Analysis
- max time kernel
595s - max time network
594s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
09/10/2023, 10:02
General
- Target Fact_#00256.exe
- Size 12.2MB
- Sample231009-l2sfqaeb92
- SHA256 e56da3db578d96a9d94752ee80539b1a3aaea4b0305892aa4a5fab74dbbeb6f8
Malware Config
Extracted
-
bandook
-
45.67.34.219
Signatures
- Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
- Bandook payload 7 IoCs
- UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fact_#00256.exe"C:\Users\Admin\AppData\Local\Temp\Fact_#00256.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\msinfo32.exeC:\windows\syswow64\msinfo32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Fact_#00256.exeC:\Users\Admin\AppData\Local\Temp\Fact_#00256.exe ooooooooooooooo2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1356-49-0x0000000013140000-0x000000001496C000-memory.dmp
memory/1356-40-0x0000000013140000-0x000000001496C000-memory.dmp
memory/1356-57-0x0000000013140000-0x000000001496C000-memory.dmp
memory/1356-42-0x0000000013140000-0x000000001496C000-memory.dmp
memory/1356-51-0x0000000013140000-0x000000001496C000-memory.dmp
memory/1356-47-0x0000000013140000-0x000000001496C000-memory.dmp
memory/1356-46-0x0000000013140000-0x000000001496C000-memory.dmp
memory/1356-45-0x0000000013140000-0x000000001496C000-memory.dmp
memory/1356-43-0x0000000013140000-0x000000001496C000-memory.dmp
memory/1356-41-0x0000000013140000-0x000000001496C000-memory.dmp
memory/1736-55-0x0000000002CE0000-0x0000000002CE1000-memory.dmp
memory/1736-52-0x0000000000400000-0x000000000103C000-memory.dmp
memory/1736-60-0x0000000000400000-0x000000000103C000-memory.dmp
memory/1736-54-0x0000000000400000-0x000000000103C000-memory.dmp
memory/1736-39-0x0000000002CE0000-0x0000000002CE1000-memory.dmp
memory/2608-0-0x0000000002EE0000-0x0000000002EE1000-memory.dmp
memory/2608-35-0x0000000000400000-0x000000000103C000-memory.dmp
memory/2608-5-0x0000000000400000-0x000000000103C000-memory.dmp
memory/2608-44-0x0000000000400000-0x000000000103C000-memory.dmp
memory/2608-4-0x0000000000400000-0x000000000103C000-memory.dmp
memory/2608-36-0x0000000000400000-0x000000000103C000-memory.dmp
memory/2608-37-0x0000000000400000-0x000000000103C000-memory.dmp
memory/2608-3-0x0000000000400000-0x000000000103C000-memory.dmp
memory/2608-2-0x0000000002EE0000-0x0000000002EE1000-memory.dmp
memory/2608-1-0x0000000000400000-0x000000000103C000-memory.dmp
memory/2608-67-0x0000000000400000-0x000000000103C000-memory.dmp