bandook | 01e8536751080ea135c3ad7ae9187d06cdcccddfc89bc0d41ea4281eeb3e9fb4

Analysis

max time kernel
301s
max time network
293s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
30-04-2023 08:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Solicitud de comprá.exe
Size

4.6MB
MD5

a2ea38d11bde2a4483b86321960d6319
SHA1

5240860d0db91bd8e13a150676a3ab1917312c59
SHA256

01e8536751080ea135c3ad7ae9187d06cdcccddfc89bc0d41ea4281eeb3e9fb4
SHA512

dcc9fb12e4375e694018c9fbaa5278c52f04aa713813dc835358fbedca3e10dc40e50f67030be18555030b5d058a002ad0fcf8d28e3a3c1615d1ee9aca14a780
SSDEEP

49152:klZfI2n9zXRNr9SvEgJAWu+5pJzznwclykqoug5FrGysQBlDQrV9a98nTnUkcNVJ:klZQiRWuwpb

Score

10^/10

bandook rat trojan upx

Malware Config

Extracted

Family

bandook

gombos.ru

Signatures

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/716-155-0x0000000013140000-0x000000001400A000-memory.dmp	family_bandook
behavioral2/memory/716-156-0x0000000013140000-0x000000001400A000-memory.dmp	family_bandook
behavioral2/memory/716-157-0x0000000013140000-0x000000001400A000-memory.dmp	family_bandook
behavioral2/memory/716-158-0x0000000013140000-0x000000001400A000-memory.dmp	family_bandook
behavioral2/memory/716-160-0x0000000013140000-0x000000001400A000-memory.dmp	family_bandook
behavioral2/memory/716-162-0x0000000013140000-0x000000001400A000-memory.dmp	family_bandook
behavioral2/memory/716-164-0x0000000013140000-0x000000001400A000-memory.dmp	family_bandook

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/716-152-0x0000000013140000-0x000000001400A000-memory.dmp	upx
behavioral2/memory/716-153-0x0000000013140000-0x000000001400A000-memory.dmp	upx
behavioral2/memory/716-155-0x0000000013140000-0x000000001400A000-memory.dmp	upx
behavioral2/memory/716-156-0x0000000013140000-0x000000001400A000-memory.dmp	upx
behavioral2/memory/716-157-0x0000000013140000-0x000000001400A000-memory.dmp	upx
behavioral2/memory/716-158-0x0000000013140000-0x000000001400A000-memory.dmp	upx
behavioral2/memory/716-160-0x0000000013140000-0x000000001400A000-memory.dmp	upx
behavioral2/memory/716-162-0x0000000013140000-0x000000001400A000-memory.dmp	upx
behavioral2/memory/716-164-0x0000000013140000-0x000000001400A000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msinfo32.exe

pid process

716 msinfo32.exe
716 msinfo32.exe

pid	process
716	msinfo32.exe
716	msinfo32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

Solicitud de comprá.exe

description	pid	process	target process
PID 2220 wrote to memory of 716	2220	Solicitud de comprá.exe	msinfo32.exe
PID 2220 wrote to memory of 716	2220	Solicitud de comprá.exe	msinfo32.exe
PID 2220 wrote to memory of 716	2220	Solicitud de comprá.exe	msinfo32.exe
PID 2220 wrote to memory of 716	2220	Solicitud de comprá.exe	msinfo32.exe
PID 2220 wrote to memory of 716	2220	Solicitud de comprá.exe	msinfo32.exe

C:\Users\Admin\AppData\Local\Temp\Solicitud de comprá.exe
"C:\Users\Admin\AppData\Local\Temp\Solicitud de comprá.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220

C:\windows\SysWOW64\msinfo32.exe
C:\windows\syswow64\msinfo32.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/716-157-0x0000000013140000-0x000000001400A000-memory.dmp

Filesize
14.8MB

Download
memory/716-156-0x0000000013140000-0x000000001400A000-memory.dmp

Filesize
14.8MB

Download
memory/716-153-0x0000000013140000-0x000000001400A000-memory.dmp

Filesize
14.8MB

Download
memory/716-155-0x0000000013140000-0x000000001400A000-memory.dmp

Filesize
14.8MB

Download
memory/716-164-0x0000000013140000-0x000000001400A000-memory.dmp

Filesize
14.8MB

Download
memory/716-162-0x0000000013140000-0x000000001400A000-memory.dmp

Filesize
14.8MB

Download
memory/716-160-0x0000000013140000-0x000000001400A000-memory.dmp

Filesize
14.8MB

Download
memory/716-152-0x0000000013140000-0x000000001400A000-memory.dmp

Filesize
14.8MB

Download
memory/716-158-0x0000000013140000-0x000000001400A000-memory.dmp

Filesize
14.8MB

Download
memory/2220-150-0x0000000000400000-0x00000000008A2000-memory.dmp

Filesize
4.6MB

Download
memory/2220-137-0x0000000000400000-0x00000000008A2000-memory.dmp

Filesize
4.6MB

Download
memory/2220-136-0x0000000000400000-0x00000000008A2000-memory.dmp

Filesize
4.6MB

Download
memory/2220-133-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/2220-170-0x0000000000400000-0x00000000008A2000-memory.dmp

Filesize
4.6MB

Download
memory/2220-151-0x0000000000400000-0x00000000008A2000-memory.dmp

Filesize
4.6MB

Download
memory/2220-134-0x0000000000400000-0x00000000008A2000-memory.dmp

Filesize
4.6MB

Download
memory/2220-149-0x0000000000400000-0x00000000008A2000-memory.dmp

Filesize
4.6MB

Download
memory/2220-154-0x0000000000400000-0x00000000008A2000-memory.dmp

Filesize
4.6MB

Download