bandook | c3755679775c45969e3f4a9de00ab27bd0c497adff77a6fe44f4f09f0f02074f

Analysis

max time kernel
299s
max time network
265s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
30-04-2023 08:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Cotizacion #055088.exe
Size

3.4MB
MD5

83af5df6e9216551558cf370f66e3b30
SHA1

2bc90b0a0007d4043ce846428fc65aa0a238f505
SHA256

c3755679775c45969e3f4a9de00ab27bd0c497adff77a6fe44f4f09f0f02074f
SHA512

c72c6b4fc7bb261dc55c5abe102cb1df438339149c0624075725fcff3cf22ff64dfe72c0c06bff945cd2237253a60f75120351fa0162b648b5f293e2ba4c1604
SSDEEP

49152:4+0Pr1wVWjFFZCWKKpxiHy0sZnnBJoieEe:4W

Score

10^/10

bandook rat trojan upx

Malware Config

Extracted

Family

bandook

gombos.ru

Signatures

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4372-156-0x0000000013140000-0x0000000013EDF000-memory.dmp	family_bandook
behavioral2/memory/4372-158-0x0000000013140000-0x0000000013EDF000-memory.dmp	family_bandook
behavioral2/memory/4372-159-0x0000000013140000-0x0000000013EDF000-memory.dmp	family_bandook
behavioral2/memory/4372-161-0x0000000013140000-0x0000000013EDF000-memory.dmp	family_bandook
behavioral2/memory/4372-162-0x0000000013140000-0x0000000013EDF000-memory.dmp	family_bandook
behavioral2/memory/4372-164-0x0000000013140000-0x0000000013EDF000-memory.dmp	family_bandook
behavioral2/memory/4372-168-0x0000000013140000-0x0000000013EDF000-memory.dmp	family_bandook

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4372-154-0x0000000013140000-0x0000000013EDF000-memory.dmp	upx
behavioral2/memory/4372-155-0x0000000013140000-0x0000000013EDF000-memory.dmp	upx
behavioral2/memory/4372-156-0x0000000013140000-0x0000000013EDF000-memory.dmp	upx
behavioral2/memory/4372-158-0x0000000013140000-0x0000000013EDF000-memory.dmp	upx
behavioral2/memory/4372-159-0x0000000013140000-0x0000000013EDF000-memory.dmp	upx
behavioral2/memory/4372-161-0x0000000013140000-0x0000000013EDF000-memory.dmp	upx
behavioral2/memory/4372-162-0x0000000013140000-0x0000000013EDF000-memory.dmp	upx
behavioral2/memory/4372-164-0x0000000013140000-0x0000000013EDF000-memory.dmp	upx
behavioral2/memory/4372-168-0x0000000013140000-0x0000000013EDF000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msinfo32.exe

pid process

4372 msinfo32.exe
4372 msinfo32.exe

pid	process
4372	msinfo32.exe
4372	msinfo32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Cotizacion #055088.exe

description	pid	process	target process
PID 3684 wrote to memory of 4372	3684	Cotizacion #055088.exe	msinfo32.exe
PID 3684 wrote to memory of 4372	3684	Cotizacion #055088.exe	msinfo32.exe
PID 3684 wrote to memory of 4372	3684	Cotizacion #055088.exe	msinfo32.exe
PID 3684 wrote to memory of 4180	3684	Cotizacion #055088.exe	Cotizacion #055088.exe
PID 3684 wrote to memory of 4180	3684	Cotizacion #055088.exe	Cotizacion #055088.exe
PID 3684 wrote to memory of 4180	3684	Cotizacion #055088.exe	Cotizacion #055088.exe
PID 3684 wrote to memory of 4372	3684	Cotizacion #055088.exe	msinfo32.exe
PID 3684 wrote to memory of 4372	3684	Cotizacion #055088.exe	msinfo32.exe

C:\Users\Admin\AppData\Local\Temp\Cotizacion #055088.exe
"C:\Users\Admin\AppData\Local\Temp\Cotizacion #055088.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3684

C:\windows\SysWOW64\msinfo32.exe
C:\windows\syswow64\msinfo32.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4372

C:\Users\Admin\AppData\Local\Temp\Cotizacion #055088.exe
"C:\Users\Admin\AppData\Local\Temp\Cotizacion #055088.exe" ooooooooooooooo
2⤵
PID:4180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3684-157-0x0000000000400000-0x0000000000771000-memory.dmp

Filesize
3.4MB

Download
memory/3684-180-0x0000000000400000-0x0000000000771000-memory.dmp

Filesize
3.4MB

Download
memory/3684-133-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/3684-136-0x0000000000400000-0x0000000000771000-memory.dmp

Filesize
3.4MB

Download
memory/3684-150-0x0000000000400000-0x0000000000771000-memory.dmp

Filesize
3.4MB

Download
memory/3684-151-0x0000000000400000-0x0000000000771000-memory.dmp

Filesize
3.4MB

Download
memory/3684-152-0x0000000000400000-0x0000000000771000-memory.dmp

Filesize
3.4MB

Download
memory/3684-134-0x0000000000400000-0x0000000000771000-memory.dmp

Filesize
3.4MB

Download
memory/3684-135-0x0000000000400000-0x0000000000771000-memory.dmp

Filesize
3.4MB

Download
memory/4180-165-0x0000000000400000-0x0000000000771000-memory.dmp

Filesize
3.4MB

Download
memory/4180-171-0x0000000000400000-0x0000000000771000-memory.dmp

Filesize
3.4MB

Download
memory/4180-153-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/4180-169-0x0000000000400000-0x0000000000771000-memory.dmp

Filesize
3.4MB

Download
memory/4180-167-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/4372-155-0x0000000013140000-0x0000000013EDF000-memory.dmp

Filesize
13.6MB

Download
memory/4372-164-0x0000000013140000-0x0000000013EDF000-memory.dmp

Filesize
13.6MB

Download
memory/4372-161-0x0000000013140000-0x0000000013EDF000-memory.dmp

Filesize
13.6MB

Download
memory/4372-158-0x0000000013140000-0x0000000013EDF000-memory.dmp

Filesize
13.6MB

Download
memory/4372-159-0x0000000013140000-0x0000000013EDF000-memory.dmp

Filesize
13.6MB

Download
memory/4372-168-0x0000000013140000-0x0000000013EDF000-memory.dmp

Filesize
13.6MB

Download
memory/4372-162-0x0000000013140000-0x0000000013EDF000-memory.dmp

Filesize
13.6MB

Download
memory/4372-154-0x0000000013140000-0x0000000013EDF000-memory.dmp

Filesize
13.6MB

Download
memory/4372-156-0x0000000013140000-0x0000000013EDF000-memory.dmp

Filesize
13.6MB

Download