bandook | fb521224b8f13c2b78ea81eb741812b9729d74674c82e461e4190036ae01e7fb

General

Target

DOCUMENTO_ARCHIVO1/PRINTDOC-09052023.exe
Size

3.8MB
MD5

d44f2a8d0135955203cf3547a1a311dd
SHA1

f8b2d00e6197e2aebe599534ae514b096673e6d0
SHA256

592f1fe8188a4288f03a30216df82180e75859191e0b7f9bc52df578d95c7dcd
SHA512

f5c1e97c069a7c6dce5177ce287707752d40d47b13379516fbcd1fade3d33af09fcbba8283b5e98290a318afa1ddb4ad706e361a1d1d71a6844b6f4281df3feb
SSDEEP

49152:zbVyaPRR0w9TpccGbyIVNYSa3QYHuUerbRnzZuJ0Zamp:zU7

Score

10^/10

bandook rat trojan upx

Malware Config

Extracted

Family

bandook

C2

gombos.ru

Signatures

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 6 IoCs

resource	yara_rule
behavioral1/memory/632-81-0x0000000013140000-0x0000000014197000-memory.dmp	family_bandook
behavioral1/memory/632-85-0x0000000013140000-0x0000000014197000-memory.dmp	family_bandook
behavioral1/memory/632-86-0x0000000013140000-0x0000000014197000-memory.dmp	family_bandook
behavioral1/memory/632-87-0x0000000013140000-0x0000000014197000-memory.dmp	family_bandook
behavioral1/memory/632-89-0x0000000013140000-0x0000000014197000-memory.dmp	family_bandook
behavioral1/memory/632-92-0x0000000013140000-0x0000000014197000-memory.dmp	family_bandook

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/632-79-0x0000000013140000-0x0000000014197000-memory.dmp	upx
behavioral1/memory/632-80-0x0000000013140000-0x0000000014197000-memory.dmp	upx
behavioral1/memory/632-81-0x0000000013140000-0x0000000014197000-memory.dmp	upx
behavioral1/memory/632-85-0x0000000013140000-0x0000000014197000-memory.dmp	upx
behavioral1/memory/632-86-0x0000000013140000-0x0000000014197000-memory.dmp	upx
behavioral1/memory/632-87-0x0000000013140000-0x0000000014197000-memory.dmp	upx
behavioral1/memory/632-89-0x0000000013140000-0x0000000014197000-memory.dmp	upx
behavioral1/memory/632-92-0x0000000013140000-0x0000000014197000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
632	msinfo32.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 632	884	PRINTDOC-09052023.exe	26
PID 884 wrote to memory of 632	884	PRINTDOC-09052023.exe	26
PID 884 wrote to memory of 632	884	PRINTDOC-09052023.exe	26
PID 884 wrote to memory of 632	884	PRINTDOC-09052023.exe	26
PID 884 wrote to memory of 556	884	PRINTDOC-09052023.exe	27
PID 884 wrote to memory of 556	884	PRINTDOC-09052023.exe	27
PID 884 wrote to memory of 556	884	PRINTDOC-09052023.exe	27
PID 884 wrote to memory of 556	884	PRINTDOC-09052023.exe	27
PID 884 wrote to memory of 632	884	PRINTDOC-09052023.exe	26
PID 884 wrote to memory of 632	884	PRINTDOC-09052023.exe	26

C:\Users\Admin\AppData\Local\Temp\DOCUMENTO_ARCHIVO1\PRINTDOC-09052023.exe
"C:\Users\Admin\AppData\Local\Temp\DOCUMENTO_ARCHIVO1\PRINTDOC-09052023.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:884
- C:\windows\syswow64\msinfo32.exe
  C:\windows\syswow64\msinfo32.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:632
- C:\Users\Admin\AppData\Local\Temp\DOCUMENTO_ARCHIVO1\PRINTDOC-09052023.exe
  C:\Users\Admin\AppData\Local\Temp\DOCUMENTO_ARCHIVO1\PRINTDOC-09052023.exe ooooooooooooooo
  2⤵
  PID:556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/556-76-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/556-97-0x0000000000400000-0x00000000007D2000-memory.dmp

Filesize
3.8MB

Download
memory/556-95-0x0000000000400000-0x00000000007D2000-memory.dmp

Filesize
3.8MB

Download
memory/556-84-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/556-83-0x0000000000400000-0x00000000007D2000-memory.dmp

Filesize
3.8MB

Download
memory/632-85-0x0000000013140000-0x0000000014197000-memory.dmp

Filesize
16.3MB

Download
memory/632-89-0x0000000013140000-0x0000000014197000-memory.dmp

Filesize
16.3MB

Download
memory/632-92-0x0000000013140000-0x0000000014197000-memory.dmp

Filesize
16.3MB

Download
memory/632-87-0x0000000013140000-0x0000000014197000-memory.dmp

Filesize
16.3MB

Download
memory/632-86-0x0000000013140000-0x0000000014197000-memory.dmp

Filesize
16.3MB

Download
memory/632-77-0x0000000013140000-0x0000000014197000-memory.dmp

Filesize
16.3MB

Download
memory/632-78-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/632-79-0x0000000013140000-0x0000000014197000-memory.dmp

Filesize
16.3MB

Download
memory/632-80-0x0000000013140000-0x0000000014197000-memory.dmp

Filesize
16.3MB

Download
memory/632-81-0x0000000013140000-0x0000000014197000-memory.dmp

Filesize
16.3MB

Download
memory/884-82-0x0000000000400000-0x00000000007D2000-memory.dmp

Filesize
3.8MB

Download
memory/884-58-0x0000000000400000-0x00000000007D2000-memory.dmp

Filesize
3.8MB

Download
memory/884-57-0x0000000000400000-0x00000000007D2000-memory.dmp

Filesize
3.8MB

Download
memory/884-54-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/884-59-0x0000000000400000-0x00000000007D2000-memory.dmp

Filesize
3.8MB

Download
memory/884-74-0x0000000000400000-0x00000000007D2000-memory.dmp

Filesize
3.8MB

Download
memory/884-72-0x0000000000400000-0x00000000007D2000-memory.dmp

Filesize
3.8MB

Download
memory/884-73-0x0000000000400000-0x00000000007D2000-memory.dmp

Filesize
3.8MB

Download
memory/884-56-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/884-55-0x0000000000400000-0x00000000007D2000-memory.dmp

Filesize
3.8MB

Download
memory/884-104-0x0000000000400000-0x00000000007D2000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing