bandook | a3d2ec4515b90456c1a798ae0f5bf3d9778de8403d13fc14edfb6249618acdd3

General

Target

Factura_Cancelada.exe
Size

3.0MB
MD5

edb4cfa462e6cca2dda869c0d46ef109
SHA1

98d212c0bc943d874db679ad81fef698180c95b9
SHA256

a3d2ec4515b90456c1a798ae0f5bf3d9778de8403d13fc14edfb6249618acdd3
SHA512

b2bb36473e08674c44aee47fc091c8d80efb16a100b418f131877af2ea0aba47dd19097952b359fc49202d4292cb5da555f04a4666e55d350a8a94366df7fa50
SSDEEP

49152:7L7UX6elsQ9Rc5lZsZZ5YGKTaIEobUrYtG:7/UFlsC

Score

10^/10

bandook rat trojan upx

Malware Config

Extracted

Family

bandook

C2

gombos.ru

Signatures

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 8 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4900-157-0x0000000013140000-0x0000000013E83000-memory.dmp	family_bandook
behavioral2/memory/4900-158-0x0000000013140000-0x0000000013E83000-memory.dmp	family_bandook
behavioral2/memory/4900-159-0x0000000013140000-0x0000000013E83000-memory.dmp	family_bandook
behavioral2/memory/4900-160-0x0000000013140000-0x0000000013E83000-memory.dmp	family_bandook
behavioral2/memory/4900-161-0x0000000013140000-0x0000000013E83000-memory.dmp	family_bandook
behavioral2/memory/4900-163-0x0000000013140000-0x0000000013E83000-memory.dmp	family_bandook
behavioral2/memory/4900-165-0x0000000013140000-0x0000000013E83000-memory.dmp	family_bandook
behavioral2/memory/4900-169-0x0000000013140000-0x0000000013E83000-memory.dmp	family_bandook

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4900-154-0x0000000013140000-0x0000000013E83000-memory.dmp	upx
behavioral2/memory/4900-155-0x0000000013140000-0x0000000013E83000-memory.dmp	upx
behavioral2/memory/4900-157-0x0000000013140000-0x0000000013E83000-memory.dmp	upx
behavioral2/memory/4900-158-0x0000000013140000-0x0000000013E83000-memory.dmp	upx
behavioral2/memory/4900-159-0x0000000013140000-0x0000000013E83000-memory.dmp	upx
behavioral2/memory/4900-160-0x0000000013140000-0x0000000013E83000-memory.dmp	upx
behavioral2/memory/4900-161-0x0000000013140000-0x0000000013E83000-memory.dmp	upx
behavioral2/memory/4900-163-0x0000000013140000-0x0000000013E83000-memory.dmp	upx
behavioral2/memory/4900-165-0x0000000013140000-0x0000000013E83000-memory.dmp	upx
behavioral2/memory/4900-169-0x0000000013140000-0x0000000013E83000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msinfo32.exe

pid process

4900 msinfo32.exe
4900 msinfo32.exe

pid	process
4900	msinfo32.exe
4900	msinfo32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Factura_Cancelada.exe

description	pid	process	target process
PID 1700 wrote to memory of 4900	1700	Factura_Cancelada.exe	msinfo32.exe
PID 1700 wrote to memory of 4900	1700	Factura_Cancelada.exe	msinfo32.exe
PID 1700 wrote to memory of 4900	1700	Factura_Cancelada.exe	msinfo32.exe
PID 1700 wrote to memory of 968	1700	Factura_Cancelada.exe	Factura_Cancelada.exe
PID 1700 wrote to memory of 968	1700	Factura_Cancelada.exe	Factura_Cancelada.exe
PID 1700 wrote to memory of 968	1700	Factura_Cancelada.exe	Factura_Cancelada.exe
PID 1700 wrote to memory of 4900	1700	Factura_Cancelada.exe	msinfo32.exe
PID 1700 wrote to memory of 4900	1700	Factura_Cancelada.exe	msinfo32.exe

C:\Users\Admin\AppData\Local\Temp\Factura_Cancelada.exe
"C:\Users\Admin\AppData\Local\Temp\Factura_Cancelada.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1700

C:\windows\SysWOW64\msinfo32.exe
C:\windows\syswow64\msinfo32.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4900

C:\Users\Admin\AppData\Local\Temp\Factura_Cancelada.exe
C:\Users\Admin\AppData\Local\Temp\Factura_Cancelada.exe ooooooooooooooo
2⤵
PID:968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/968-153-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/968-172-0x0000000000400000-0x0000000000715000-memory.dmp

Filesize
3.1MB

Download
memory/968-170-0x0000000000400000-0x0000000000715000-memory.dmp

Filesize
3.1MB

Download
memory/968-167-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/968-166-0x0000000000400000-0x0000000000715000-memory.dmp

Filesize
3.1MB

Download
memory/1700-152-0x0000000000400000-0x0000000000715000-memory.dmp

Filesize
3.1MB

Download
memory/1700-150-0x0000000000400000-0x0000000000715000-memory.dmp

Filesize
3.1MB

Download
memory/1700-151-0x0000000000400000-0x0000000000715000-memory.dmp

Filesize
3.1MB

Download
memory/1700-181-0x0000000000400000-0x0000000000715000-memory.dmp

Filesize
3.1MB

Download
memory/1700-134-0x0000000000400000-0x0000000000715000-memory.dmp

Filesize
3.1MB

Download
memory/1700-156-0x0000000000400000-0x0000000000715000-memory.dmp

Filesize
3.1MB

Download
memory/1700-135-0x0000000000400000-0x0000000000715000-memory.dmp

Filesize
3.1MB

Download
memory/1700-136-0x0000000000400000-0x0000000000715000-memory.dmp

Filesize
3.1MB

Download
memory/1700-133-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/4900-160-0x0000000013140000-0x0000000013E83000-memory.dmp

Filesize
13.3MB

Download
memory/4900-161-0x0000000013140000-0x0000000013E83000-memory.dmp

Filesize
13.3MB

Download
memory/4900-163-0x0000000013140000-0x0000000013E83000-memory.dmp

Filesize
13.3MB

Download
memory/4900-165-0x0000000013140000-0x0000000013E83000-memory.dmp

Filesize
13.3MB

Download
memory/4900-159-0x0000000013140000-0x0000000013E83000-memory.dmp

Filesize
13.3MB

Download
memory/4900-158-0x0000000013140000-0x0000000013E83000-memory.dmp

Filesize
13.3MB

Download
memory/4900-169-0x0000000013140000-0x0000000013E83000-memory.dmp

Filesize
13.3MB

Download
memory/4900-157-0x0000000013140000-0x0000000013E83000-memory.dmp

Filesize
13.3MB

Download
memory/4900-155-0x0000000013140000-0x0000000013E83000-memory.dmp

Filesize
13.3MB

Download
memory/4900-154-0x0000000013140000-0x0000000013E83000-memory.dmp

Filesize
13.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads