Overview

overview

10

Static

static

10

lab6_sampl...a3.exe

windows7-x64

10

lab6_sampl...a3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    lab_case_study_samples.zip

  • Size

    1.2MB

  • Sample

    230709-rtgbdadh4w

  • MD5

    28ae481e49781403c75a1cec101e613a

  • SHA1

    1eb047f9309e917043d7b1644e3b452b65d6fa97

  • SHA256

    d86443a44ce865522f1710be1d779b84b6cf49d04d61d0cbd0ed3e396aea9e02

  • SHA512

    675ebaea3bdc76bf3bf6280f40fa1c8ea39160737fc3d3fd7420eeeac8ecc7adec772d09ef261ce7b0543e25b0c624bcede1468a671453cdb2e330a70dfe8dcb

  • SSDEEP

    24576:HUtyX5bK3fhRCbgWH3RgVAFh/np7V3EC5DGLxJnkX8YMhFTQ8K6a:0IJbK3WkWBgVAF5p7lpiv/M8c

Score
10/10
bandookdarkcometpersistencerattrojan

Malware Config

Extracted

Family

bandook

C2

iamgood.blogdns.net

Targets

    • Target

      lab6_samples/4f1923485e8cdd052467d335a6384f93cd1d50b5d927aea471e56290be29ffa3.exe

    • Size

      977KB

    • MD5

      f000ca9522aafa0c54b863528228a43b

    • SHA1

      c636e88b9e8079ba086f5cdb132fa39e747d0f23

    • SHA256

      4f1923485e8cdd052467d335a6384f93cd1d50b5d927aea471e56290be29ffa3

    • SHA512

      ccbb478d676a3c6f1355ab30933196c5bf41b64b613e8efe661546c238700ce2aec340390af9069c303a43bc7c4f41400c418920041cf4967c6e02b272ef372d

    • SSDEEP

      24576:2ZcgQmXNGZQFXu+pcUKR9ZS2hWN8ow/hvdY/:2ZBgZRZUwJ

    Score
    10/10
    bandookrattrojanpersistence

    • Bandook RAT

      Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

      rattrojanbandook

    • Bandook payload

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks