bandook | 60eecb884a1b16f80657569edf121d6a8f489081befae1ecd1d26e9233e58104

Analysis

max time kernel
301s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2023 09:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

COTIZACION SOLICITADA_22D3.exe
Size

1.6MB
MD5

fd9fb71a9a3f389a73c9b2b6d2060021
SHA1

c57eca88d6d8ad1523f2b86a720c6f70a7d9766c
SHA256

60eecb884a1b16f80657569edf121d6a8f489081befae1ecd1d26e9233e58104
SHA512

872b5c5a02ad773a2062fa7bb48de1bcf82bccfa12c2fb11c348097fb79428a394467cf134da525274e32bcdae9c85512fd88d49b8a7dac33da19da3b6b44486
SSDEEP

24576:RuBHAm0A536Omg122tsK8Tz4aoURxqiaDQF6KljwbGRNW0x4GSWmo3E6c3mNC1ly:Ru9P/ghxxqjSZljPVmo4sGo

Score

10^/10

bandook rat trojan upx

Malware Config

Extracted

Family

bandook

deapproved.ru

Signatures

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3836-155-0x0000000013140000-0x0000000013C7D000-memory.dmp	family_bandook
behavioral2/memory/3836-156-0x0000000013140000-0x0000000013C7D000-memory.dmp	family_bandook
behavioral2/memory/3836-157-0x0000000013140000-0x0000000013C7D000-memory.dmp	family_bandook
behavioral2/memory/3836-158-0x0000000013140000-0x0000000013C7D000-memory.dmp	family_bandook
behavioral2/memory/3836-160-0x0000000013140000-0x0000000013C7D000-memory.dmp	family_bandook
behavioral2/memory/3836-162-0x0000000013140000-0x0000000013C7D000-memory.dmp	family_bandook
behavioral2/memory/3836-164-0x0000000013140000-0x0000000013C7D000-memory.dmp	family_bandook

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3836-153-0x0000000013140000-0x0000000013C7D000-memory.dmp	upx
behavioral2/memory/3836-154-0x0000000013140000-0x0000000013C7D000-memory.dmp	upx
behavioral2/memory/3836-155-0x0000000013140000-0x0000000013C7D000-memory.dmp	upx
behavioral2/memory/3836-156-0x0000000013140000-0x0000000013C7D000-memory.dmp	upx
behavioral2/memory/3836-157-0x0000000013140000-0x0000000013C7D000-memory.dmp	upx
behavioral2/memory/3836-158-0x0000000013140000-0x0000000013C7D000-memory.dmp	upx
behavioral2/memory/3836-160-0x0000000013140000-0x0000000013C7D000-memory.dmp	upx
behavioral2/memory/3836-162-0x0000000013140000-0x0000000013C7D000-memory.dmp	upx
behavioral2/memory/3836-164-0x0000000013140000-0x0000000013C7D000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msinfo32.exe

pid process

3836 msinfo32.exe
3836 msinfo32.exe

pid	process
3836	msinfo32.exe
3836	msinfo32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

COTIZACION SOLICITADA_22D3.exe

description	pid	process	target process
PID 4260 wrote to memory of 3836	4260	COTIZACION SOLICITADA_22D3.exe	msinfo32.exe
PID 4260 wrote to memory of 3836	4260	COTIZACION SOLICITADA_22D3.exe	msinfo32.exe
PID 4260 wrote to memory of 3836	4260	COTIZACION SOLICITADA_22D3.exe	msinfo32.exe
PID 4260 wrote to memory of 3836	4260	COTIZACION SOLICITADA_22D3.exe	msinfo32.exe
PID 4260 wrote to memory of 3836	4260	COTIZACION SOLICITADA_22D3.exe	msinfo32.exe

C:\Users\Admin\AppData\Local\Temp\COTIZACION SOLICITADA_22D3.exe
"C:\Users\Admin\AppData\Local\Temp\COTIZACION SOLICITADA_22D3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4260

C:\windows\SysWOW64\msinfo32.exe
C:\windows\syswow64\msinfo32.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3836-160-0x0000000013140000-0x0000000013C7D000-memory.dmp

Filesize
11.2MB

Download
memory/3836-155-0x0000000013140000-0x0000000013C7D000-memory.dmp

Filesize
11.2MB

Download
memory/3836-164-0x0000000013140000-0x0000000013C7D000-memory.dmp

Filesize
11.2MB

Download
memory/3836-153-0x0000000013140000-0x0000000013C7D000-memory.dmp

Filesize
11.2MB

Download
memory/3836-162-0x0000000013140000-0x0000000013C7D000-memory.dmp

Filesize
11.2MB

Download
memory/3836-158-0x0000000013140000-0x0000000013C7D000-memory.dmp

Filesize
11.2MB

Download
memory/3836-157-0x0000000013140000-0x0000000013C7D000-memory.dmp

Filesize
11.2MB

Download
memory/3836-154-0x0000000013140000-0x0000000013C7D000-memory.dmp

Filesize
11.2MB

Download
memory/3836-156-0x0000000013140000-0x0000000013C7D000-memory.dmp

Filesize
11.2MB

Download
memory/4260-149-0x0000000000400000-0x00000000005A0000-memory.dmp

Filesize
1.6MB

Download
memory/4260-151-0x0000000000400000-0x00000000005A0000-memory.dmp

Filesize
1.6MB

Download
memory/4260-163-0x0000000000400000-0x00000000005A0000-memory.dmp

Filesize
1.6MB

Download
memory/4260-170-0x0000000000400000-0x00000000005A0000-memory.dmp

Filesize
1.6MB

Download
memory/4260-150-0x0000000000400000-0x00000000005A0000-memory.dmp

Filesize
1.6MB

Download
memory/4260-134-0x0000000000400000-0x00000000005A0000-memory.dmp

Filesize
1.6MB

Download
memory/4260-133-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/4260-137-0x0000000000400000-0x00000000005A0000-memory.dmp

Filesize
1.6MB

Download
memory/4260-136-0x0000000000400000-0x00000000005A0000-memory.dmp

Filesize
1.6MB

Download
memory/4260-135-0x0000000000400000-0x00000000005A0000-memory.dmp

Filesize
1.6MB

Download
memory/4260-152-0x0000000000400000-0x00000000005A0000-memory.dmp

Filesize
1.6MB

Download