bandook | 21ff46a6fc9173fcc147d7a5c603032c662c6c1f1b05c1bb1e30e20e168bb056

Resubmissions

31-05-2023 19:10

230531-xvh49aaf5v 10

31-05-2023 19:03

230531-xqvmgsad2z 1

Analysis

max time kernel
634s
max time network
622s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2023 19:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Visualizarpdf-print-31052023.exe
Size

4.4MB
MD5

a12d326845a96a03867b2b70ca8f12ee
SHA1

3b1264d2e156a09142847b6a18f70a3267c406e2
SHA256

21ff46a6fc9173fcc147d7a5c603032c662c6c1f1b05c1bb1e30e20e168bb056
SHA512

9fef1a558a6f0ea732f6a0078d2aaf5ca01d347f1a901328d78f420de249eae054074918d792d4a7b08bf92010f9a6797bc5635c649a94f67cea6fc7b175a7b6
SSDEEP

49152:cbVY1yAdICj03tywdG0UhW45SG/kTQGKZE+59eJQIT2TKyP:co

Score

10^/10

bandook rat trojan upx

Malware Config

Signatures

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 8 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3616-174-0x0000000013140000-0x00000000140F3000-memory.dmp	family_bandook
behavioral2/memory/3616-176-0x0000000013140000-0x00000000140F3000-memory.dmp	family_bandook
behavioral2/memory/3616-175-0x0000000013140000-0x00000000140F3000-memory.dmp	family_bandook
behavioral2/memory/3616-177-0x0000000013140000-0x00000000140F3000-memory.dmp	family_bandook
behavioral2/memory/3616-178-0x0000000013140000-0x00000000140F3000-memory.dmp	family_bandook
behavioral2/memory/3616-180-0x0000000013140000-0x00000000140F3000-memory.dmp	family_bandook
behavioral2/memory/3616-182-0x0000000013140000-0x00000000140F3000-memory.dmp	family_bandook
behavioral2/memory/3616-186-0x0000000013140000-0x00000000140F3000-memory.dmp	family_bandook

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3616-172-0x0000000013140000-0x00000000140F3000-memory.dmp	upx
behavioral2/memory/3616-173-0x0000000013140000-0x00000000140F3000-memory.dmp	upx
behavioral2/memory/3616-174-0x0000000013140000-0x00000000140F3000-memory.dmp	upx
behavioral2/memory/3616-176-0x0000000013140000-0x00000000140F3000-memory.dmp	upx
behavioral2/memory/3616-175-0x0000000013140000-0x00000000140F3000-memory.dmp	upx
behavioral2/memory/3616-177-0x0000000013140000-0x00000000140F3000-memory.dmp	upx
behavioral2/memory/3616-178-0x0000000013140000-0x00000000140F3000-memory.dmp	upx
behavioral2/memory/3616-180-0x0000000013140000-0x00000000140F3000-memory.dmp	upx
behavioral2/memory/3616-182-0x0000000013140000-0x00000000140F3000-memory.dmp	upx
behavioral2/memory/3616-186-0x0000000013140000-0x00000000140F3000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msinfo32.exe

pid process

3616 msinfo32.exe
3616 msinfo32.exe

pid	process
3616	msinfo32.exe
3616	msinfo32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Visualizarpdf-print-31052023.exe

description	pid	process	target process
PID 832 wrote to memory of 3616	832	Visualizarpdf-print-31052023.exe	msinfo32.exe
PID 832 wrote to memory of 3616	832	Visualizarpdf-print-31052023.exe	msinfo32.exe
PID 832 wrote to memory of 3616	832	Visualizarpdf-print-31052023.exe	msinfo32.exe
PID 832 wrote to memory of 4880	832	Visualizarpdf-print-31052023.exe	Visualizarpdf-print-31052023.exe
PID 832 wrote to memory of 4880	832	Visualizarpdf-print-31052023.exe	Visualizarpdf-print-31052023.exe
PID 832 wrote to memory of 4880	832	Visualizarpdf-print-31052023.exe	Visualizarpdf-print-31052023.exe
PID 832 wrote to memory of 3616	832	Visualizarpdf-print-31052023.exe	msinfo32.exe
PID 832 wrote to memory of 3616	832	Visualizarpdf-print-31052023.exe	msinfo32.exe

C:\Users\Admin\AppData\Local\Temp\Visualizarpdf-print-31052023.exe
"C:\Users\Admin\AppData\Local\Temp\Visualizarpdf-print-31052023.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:832

C:\windows\SysWOW64\msinfo32.exe
C:\windows\syswow64\msinfo32.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3616

C:\Users\Admin\AppData\Local\Temp\Visualizarpdf-print-31052023.exe
C:\Users\Admin\AppData\Local\Temp\Visualizarpdf-print-31052023.exe ooooooooooooooo
2⤵
PID:4880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/832-133-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/832-134-0x0000000000400000-0x000000000087A000-memory.dmp

Filesize
4.5MB

Download
memory/832-135-0x0000000000400000-0x000000000087A000-memory.dmp

Filesize
4.5MB

Download
memory/832-136-0x0000000000400000-0x000000000087A000-memory.dmp

Filesize
4.5MB

Download
memory/832-137-0x0000000000400000-0x000000000087A000-memory.dmp

Filesize
4.5MB

Download
memory/832-167-0x0000000000400000-0x000000000087A000-memory.dmp

Filesize
4.5MB

Download
memory/832-168-0x0000000000400000-0x000000000087A000-memory.dmp

Filesize
4.5MB

Download
memory/832-169-0x0000000000400000-0x000000000087A000-memory.dmp

Filesize
4.5MB

Download
memory/832-198-0x0000000000400000-0x000000000087A000-memory.dmp

Filesize
4.5MB

Download
memory/832-171-0x0000000000400000-0x000000000087A000-memory.dmp

Filesize
4.5MB

Download
memory/832-183-0x0000000000400000-0x000000000087A000-memory.dmp

Filesize
4.5MB

Download
memory/3616-174-0x0000000013140000-0x00000000140F3000-memory.dmp

Filesize
15.7MB

Download
memory/3616-182-0x0000000013140000-0x00000000140F3000-memory.dmp

Filesize
15.7MB

Download
memory/3616-176-0x0000000013140000-0x00000000140F3000-memory.dmp

Filesize
15.7MB

Download
memory/3616-175-0x0000000013140000-0x00000000140F3000-memory.dmp

Filesize
15.7MB

Download
memory/3616-177-0x0000000013140000-0x00000000140F3000-memory.dmp

Filesize
15.7MB

Download
memory/3616-178-0x0000000013140000-0x00000000140F3000-memory.dmp

Filesize
15.7MB

Download
memory/3616-180-0x0000000013140000-0x00000000140F3000-memory.dmp

Filesize
15.7MB

Download
memory/3616-173-0x0000000013140000-0x00000000140F3000-memory.dmp

Filesize
15.7MB

Download
memory/3616-172-0x0000000013140000-0x00000000140F3000-memory.dmp

Filesize
15.7MB

Download
memory/3616-186-0x0000000013140000-0x00000000140F3000-memory.dmp

Filesize
15.7MB

Download
memory/4880-185-0x0000000000B30000-0x0000000000B31000-memory.dmp

Filesize
4KB

Download
memory/4880-184-0x0000000000400000-0x000000000087A000-memory.dmp

Filesize
4.5MB

Download
memory/4880-190-0x0000000000400000-0x000000000087A000-memory.dmp

Filesize
4.5MB

Download
memory/4880-191-0x0000000000400000-0x000000000087A000-memory.dmp

Filesize
4.5MB

Download
memory/4880-170-0x0000000000B30000-0x0000000000B31000-memory.dmp

Filesize
4KB

Download