ffaa6ae5e499945093a6fe2a7a05504f8796127cd6f4de239b47a7e86715214c

Analysis

max time kernel
123s
max time network
159s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-02-2024 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SampDroid.exe
Size

120.4MB
MD5

8a4318c2a9f52f8bf99a62a4220d895f
SHA1

570a8978c012a390da251ef3d76dfd7364fdd18e
SHA256

2a91ed841fcf2c720c33f3fdbd10bd53adf3bdfc2e69f0dd96b1fd45a2ef5350
SHA512

7788ae81f663f8586515e9b3210e8bb2b5abcc6d0e31a359f7a751d9846b033ac58fdc2cb4e05c72475ae12d2870e3b0e29d8414f3618dcde0097be0ccc26fa8
SSDEEP

1572864:m1f0+Sva7Hdp1Nhn+aCdrvdYrZ/7/lbg8udR8SnuSE49z:basulbg8yTnbEOz

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SampDroid.exeSampDroid.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Control Panel\International\Geo\Nation	SampDroid.exe
Key value queried	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Control Panel\International\Geo\Nation	SampDroid.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

SampDroid.exeSampDroid.exeSampDroid.exe

pid process

2560 SampDroid.exe
2544 SampDroid.exe
2868 SampDroid.exe
2868 SampDroid.exe

pid	process
2560	SampDroid.exe
2544	SampDroid.exe
2868	SampDroid.exe
2868	SampDroid.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

SampDroid.exe

description	pid	process	target process
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2840	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2560	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2560	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2560	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2544	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2544	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2544	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2184	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2184	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2184	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2184	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2184	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2184	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2184	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2184	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2184	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2184	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2184	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2184	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2184	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2184	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2184	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2184	2868	SampDroid.exe	SampDroid.exe
PID 2868 wrote to memory of 2184	2868	SampDroid.exe	SampDroid.exe

C:\Users\Admin\AppData\Local\Temp\SampDroid.exe
"C:\Users\Admin\AppData\Local\Temp\SampDroid.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2868

C:\Users\Admin\AppData\Local\Temp\SampDroid.exe
"C:\Users\Admin\AppData\Local\Temp\SampDroid.exe" --type=gpu-process --field-trial-handle=1008,11260794646139359116,10185477156220366414,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1016 /prefetch:2
2⤵
PID:2840

C:\Users\Admin\AppData\Local\Temp\SampDroid.exe
"C:\Users\Admin\AppData\Local\Temp\SampDroid.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1008,11260794646139359116,10185477156220366414,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1296 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2560

C:\Users\Admin\AppData\Local\Temp\SampDroid.exe
"C:\Users\Admin\AppData\Local\Temp\SampDroid.exe" --type=renderer --field-trial-handle=1008,11260794646139359116,10185477156220366414,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --node-integration --no-sandbox --no-zygote --enable-remote-module --background-color=#fff --enable-spellcheck --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1468 /prefetch:1
2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:2544

C:\Users\Admin\AppData\Local\Temp\SampDroid.exe
"C:\Users\Admin\AppData\Local\Temp\SampDroid.exe" --type=gpu-process --field-trial-handle=1008,11260794646139359116,10185477156220366414,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1016 /prefetch:2
2⤵
PID:2184

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2840-1-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/2840-33-0x0000000077BE0000-0x0000000077BE1000-memory.dmp

Filesize
4KB

Download
memory/2868-37-0x00000000029F0000-0x00000000029F1000-memory.dmp

Filesize
4KB

Download