bandook | 7fccc0fd1db4123276163e62b4b152efaebe17228a72e1d91cc0109a61a247be

General

Target

Nuevo_Documento2607.pdf.exe
Size

6.9MB
MD5

c688b50e5b47539ab29e4e748737391a
SHA1

24f9be8db519190abdeb4e211c5be863c31f349d
SHA256

7fccc0fd1db4123276163e62b4b152efaebe17228a72e1d91cc0109a61a247be
SHA512

af672fa317e62e32cd500567910501f00b693549cc7b1d120830b0c7754f3a86df4b435998f14259da268e4a2ea5cc40e324875a4dd3f7399c738360fabb37fd
SSDEEP

49152:YW1L/cM04WxPi0ooPGpFA0k2spoDAffLPnwTaxcKotmQk1s/6wXSsT1pRb/Ce9vK:YW1LkM0v

Score

10^/10

bandook rat trojan upx

Malware Config

Extracted

Family

bandook

C2

185.10.68.52

Signatures

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 14 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2012-175-0x0000000013140000-0x00000000140F0000-memory.dmp	family_bandook
behavioral1/memory/2012-177-0x0000000013140000-0x00000000140F0000-memory.dmp	family_bandook
behavioral1/memory/2012-178-0x0000000013140000-0x00000000140F0000-memory.dmp	family_bandook
behavioral1/memory/2012-179-0x0000000013140000-0x00000000140F0000-memory.dmp	family_bandook
behavioral1/memory/2012-181-0x0000000013140000-0x00000000140F0000-memory.dmp	family_bandook
behavioral1/memory/2012-183-0x0000000013140000-0x00000000140F0000-memory.dmp	family_bandook
behavioral1/memory/2012-187-0x0000000013140000-0x00000000140F0000-memory.dmp	family_bandook
behavioral1/memory/2012-191-0x0000000013140000-0x00000000140F0000-memory.dmp	family_bandook
behavioral1/memory/2012-192-0x0000000013140000-0x00000000140F0000-memory.dmp	family_bandook
behavioral1/memory/2012-193-0x0000000013140000-0x00000000140F0000-memory.dmp	family_bandook
behavioral1/memory/2012-195-0x0000000013140000-0x00000000140F0000-memory.dmp	family_bandook
behavioral1/memory/2012-196-0x0000000013140000-0x00000000140F0000-memory.dmp	family_bandook
behavioral1/memory/2012-198-0x0000000013140000-0x00000000140F0000-memory.dmp	family_bandook
behavioral1/memory/2012-201-0x0000000013140000-0x00000000140F0000-memory.dmp	family_bandook

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2012-172-0x0000000013140000-0x00000000140F0000-memory.dmp	upx
behavioral1/memory/2012-174-0x0000000013140000-0x00000000140F0000-memory.dmp	upx
behavioral1/memory/2012-175-0x0000000013140000-0x00000000140F0000-memory.dmp	upx
behavioral1/memory/2012-176-0x0000000013140000-0x00000000140F0000-memory.dmp	upx
behavioral1/memory/2012-177-0x0000000013140000-0x00000000140F0000-memory.dmp	upx
behavioral1/memory/2012-178-0x0000000013140000-0x00000000140F0000-memory.dmp	upx
behavioral1/memory/2012-179-0x0000000013140000-0x00000000140F0000-memory.dmp	upx
behavioral1/memory/2012-181-0x0000000013140000-0x00000000140F0000-memory.dmp	upx
behavioral1/memory/2012-183-0x0000000013140000-0x00000000140F0000-memory.dmp	upx
behavioral1/memory/2012-187-0x0000000013140000-0x00000000140F0000-memory.dmp	upx
behavioral1/memory/2012-191-0x0000000013140000-0x00000000140F0000-memory.dmp	upx
behavioral1/memory/2012-192-0x0000000013140000-0x00000000140F0000-memory.dmp	upx
behavioral1/memory/2012-193-0x0000000013140000-0x00000000140F0000-memory.dmp	upx
behavioral1/memory/2012-195-0x0000000013140000-0x00000000140F0000-memory.dmp	upx
behavioral1/memory/2012-196-0x0000000013140000-0x00000000140F0000-memory.dmp	upx
behavioral1/memory/2012-198-0x0000000013140000-0x00000000140F0000-memory.dmp	upx
behavioral1/memory/2012-201-0x0000000013140000-0x00000000140F0000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msinfo32.exe

pid process

2012 msinfo32.exe
2012 msinfo32.exe

pid	process
2012	msinfo32.exe
2012	msinfo32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Nuevo_Documento2607.pdf.exe

description	pid	process	target process
PID 4180 wrote to memory of 2012	4180	Nuevo_Documento2607.pdf.exe	msinfo32.exe
PID 4180 wrote to memory of 2012	4180	Nuevo_Documento2607.pdf.exe	msinfo32.exe
PID 4180 wrote to memory of 2012	4180	Nuevo_Documento2607.pdf.exe	msinfo32.exe
PID 4180 wrote to memory of 2860	4180	Nuevo_Documento2607.pdf.exe	Nuevo_Documento2607.pdf.exe
PID 4180 wrote to memory of 2860	4180	Nuevo_Documento2607.pdf.exe	Nuevo_Documento2607.pdf.exe
PID 4180 wrote to memory of 2860	4180	Nuevo_Documento2607.pdf.exe	Nuevo_Documento2607.pdf.exe
PID 4180 wrote to memory of 2012	4180	Nuevo_Documento2607.pdf.exe	msinfo32.exe
PID 4180 wrote to memory of 2012	4180	Nuevo_Documento2607.pdf.exe	msinfo32.exe

C:\Users\Admin\AppData\Local\Temp\Nuevo_Documento2607.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Nuevo_Documento2607.pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4180

C:\windows\SysWOW64\msinfo32.exe
C:\windows\syswow64\msinfo32.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2012

C:\Users\Admin\AppData\Local\Temp\Nuevo_Documento2607.pdf.exe
C:\Users\Admin\AppData\Local\Temp\Nuevo_Documento2607.pdf.exe ooooooooooooooo
2⤵
PID:2860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-187-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/2012-172-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/2012-178-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/2012-177-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/2012-201-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/2012-198-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/2012-196-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/2012-195-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/2012-193-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/2012-181-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/2012-192-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/2012-174-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/2012-175-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/2012-176-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/2012-191-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/2012-183-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/2012-179-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/2860-171-0x0000000002890000-0x0000000002891000-memory.dmp

Filesize
4KB

Download
memory/2860-184-0x0000000000400000-0x0000000000AFB000-memory.dmp

Filesize
7.0MB

Download
memory/2860-186-0x0000000002890000-0x0000000002891000-memory.dmp

Filesize
4KB

Download
memory/2860-202-0x0000000000400000-0x0000000000AFB000-memory.dmp

Filesize
7.0MB

Download
memory/4180-135-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/4180-133-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/4180-173-0x0000000000400000-0x0000000000AFB000-memory.dmp

Filesize
7.0MB

Download
memory/4180-134-0x0000000000400000-0x0000000000AFB000-memory.dmp

Filesize
7.0MB

Download
memory/4180-170-0x0000000000400000-0x0000000000AFB000-memory.dmp

Filesize
7.0MB

Download
memory/4180-169-0x0000000000400000-0x0000000000AFB000-memory.dmp

Filesize
7.0MB

Download
memory/4180-168-0x0000000000400000-0x0000000000AFB000-memory.dmp

Filesize
7.0MB

Download
memory/4180-137-0x0000000000400000-0x0000000000AFB000-memory.dmp

Filesize
7.0MB

Download
memory/4180-136-0x0000000000400000-0x0000000000AFB000-memory.dmp

Filesize
7.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads