bandook | a3d2ec4515b90456c1a798ae0f5bf3d9778de8403d13fc14edfb6249618acdd3

General

Target

Factura_Cancelada.exe
Size

3.0MB
MD5

edb4cfa462e6cca2dda869c0d46ef109
SHA1

98d212c0bc943d874db679ad81fef698180c95b9
SHA256

a3d2ec4515b90456c1a798ae0f5bf3d9778de8403d13fc14edfb6249618acdd3
SHA512

b2bb36473e08674c44aee47fc091c8d80efb16a100b418f131877af2ea0aba47dd19097952b359fc49202d4292cb5da555f04a4666e55d350a8a94366df7fa50
SSDEEP

49152:7L7UX6elsQ9Rc5lZsZZ5YGKTaIEobUrYtG:7/UFlsC

Score

10^/10

bandook rat trojan upx

Malware Config

Extracted

Family

bandook

C2

gombos.ru

Signatures

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1168-81-0x0000000013140000-0x0000000013E83000-memory.dmp	family_bandook
behavioral1/memory/1168-82-0x0000000013140000-0x0000000013E83000-memory.dmp	family_bandook
behavioral1/memory/1168-88-0x0000000013140000-0x0000000013E83000-memory.dmp	family_bandook
behavioral1/memory/1168-89-0x0000000013140000-0x0000000013E83000-memory.dmp	family_bandook
behavioral1/memory/1168-90-0x0000000013140000-0x0000000013E83000-memory.dmp	family_bandook
behavioral1/memory/1168-92-0x0000000013140000-0x0000000013E83000-memory.dmp	family_bandook
behavioral1/memory/1168-94-0x0000000013140000-0x0000000013E83000-memory.dmp	family_bandook

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1168-79-0x0000000013140000-0x0000000013E83000-memory.dmp	upx
behavioral1/memory/1168-80-0x0000000013140000-0x0000000013E83000-memory.dmp	upx
behavioral1/memory/1168-81-0x0000000013140000-0x0000000013E83000-memory.dmp	upx
behavioral1/memory/1168-82-0x0000000013140000-0x0000000013E83000-memory.dmp	upx
behavioral1/memory/1168-88-0x0000000013140000-0x0000000013E83000-memory.dmp	upx
behavioral1/memory/1168-89-0x0000000013140000-0x0000000013E83000-memory.dmp	upx
behavioral1/memory/1168-90-0x0000000013140000-0x0000000013E83000-memory.dmp	upx
behavioral1/memory/1168-92-0x0000000013140000-0x0000000013E83000-memory.dmp	upx
behavioral1/memory/1168-94-0x0000000013140000-0x0000000013E83000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

msinfo32.exe

pid process

1168 msinfo32.exe

pid	process
1168	msinfo32.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

Factura_Cancelada.exe

description	pid	process	target process
PID 1300 wrote to memory of 1168	1300	Factura_Cancelada.exe	msinfo32.exe
PID 1300 wrote to memory of 1168	1300	Factura_Cancelada.exe	msinfo32.exe
PID 1300 wrote to memory of 1168	1300	Factura_Cancelada.exe	msinfo32.exe
PID 1300 wrote to memory of 1168	1300	Factura_Cancelada.exe	msinfo32.exe
PID 1300 wrote to memory of 1376	1300	Factura_Cancelada.exe	Factura_Cancelada.exe
PID 1300 wrote to memory of 1376	1300	Factura_Cancelada.exe	Factura_Cancelada.exe
PID 1300 wrote to memory of 1376	1300	Factura_Cancelada.exe	Factura_Cancelada.exe
PID 1300 wrote to memory of 1376	1300	Factura_Cancelada.exe	Factura_Cancelada.exe
PID 1300 wrote to memory of 1168	1300	Factura_Cancelada.exe	msinfo32.exe
PID 1300 wrote to memory of 1168	1300	Factura_Cancelada.exe	msinfo32.exe

C:\Users\Admin\AppData\Local\Temp\Factura_Cancelada.exe
"C:\Users\Admin\AppData\Local\Temp\Factura_Cancelada.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1300

C:\windows\syswow64\msinfo32.exe
C:\windows\syswow64\msinfo32.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1168

C:\Users\Admin\AppData\Local\Temp\Factura_Cancelada.exe
C:\Users\Admin\AppData\Local\Temp\Factura_Cancelada.exe ooooooooooooooo
2⤵
PID:1376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1168-78-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1168-94-0x0000000013140000-0x0000000013E83000-memory.dmp

Filesize
13.3MB

Download
memory/1168-92-0x0000000013140000-0x0000000013E83000-memory.dmp

Filesize
13.3MB

Download
memory/1168-90-0x0000000013140000-0x0000000013E83000-memory.dmp

Filesize
13.3MB

Download
memory/1168-89-0x0000000013140000-0x0000000013E83000-memory.dmp

Filesize
13.3MB

Download
memory/1168-88-0x0000000013140000-0x0000000013E83000-memory.dmp

Filesize
13.3MB

Download
memory/1168-82-0x0000000013140000-0x0000000013E83000-memory.dmp

Filesize
13.3MB

Download
memory/1168-81-0x0000000013140000-0x0000000013E83000-memory.dmp

Filesize
13.3MB

Download
memory/1168-80-0x0000000013140000-0x0000000013E83000-memory.dmp

Filesize
13.3MB

Download
memory/1168-79-0x0000000013140000-0x0000000013E83000-memory.dmp

Filesize
13.3MB

Download
memory/1168-77-0x0000000013140000-0x0000000013E83000-memory.dmp

Filesize
13.3MB

Download
memory/1300-72-0x0000000000400000-0x0000000000715000-memory.dmp

Filesize
3.1MB

Download
memory/1300-57-0x0000000000400000-0x0000000000715000-memory.dmp

Filesize
3.1MB

Download
memory/1300-74-0x0000000000400000-0x0000000000715000-memory.dmp

Filesize
3.1MB

Download
memory/1300-73-0x0000000000400000-0x0000000000715000-memory.dmp

Filesize
3.1MB

Download
memory/1300-54-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1300-83-0x0000000000400000-0x0000000000715000-memory.dmp

Filesize
3.1MB

Download
memory/1300-105-0x0000000000400000-0x0000000000715000-memory.dmp

Filesize
3.1MB

Download
memory/1300-55-0x0000000000400000-0x0000000000715000-memory.dmp

Filesize
3.1MB

Download
memory/1300-59-0x0000000000400000-0x0000000000715000-memory.dmp

Filesize
3.1MB

Download
memory/1300-58-0x0000000000400000-0x0000000000715000-memory.dmp

Filesize
3.1MB

Download
memory/1300-56-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1376-76-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1376-85-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1376-96-0x0000000000400000-0x0000000000715000-memory.dmp

Filesize
3.1MB

Download
memory/1376-98-0x0000000000400000-0x0000000000715000-memory.dmp

Filesize
3.1MB

Download
memory/1376-84-0x0000000000400000-0x0000000000715000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads