bandook | e56da3db578d96a9d94752ee80539b1a3aaea4b0305892aa4a5fab74dbbeb6f8

General

Target

Fact_#00256.exe
Size

12.2MB
MD5

0ed92b3833c659a68be6a3a2f03ddcd1
SHA1

8ebaadf8fa61d0df070c13a27bc269b1b2f20e92
SHA256

e56da3db578d96a9d94752ee80539b1a3aaea4b0305892aa4a5fab74dbbeb6f8
SHA512

fa67dfc9c7a4a1ccbdc9a08ef40399146d5f735e708aa4392aa0a88cec3cb38927b34bd1f9796bd4928fc7674004d27b29e6a3e8281de1612dede8fe6cd89dd2
SSDEEP

49152:5F3eFJ17qhl7Mrpuo/skg2O144bQVcPNA/za2nIVAHSfq2vt9cXYWh1nV5sF5ov8:5FuFJp

Score

10^/10

bandook rat trojan upx

Malware Config

Extracted

Family

bandook

C2

45.67.34.219

Signatures

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 7 IoCs

resource	yara_rule
behavioral2/memory/1356-42-0x0000000013140000-0x000000001496C000-memory.dmp	family_bandook
behavioral2/memory/1356-45-0x0000000013140000-0x000000001496C000-memory.dmp	family_bandook
behavioral2/memory/1356-46-0x0000000013140000-0x000000001496C000-memory.dmp	family_bandook
behavioral2/memory/1356-47-0x0000000013140000-0x000000001496C000-memory.dmp	family_bandook
behavioral2/memory/1356-49-0x0000000013140000-0x000000001496C000-memory.dmp	family_bandook
behavioral2/memory/1356-51-0x0000000013140000-0x000000001496C000-memory.dmp	family_bandook
behavioral2/memory/1356-57-0x0000000013140000-0x000000001496C000-memory.dmp	family_bandook

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1356-40-0x0000000013140000-0x000000001496C000-memory.dmp	upx
behavioral2/memory/1356-41-0x0000000013140000-0x000000001496C000-memory.dmp	upx
behavioral2/memory/1356-43-0x0000000013140000-0x000000001496C000-memory.dmp	upx
behavioral2/memory/1356-42-0x0000000013140000-0x000000001496C000-memory.dmp	upx
behavioral2/memory/1356-45-0x0000000013140000-0x000000001496C000-memory.dmp	upx
behavioral2/memory/1356-46-0x0000000013140000-0x000000001496C000-memory.dmp	upx
behavioral2/memory/1356-47-0x0000000013140000-0x000000001496C000-memory.dmp	upx
behavioral2/memory/1356-49-0x0000000013140000-0x000000001496C000-memory.dmp	upx
behavioral2/memory/1356-51-0x0000000013140000-0x000000001496C000-memory.dmp	upx
behavioral2/memory/1356-57-0x0000000013140000-0x000000001496C000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1356	msinfo32.exe
1356	msinfo32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 1356	2608	Fact_#00256.exe	110
PID 2608 wrote to memory of 1356	2608	Fact_#00256.exe	110
PID 2608 wrote to memory of 1356	2608	Fact_#00256.exe	110
PID 2608 wrote to memory of 1736	2608	Fact_#00256.exe	111
PID 2608 wrote to memory of 1736	2608	Fact_#00256.exe	111
PID 2608 wrote to memory of 1736	2608	Fact_#00256.exe	111
PID 2608 wrote to memory of 1356	2608	Fact_#00256.exe	110
PID 2608 wrote to memory of 1356	2608	Fact_#00256.exe	110

C:\Users\Admin\AppData\Local\Temp\Fact_#00256.exe
"C:\Users\Admin\AppData\Local\Temp\Fact_#00256.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2608
- C:\windows\SysWOW64\msinfo32.exe
  C:\windows\syswow64\msinfo32.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1356
- C:\Users\Admin\AppData\Local\Temp\Fact_#00256.exe
  C:\Users\Admin\AppData\Local\Temp\Fact_#00256.exe ooooooooooooooo
  2⤵
  PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1356-49-0x0000000013140000-0x000000001496C000-memory.dmp

Filesize
24.2MB

Download
memory/1356-40-0x0000000013140000-0x000000001496C000-memory.dmp

Filesize
24.2MB

Download
memory/1356-42-0x0000000013140000-0x000000001496C000-memory.dmp

Filesize
24.2MB

Download
memory/1356-43-0x0000000013140000-0x000000001496C000-memory.dmp

Filesize
24.2MB

Download
memory/1356-45-0x0000000013140000-0x000000001496C000-memory.dmp

Filesize
24.2MB

Download
memory/1356-57-0x0000000013140000-0x000000001496C000-memory.dmp

Filesize
24.2MB

Download
memory/1356-46-0x0000000013140000-0x000000001496C000-memory.dmp

Filesize
24.2MB

Download
memory/1356-47-0x0000000013140000-0x000000001496C000-memory.dmp

Filesize
24.2MB

Download
memory/1356-51-0x0000000013140000-0x000000001496C000-memory.dmp

Filesize
24.2MB

Download
memory/1356-41-0x0000000013140000-0x000000001496C000-memory.dmp

Filesize
24.2MB

Download
memory/1736-60-0x0000000000400000-0x000000000103C000-memory.dmp

Filesize
12.2MB

Download
memory/1736-39-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

Filesize
4KB

Download
memory/1736-52-0x0000000000400000-0x000000000103C000-memory.dmp

Filesize
12.2MB

Download
memory/1736-54-0x0000000000400000-0x000000000103C000-memory.dmp

Filesize
12.2MB

Download
memory/1736-55-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

Filesize
4KB

Download
memory/2608-36-0x0000000000400000-0x000000000103C000-memory.dmp

Filesize
12.2MB

Download
memory/2608-3-0x0000000000400000-0x000000000103C000-memory.dmp

Filesize
12.2MB

Download
memory/2608-2-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

Filesize
4KB

Download
memory/2608-0-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

Filesize
4KB

Download
memory/2608-67-0x0000000000400000-0x000000000103C000-memory.dmp

Filesize
12.2MB

Download
memory/2608-37-0x0000000000400000-0x000000000103C000-memory.dmp

Filesize
12.2MB

Download
memory/2608-1-0x0000000000400000-0x000000000103C000-memory.dmp

Filesize
12.2MB

Download
memory/2608-35-0x0000000000400000-0x000000000103C000-memory.dmp

Filesize
12.2MB

Download
memory/2608-5-0x0000000000400000-0x000000000103C000-memory.dmp

Filesize
12.2MB

Download
memory/2608-4-0x0000000000400000-0x000000000103C000-memory.dmp

Filesize
12.2MB

Download
memory/2608-44-0x0000000000400000-0x000000000103C000-memory.dmp

Filesize
12.2MB

Download

Analysis

Sharing