bandook | 17c531b0b3371814115d2912b3abc79b03dd15c43269c608a4d762b9b2c643d2

General

Target

archivo_pdf_01062023.exe
Size

4.6MB
MD5

607c9cdde6cff616b220d6057ed04e4d
SHA1

736fefd82f49949a32b5b375eae86507577c7e37
SHA256

17c531b0b3371814115d2912b3abc79b03dd15c43269c608a4d762b9b2c643d2
SHA512

f2bf7ed91ac291224c60f98f1a8efb44542ed514a908dd47599971f6a3598be8e4d04514f1e29d8cf7c57df106f17ceda9897558b0e239648ff13868f05ac328
SSDEEP

49152:MOdxUmMwUZHB1krgCx4PPjU4uy1ZyagpwVDwtQnv9rK9rmP17zJqVN28C:MV

Score

10^/10

bandook rat trojan upx

Malware Config

Signatures

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 7 IoCs

resource	yara_rule
behavioral2/memory/880-174-0x0000000013140000-0x00000000140BC000-memory.dmp	family_bandook
behavioral2/memory/880-175-0x0000000013140000-0x00000000140BC000-memory.dmp	family_bandook
behavioral2/memory/880-176-0x0000000013140000-0x00000000140BC000-memory.dmp	family_bandook
behavioral2/memory/880-178-0x0000000013140000-0x00000000140BC000-memory.dmp	family_bandook
behavioral2/memory/880-179-0x0000000013140000-0x00000000140BC000-memory.dmp	family_bandook
behavioral2/memory/880-181-0x0000000013140000-0x00000000140BC000-memory.dmp	family_bandook
behavioral2/memory/880-185-0x0000000013140000-0x00000000140BC000-memory.dmp	family_bandook

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/880-172-0x0000000013140000-0x00000000140BC000-memory.dmp	upx
behavioral2/memory/880-173-0x0000000013140000-0x00000000140BC000-memory.dmp	upx
behavioral2/memory/880-174-0x0000000013140000-0x00000000140BC000-memory.dmp	upx
behavioral2/memory/880-175-0x0000000013140000-0x00000000140BC000-memory.dmp	upx
behavioral2/memory/880-176-0x0000000013140000-0x00000000140BC000-memory.dmp	upx
behavioral2/memory/880-178-0x0000000013140000-0x00000000140BC000-memory.dmp	upx
behavioral2/memory/880-179-0x0000000013140000-0x00000000140BC000-memory.dmp	upx
behavioral2/memory/880-181-0x0000000013140000-0x00000000140BC000-memory.dmp	upx
behavioral2/memory/880-185-0x0000000013140000-0x00000000140BC000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
880	msinfo32.exe
880	msinfo32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 880	3840	archivo_pdf_01062023.exe	85
PID 3840 wrote to memory of 880	3840	archivo_pdf_01062023.exe	85
PID 3840 wrote to memory of 880	3840	archivo_pdf_01062023.exe	85
PID 3840 wrote to memory of 1340	3840	archivo_pdf_01062023.exe	86
PID 3840 wrote to memory of 1340	3840	archivo_pdf_01062023.exe	86
PID 3840 wrote to memory of 1340	3840	archivo_pdf_01062023.exe	86
PID 3840 wrote to memory of 880	3840	archivo_pdf_01062023.exe	85
PID 3840 wrote to memory of 880	3840	archivo_pdf_01062023.exe	85

C:\Users\Admin\AppData\Local\Temp\archivo_pdf_01062023.exe
"C:\Users\Admin\AppData\Local\Temp\archivo_pdf_01062023.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3840
- C:\windows\SysWOW64\msinfo32.exe
  C:\windows\syswow64\msinfo32.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:880
- C:\Users\Admin\AppData\Local\Temp\archivo_pdf_01062023.exe
  C:\Users\Admin\AppData\Local\Temp\archivo_pdf_01062023.exe ooooooooooooooo
  2⤵
  PID:1340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/880-172-0x0000000013140000-0x00000000140BC000-memory.dmp

Filesize
15.5MB

Download
memory/880-176-0x0000000013140000-0x00000000140BC000-memory.dmp

Filesize
15.5MB

Download
memory/880-175-0x0000000013140000-0x00000000140BC000-memory.dmp

Filesize
15.5MB

Download
memory/880-174-0x0000000013140000-0x00000000140BC000-memory.dmp

Filesize
15.5MB

Download
memory/880-185-0x0000000013140000-0x00000000140BC000-memory.dmp

Filesize
15.5MB

Download
memory/880-173-0x0000000013140000-0x00000000140BC000-memory.dmp

Filesize
15.5MB

Download
memory/880-178-0x0000000013140000-0x00000000140BC000-memory.dmp

Filesize
15.5MB

Download
memory/880-181-0x0000000013140000-0x00000000140BC000-memory.dmp

Filesize
15.5MB

Download
memory/880-179-0x0000000013140000-0x00000000140BC000-memory.dmp

Filesize
15.5MB

Download
memory/1340-183-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/1340-171-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/1340-184-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/1340-187-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/1340-189-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/1340-191-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/3840-168-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/3840-170-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/3840-169-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/3840-182-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/3840-133-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download
memory/3840-167-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/3840-137-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/3840-136-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/3840-135-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/3840-134-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/3840-197-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download

Analysis

Sharing