exe
PID 3076 wrote to memory of 3688	3076	cotizacion digital.exe	cotizacion digital.exe
PID 3076 wrote to memory of 3688	3076	cotizacion digital.exe	cotizacion digital.exe
PID 3076 wrote to memory of 1832	3076	cotizacion digital.exe	msinfo32.exe
PID 3076 wrote to memory of 1832	3076	cotizacion digital.exe	msinfo32.exe

C:\Users\Admin\AppData\Local\Temp\cotizacion digital.exe
"C:\Users\Admin\AppData\Local\Temp\cotizacion digital.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3076

C:\windows\SysWOW64\msinfo32.exe
C:\windows\syswow64\msinfo32.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1832

C:\Users\Admin\AppData\Local\Temp\cotizacion digital.exe
"C:\Users\Admin\AppData\Local\Temp\cotizacion digital.exe" dkddkdkkdkdd ddd
2⤵
PID:3688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1832-154-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/1832-167-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/1832-163-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/1832-162-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/1832-159-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/1832-158-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/1832-157-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/1832-156-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/1832-153-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/3076-150-0x0000000000400000-0x00000000006AE000-memory.dmp

Filesize
2.7MB

Download
memory/3076-135-0x0000000000400000-0x00000000006AE000-memory.dmp

Filesize
2.7MB

Download
memory/3076-179-0x0000000000400000-0x00000000006AE000-memory.dmp

Filesize
2.7MB

Download
memory/3076-151-0x0000000000400000-0x00000000006AE000-memory.dmp

Filesize
2.7MB

Download
memory/3076-133-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/3076-149-0x0000000000400000-0x00000000006AE000-memory.dmp

Filesize
2.7MB

Download
memory/3076-136-0x0000000000400000-0x00000000006AE000-memory.dmp

Filesize
2.7MB

Download
memory/3076-155-0x0000000000400000-0x00000000006AE000-memory.dmp

Filesize
2.7MB

Download
memory/3076-134-0x0000000000400000-0x00000000006AE000-memory.dmp

Filesize
2.7MB

Download
memory/3688-166-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/3688-164-0x0000000000400000-0x00000000006AE000-memory.dmp

Filesize
2.7MB

Download
memory/3688-168-0x0000000000400000-0x00000000006AE000-memory.dmp

Filesize
2.7MB

Download
memory/3688-170-0x0000000000400000-0x00000000006AE000-memory.dmp

Filesize
2.7MB

Download
memory/3688-152-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads