bandook | 72deb006068fe144f367a21e71a6afa3b02d4fc22f9fb4fec118df97a39dc73f

Analysis

max time kernel
291s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2023 09:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Orden de Compra.exe
Size

3.1MB
MD5

14590acf2f905137fed9a2c963193aa5
SHA1

2babf37152863a1b882fa525d4c8a1510f47c052
SHA256

72deb006068fe144f367a21e71a6afa3b02d4fc22f9fb4fec118df97a39dc73f
SHA512

4f9aabc238d7c5fdcd5919507a9e28e9b25903a7af12d9fbb8f429600ca3f911a19ab9f0a6577732ba0d57acf6072d3c53285e4c01d7a9cd9f3d7ee15e02afac
SSDEEP

49152:nZipCPI498xdzZBxDJYd2cElsX8Okqw2Rt1eRob1:nZw

Score

10^/10

bandook rat trojan upx

Malware Config

Extracted

Family

bandook

deapproved.ru

Signatures

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2192-156-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral2/memory/2192-157-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral2/memory/2192-158-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral2/memory/2192-160-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral2/memory/2192-161-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral2/memory/2192-163-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral2/memory/2192-165-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2192-152-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/2192-153-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/2192-156-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/2192-157-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/2192-158-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/2192-160-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/2192-161-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/2192-163-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral2/memory/2192-165-0x0000000013140000-0x0000000014009000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msinfo32.exe

pid process

2192 msinfo32.exe
2192 msinfo32.exe

pid	process
2192	msinfo32.exe
2192	msinfo32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

Orden de Compra.exe

description	pid	process	target process
PID 2648 wrote to memory of 2192	2648	Orden de Compra.exe	msinfo32.exe
PID 2648 wrote to memory of 2192	2648	Orden de Compra.exe	msinfo32.exe
PID 2648 wrote to memory of 2192	2648	Orden de Compra.exe	msinfo32.exe
PID 2648 wrote to memory of 2192	2648	Orden de Compra.exe	msinfo32.exe
PID 2648 wrote to memory of 2192	2648	Orden de Compra.exe	msinfo32.exe

C:\Users\Admin\AppData\Local\Temp\Orden de Compra.exe
"C:\Users\Admin\AppData\Local\Temp\Orden de Compra.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2648

C:\windows\SysWOW64\msinfo32.exe
C:\windows\syswow64\msinfo32.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2192-158-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/2192-157-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/2192-153-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/2192-156-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/2192-165-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/2192-163-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/2192-161-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/2192-152-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/2192-160-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/2648-150-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/2648-136-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/2648-135-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/2648-133-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/2648-171-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/2648-151-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/2648-134-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/2648-149-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/2648-154-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download