bandook | 17c531b0b3371814115d2912b3abc79b03dd15c43269c608a4d762b9b2c643d2

General

Target

archivo_pdf_01062023.exe
Size

4.6MB
MD5

607c9cdde6cff616b220d6057ed04e4d
SHA1

736fefd82f49949a32b5b375eae86507577c7e37
SHA256

17c531b0b3371814115d2912b3abc79b03dd15c43269c608a4d762b9b2c643d2
SHA512

f2bf7ed91ac291224c60f98f1a8efb44542ed514a908dd47599971f6a3598be8e4d04514f1e29d8cf7c57df106f17ceda9897558b0e239648ff13868f05ac328
SSDEEP

49152:MOdxUmMwUZHB1krgCx4PPjU4uy1ZyagpwVDwtQnv9rK9rmP17zJqVN28C:MV

Score

10^/10

bandook rat trojan upx

Malware Config

Signatures

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 8 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2040-98-0x0000000013140000-0x00000000140BC000-memory.dmp	family_bandook
behavioral1/memory/2040-100-0x0000000013140000-0x00000000140BC000-memory.dmp	family_bandook
behavioral1/memory/2040-101-0x0000000013140000-0x00000000140BC000-memory.dmp	family_bandook
behavioral1/memory/2040-103-0x0000000013140000-0x00000000140BC000-memory.dmp	family_bandook
behavioral1/memory/2040-102-0x0000000013140000-0x00000000140BC000-memory.dmp	family_bandook
behavioral1/memory/2040-106-0x0000000013140000-0x00000000140BC000-memory.dmp	family_bandook
behavioral1/memory/2040-108-0x0000000013140000-0x00000000140BC000-memory.dmp	family_bandook
behavioral1/memory/2040-112-0x0000000013140000-0x00000000140BC000-memory.dmp	family_bandook

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2040-96-0x0000000013140000-0x00000000140BC000-memory.dmp	upx
behavioral1/memory/2040-97-0x0000000013140000-0x00000000140BC000-memory.dmp	upx
behavioral1/memory/2040-98-0x0000000013140000-0x00000000140BC000-memory.dmp	upx
behavioral1/memory/2040-100-0x0000000013140000-0x00000000140BC000-memory.dmp	upx
behavioral1/memory/2040-101-0x0000000013140000-0x00000000140BC000-memory.dmp	upx
behavioral1/memory/2040-103-0x0000000013140000-0x00000000140BC000-memory.dmp	upx
behavioral1/memory/2040-102-0x0000000013140000-0x00000000140BC000-memory.dmp	upx
behavioral1/memory/2040-106-0x0000000013140000-0x00000000140BC000-memory.dmp	upx
behavioral1/memory/2040-108-0x0000000013140000-0x00000000140BC000-memory.dmp	upx
behavioral1/memory/2040-112-0x0000000013140000-0x00000000140BC000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

msinfo32.exe

pid process

2040 msinfo32.exe

pid	process
2040	msinfo32.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

archivo_pdf_01062023.exe

description	pid	process	target process
PID 1520 wrote to memory of 2040	1520	archivo_pdf_01062023.exe	msinfo32.exe
PID 1520 wrote to memory of 2040	1520	archivo_pdf_01062023.exe	msinfo32.exe
PID 1520 wrote to memory of 2040	1520	archivo_pdf_01062023.exe	msinfo32.exe
PID 1520 wrote to memory of 2040	1520	archivo_pdf_01062023.exe	msinfo32.exe
PID 1520 wrote to memory of 584	1520	archivo_pdf_01062023.exe	archivo_pdf_01062023.exe
PID 1520 wrote to memory of 584	1520	archivo_pdf_01062023.exe	archivo_pdf_01062023.exe
PID 1520 wrote to memory of 584	1520	archivo_pdf_01062023.exe	archivo_pdf_01062023.exe
PID 1520 wrote to memory of 584	1520	archivo_pdf_01062023.exe	archivo_pdf_01062023.exe
PID 1520 wrote to memory of 2040	1520	archivo_pdf_01062023.exe	msinfo32.exe
PID 1520 wrote to memory of 2040	1520	archivo_pdf_01062023.exe	msinfo32.exe

C:\Users\Admin\AppData\Local\Temp\archivo_pdf_01062023.exe
"C:\Users\Admin\AppData\Local\Temp\archivo_pdf_01062023.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1520

C:\windows\syswow64\msinfo32.exe
C:\windows\syswow64\msinfo32.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2040

C:\Users\Admin\AppData\Local\Temp\archivo_pdf_01062023.exe
C:\Users\Admin\AppData\Local\Temp\archivo_pdf_01062023.exe ooooooooooooooo
2⤵
PID:584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/584-107-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/584-110-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/584-114-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/584-116-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/584-93-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1520-90-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/1520-89-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/1520-91-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/1520-59-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/1520-123-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/1520-58-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/1520-56-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1520-54-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1520-55-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/1520-99-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/2040-97-0x0000000013140000-0x00000000140BC000-memory.dmp

Filesize
15.5MB

Download
memory/2040-101-0x0000000013140000-0x00000000140BC000-memory.dmp

Filesize
15.5MB

Download
memory/2040-103-0x0000000013140000-0x00000000140BC000-memory.dmp

Filesize
15.5MB

Download
memory/2040-102-0x0000000013140000-0x00000000140BC000-memory.dmp

Filesize
15.5MB

Download
memory/2040-106-0x0000000013140000-0x00000000140BC000-memory.dmp

Filesize
15.5MB

Download
memory/2040-100-0x0000000013140000-0x00000000140BC000-memory.dmp

Filesize
15.5MB

Download
memory/2040-108-0x0000000013140000-0x00000000140BC000-memory.dmp

Filesize
15.5MB

Download
memory/2040-98-0x0000000013140000-0x00000000140BC000-memory.dmp

Filesize
15.5MB

Download
memory/2040-112-0x0000000013140000-0x00000000140BC000-memory.dmp

Filesize
15.5MB

Download
memory/2040-96-0x0000000013140000-0x00000000140BC000-memory.dmp

Filesize
15.5MB

Download
memory/2040-95-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2040-94-0x0000000013140000-0x00000000140BC000-memory.dmp

Filesize
15.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads