Analysis
-
max time kernel
119s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-08-2024 03:10
Static task
static1
Behavioral task
behavioral1
Sample
21dbc8bf435da3844fe87d4d81e4ba50N.exe
Resource
win7-20240704-en
General
-
Target
21dbc8bf435da3844fe87d4d81e4ba50N.exe
-
Size
284KB
-
MD5
21dbc8bf435da3844fe87d4d81e4ba50
-
SHA1
fbd9b966f1b50c99521127c477a8c3cde96fc14f
-
SHA256
c0c67ac11ce4010268dea559f2b08b21d8ef6f49f48d2786cc1fdfb556397546
-
SHA512
9d491b7e346d9c4b910e74e4b774af1c691c2dc844804546a2f886072c5dac2ca243136d56bb80d542d8f4768c5f924b5994fe57be90ab298358ba1c56d9527b
-
SSDEEP
3072:mSQ0EWVwZhKxC5Rt+k60Zh+qw6PYSsszfHZTZJ2lC:mPA6wxmuJspr2l
Malware Config
Signatures
-
Detects Andromeda payload. 2 IoCs
resource yara_rule behavioral2/memory/3688-60-0x0000000000FD0000-0x0000000000FD5000-memory.dmp family_andromeda behavioral2/memory/3688-64-0x0000000000FD0000-0x0000000000FD5000-memory.dmp family_andromeda -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\52153 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\msweaw.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 21dbc8bf435da3844fe87d4d81e4ba50N.exe -
Executes dropped EXE 3 IoCs
pid Process 4896 skyrpe.exe 1512 skyrpe.exe 208 skyrpe.exe -
resource yara_rule behavioral2/memory/4468-7-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4468-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4468-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4468-39-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4468-55-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1512-66-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Skype = "C:\\Users\\Admin\\AppData\\Roaming\\skype\\skyrpe.exe" reg.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum skyrpe.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 skyrpe.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3212 set thread context of 4468 3212 21dbc8bf435da3844fe87d4d81e4ba50N.exe 95 PID 4896 set thread context of 1512 4896 skyrpe.exe 103 PID 4896 set thread context of 208 4896 skyrpe.exe 104 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\PROGRA~3\LOCALS~1\Temp\msweaw.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21dbc8bf435da3844fe87d4d81e4ba50N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21dbc8bf435da3844fe87d4d81e4ba50N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skyrpe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skyrpe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skyrpe.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 208 skyrpe.exe 208 skyrpe.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 208 skyrpe.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe Token: SeDebugPrivilege 1512 skyrpe.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3212 21dbc8bf435da3844fe87d4d81e4ba50N.exe 4468 21dbc8bf435da3844fe87d4d81e4ba50N.exe 4896 skyrpe.exe 1512 skyrpe.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 3212 wrote to memory of 4468 3212 21dbc8bf435da3844fe87d4d81e4ba50N.exe 95 PID 3212 wrote to memory of 4468 3212 21dbc8bf435da3844fe87d4d81e4ba50N.exe 95 PID 3212 wrote to memory of 4468 3212 21dbc8bf435da3844fe87d4d81e4ba50N.exe 95 PID 3212 wrote to memory of 4468 3212 21dbc8bf435da3844fe87d4d81e4ba50N.exe 95 PID 3212 wrote to memory of 4468 3212 21dbc8bf435da3844fe87d4d81e4ba50N.exe 95 PID 3212 wrote to memory of 4468 3212 21dbc8bf435da3844fe87d4d81e4ba50N.exe 95 PID 3212 wrote to memory of 4468 3212 21dbc8bf435da3844fe87d4d81e4ba50N.exe 95 PID 3212 wrote to memory of 4468 3212 21dbc8bf435da3844fe87d4d81e4ba50N.exe 95 PID 4468 wrote to memory of 2592 4468 21dbc8bf435da3844fe87d4d81e4ba50N.exe 96 PID 4468 wrote to memory of 2592 4468 21dbc8bf435da3844fe87d4d81e4ba50N.exe 96 PID 4468 wrote to memory of 2592 4468 21dbc8bf435da3844fe87d4d81e4ba50N.exe 96 PID 2592 wrote to memory of 4672 2592 cmd.exe 99 PID 2592 wrote to memory of 4672 2592 cmd.exe 99 PID 2592 wrote to memory of 4672 2592 cmd.exe 99 PID 4468 wrote to memory of 4896 4468 21dbc8bf435da3844fe87d4d81e4ba50N.exe 100 PID 4468 wrote to memory of 4896 4468 21dbc8bf435da3844fe87d4d81e4ba50N.exe 100 PID 4468 wrote to memory of 4896 4468 21dbc8bf435da3844fe87d4d81e4ba50N.exe 100 PID 4896 wrote to memory of 1512 4896 skyrpe.exe 103 PID 4896 wrote to memory of 1512 4896 skyrpe.exe 103 PID 4896 wrote to memory of 1512 4896 skyrpe.exe 103 PID 4896 wrote to memory of 1512 4896 skyrpe.exe 103 PID 4896 wrote to memory of 1512 4896 skyrpe.exe 103 PID 4896 wrote to memory of 1512 4896 skyrpe.exe 103 PID 4896 wrote to memory of 1512 4896 skyrpe.exe 103 PID 4896 wrote to memory of 1512 4896 skyrpe.exe 103 PID 4896 wrote to memory of 208 4896 skyrpe.exe 104 PID 4896 wrote to memory of 208 4896 skyrpe.exe 104 PID 4896 wrote to memory of 208 4896 skyrpe.exe 104 PID 4896 wrote to memory of 208 4896 skyrpe.exe 104 PID 4896 wrote to memory of 208 4896 skyrpe.exe 104 PID 4896 wrote to memory of 208 4896 skyrpe.exe 104 PID 208 wrote to memory of 3688 208 skyrpe.exe 105 PID 208 wrote to memory of 3688 208 skyrpe.exe 105 PID 208 wrote to memory of 3688 208 skyrpe.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\21dbc8bf435da3844fe87d4d81e4ba50N.exe"C:\Users\Admin\AppData\Local\Temp\21dbc8bf435da3844fe87d4d81e4ba50N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\21dbc8bf435da3844fe87d4d81e4ba50N.exe"C:\Users\Admin\AppData\Local\Temp\21dbc8bf435da3844fe87d4d81e4ba50N.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MJJUR.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Skype" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4672
-
-
-
C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1512
-
-
C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\syswow64\svchost.exe5⤵
- Adds policy Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3688
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139B
MD50654f004b2e314bad7f75867e91da37d
SHA14232c22e7340b12108d86e3cb35ed288a3dbc7f1
SHA256ead325a060300a9606a3f0f14694be39a3e4006a60c6c3eb0bea5d6f98192249
SHA512dda135cdfca90a742d42b4c7a5e7f5df6580ec428302a8f0c311f5b92eb08dda75774e0c7497110faffbe2dfa02b30d2dfe35ec2848a275f53be8d930c7aa553
-
Filesize
284KB
MD5f3ab84d2f48d60117194fb6c387dd054
SHA161db4f6007f22db3659fe97bbb8d648568f0b95c
SHA256568056806f810fda7f1afca06f5b51beba49610cc853e7a38355a73d995744a5
SHA512d7e072f037ed9b59510e1096e8aa5f2135fe43f1b7074b273c6fe0a1f6da59e62f660180649e7a3ba40db28de5b2d6a3a032235c30532094ea300a92b08df534