Malware Analysis Report

2025-01-02 14:44

Sample ID 240820-cftxzsybmh
Target c8e12fb10fc9963c49e4d074cc5ba2b0N.exe
SHA256 22c91158f3bb3e30cd36ff983fb2f8874cc436466e3938db0ef5e45e8fd26338
Tags
andromeda backdoor botnet discovery persistence upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

22c91158f3bb3e30cd36ff983fb2f8874cc436466e3938db0ef5e45e8fd26338

Threat Level: Known bad

The file c8e12fb10fc9963c49e4d074cc5ba2b0N.exe was found to be: Known bad.

Malicious Activity Summary

andromeda backdoor botnet discovery persistence upx

Andromeda, Gamarue

Detects Andromeda payload.

Adds policy Run key to start application

Loads dropped DLL

Checks computer location settings

UPX packed file

Executes dropped EXE

Maps connected drives based on registry

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-20 02:01

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-20 02:01

Reported

2024-08-20 02:03

Platform

win10v2004-20240802-en

Max time kernel

119s

Max time network

105s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe"

Signatures

Andromeda, Gamarue

botnet backdoor andromeda

Detects Andromeda payload.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\56050 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\mseuyuip.com" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Skype = "C:\\Users\\Admin\\AppData\\Roaming\\skype\\skyrpe.exe" C:\Windows\SysWOW64\reg.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\PROGRA~3\LOCALS~1\Temp\mseuyuip.com C:\Windows\SysWOW64\svchost.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4524 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe
PID 4524 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe
PID 4524 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe
PID 4524 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe
PID 4524 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe
PID 4524 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe
PID 4524 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe
PID 4524 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe
PID 3492 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Windows\SysWOW64\cmd.exe
PID 3492 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Windows\SysWOW64\cmd.exe
PID 3492 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Windows\SysWOW64\cmd.exe
PID 2212 wrote to memory of 2060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2212 wrote to memory of 2060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2212 wrote to memory of 2060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3492 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3492 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3492 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3892 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3892 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3892 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3892 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3892 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3892 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3892 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3892 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3892 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3892 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3892 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3892 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3892 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3892 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 4012 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Windows\SysWOW64\svchost.exe
PID 4012 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Windows\SysWOW64\svchost.exe
PID 4012 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe

"C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe"

C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe

"C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JKCJK.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Skype" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe" /f

C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe

"C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"

C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe

"C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"

C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe

"C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\syswow64\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 www.update.microsoft.com udp
US 20.109.209.108:80 www.update.microsoft.com tcp
US 8.8.4.4:53 sonic4me.com udp
US 184.105.192.2:80 sonic4me.com tcp
US 8.8.4.4:53 imageshells.com udp
US 184.105.192.2:80 imageshells.com tcp
US 8.8.8.8:53 108.209.109.20.in-addr.arpa udp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
US 8.8.8.8:53 2.192.105.184.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

memory/4524-0-0x0000000000400000-0x0000000000462000-memory.dmp

memory/4524-3-0x0000000002430000-0x0000000002431000-memory.dmp

memory/4524-4-0x0000000002440000-0x0000000002441000-memory.dmp

memory/4524-5-0x0000000000400000-0x0000000000462000-memory.dmp

memory/4524-6-0x0000000002430000-0x0000000002431000-memory.dmp

memory/4524-8-0x00000000001D0000-0x00000000001D1000-memory.dmp

memory/4524-7-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/3492-9-0x0000000000400000-0x000000000040B000-memory.dmp

memory/3492-13-0x0000000000400000-0x000000000040B000-memory.dmp

memory/3492-11-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4524-15-0x0000000000400000-0x0000000000462000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\JKCJK.txt

MD5 0654f004b2e314bad7f75867e91da37d
SHA1 4232c22e7340b12108d86e3cb35ed288a3dbc7f1
SHA256 ead325a060300a9606a3f0f14694be39a3e4006a60c6c3eb0bea5d6f98192249
SHA512 dda135cdfca90a742d42b4c7a5e7f5df6580ec428302a8f0c311f5b92eb08dda75774e0c7497110faffbe2dfa02b30d2dfe35ec2848a275f53be8d930c7aa553

C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe

MD5 c8e12fb10fc9963c49e4d074cc5ba2b0
SHA1 676786db56b6aff6a05da8b13cbd5069e03aada0
SHA256 22c91158f3bb3e30cd36ff983fb2f8874cc436466e3938db0ef5e45e8fd26338
SHA512 344baa3d36885077c283e06ff967803df97bb87f09d634f0de3650c6a91f16f27dfd47952703107d086a37be8de38393c8d535fcbf1772e4297e0ae2ac86cf48

memory/3892-40-0x0000000000400000-0x0000000000462000-memory.dmp

memory/3892-41-0x0000000000400000-0x0000000000462000-memory.dmp

memory/3492-42-0x0000000000400000-0x000000000040B000-memory.dmp

memory/3892-46-0x0000000000400000-0x0000000000462000-memory.dmp

memory/4012-52-0x0000000000400000-0x0000000000405000-memory.dmp

memory/4012-56-0x0000000000400000-0x0000000000405000-memory.dmp

memory/3892-57-0x0000000000400000-0x0000000000462000-memory.dmp

memory/3492-58-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2184-62-0x00000000004A0000-0x00000000004A5000-memory.dmp

memory/2184-64-0x00000000005E0000-0x00000000005E5000-memory.dmp

memory/2184-68-0x00000000005E0000-0x00000000005E5000-memory.dmp

memory/2392-70-0x0000000000400000-0x000000000040B000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-20 02:01

Reported

2024-08-20 02:03

Platform

win7-20240708-en

Max time kernel

119s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe"

Signatures

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\syswow64\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\28819 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\msneaooaa.pif" C:\Windows\syswow64\svchost.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\Skype = "C:\\Users\\Admin\\AppData\\Roaming\\skype\\skyrpe.exe" C:\Windows\SysWOW64\reg.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\PROGRA~3\LOCALS~1\Temp\msneaooaa.pif C:\Windows\syswow64\svchost.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2876 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe
PID 2876 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe
PID 2876 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe
PID 2876 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe
PID 2876 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe
PID 2876 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe
PID 2876 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe
PID 2876 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe
PID 2100 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Windows\SysWOW64\cmd.exe
PID 2100 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Windows\SysWOW64\cmd.exe
PID 2100 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Windows\SysWOW64\cmd.exe
PID 2100 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Windows\SysWOW64\cmd.exe
PID 948 wrote to memory of 3100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 948 wrote to memory of 3100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 948 wrote to memory of 3100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 948 wrote to memory of 3100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2100 wrote to memory of 3124 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 2100 wrote to memory of 3124 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 2100 wrote to memory of 3124 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 2100 wrote to memory of 3124 N/A C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3124 wrote to memory of 10148 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3124 wrote to memory of 10148 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3124 wrote to memory of 10148 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3124 wrote to memory of 10148 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3124 wrote to memory of 10148 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3124 wrote to memory of 10148 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3124 wrote to memory of 10148 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3124 wrote to memory of 10148 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3124 wrote to memory of 10224 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3124 wrote to memory of 10224 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3124 wrote to memory of 10224 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3124 wrote to memory of 10224 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3124 wrote to memory of 10224 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3124 wrote to memory of 10224 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3124 wrote to memory of 10224 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 10224 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Windows\syswow64\svchost.exe
PID 10224 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Windows\syswow64\svchost.exe
PID 10224 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Windows\syswow64\svchost.exe
PID 10224 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Windows\syswow64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe

"C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe"

C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe

"C:\Users\Admin\AppData\Local\Temp\c8e12fb10fc9963c49e4d074cc5ba2b0N.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\RDBFA.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Skype" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe" /f

C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe

"C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"

C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe

"C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"

C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe

"C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"

C:\Windows\syswow64\svchost.exe

C:\Windows\syswow64\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.update.microsoft.com udp
US 20.109.209.108:80 www.update.microsoft.com tcp
US 8.8.4.4:53 sonic4me.com udp
US 184.105.192.2:80 sonic4me.com tcp
US 8.8.4.4:53 imageshells.com udp
US 184.105.192.2:80 imageshells.com tcp

Files

memory/2876-0-0x0000000000400000-0x0000000000462000-memory.dmp

memory/2876-3-0x0000000000250000-0x0000000000251000-memory.dmp

memory/2876-222-0x0000000000404000-0x0000000000405000-memory.dmp

memory/2876-223-0x0000000000400000-0x0000000000462000-memory.dmp

memory/2100-53481-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2100-53487-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2100-53489-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2100-53485-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2100-53483-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2876-53491-0x0000000000400000-0x0000000000462000-memory.dmp

memory/2100-53490-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2100-53492-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RDBFA.bat

MD5 0654f004b2e314bad7f75867e91da37d
SHA1 4232c22e7340b12108d86e3cb35ed288a3dbc7f1
SHA256 ead325a060300a9606a3f0f14694be39a3e4006a60c6c3eb0bea5d6f98192249
SHA512 dda135cdfca90a742d42b4c7a5e7f5df6580ec428302a8f0c311f5b92eb08dda75774e0c7497110faffbe2dfa02b30d2dfe35ec2848a275f53be8d930c7aa553

\Users\Admin\AppData\Roaming\skype\skyrpe.exe

MD5 6feacccfe46d179455ceb5d2167ab728
SHA1 c432619fb94df6bdbb3eb02364a09de53aca31d0
SHA256 a153bc56feddfd4ce2e4d30d6b830dd1ec5a17dc54505fca8c862ba9dc634675
SHA512 0c3918e64e4a4e12918b50feda904f4f79971f7b1fd4c449052fd469a16e737cc08f15f1468985bf24bf0a0dbff8be3c9aa5ee590687268f92150f0d1596b408

memory/2100-53524-0x00000000033E0000-0x0000000003442000-memory.dmp

memory/2100-53526-0x00000000033E0000-0x0000000003442000-memory.dmp

memory/2100-53534-0x00000000033E0000-0x0000000003442000-memory.dmp

memory/2100-53533-0x00000000033E0000-0x0000000003442000-memory.dmp

memory/2100-53687-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2100-53688-0x00000000033E0000-0x0000000003442000-memory.dmp

memory/3124-53690-0x0000000000400000-0x0000000000462000-memory.dmp

memory/10224-106971-0x0000000000400000-0x0000000000405000-memory.dmp

memory/3124-106973-0x0000000000400000-0x0000000000462000-memory.dmp

memory/2100-106979-0x0000000000400000-0x000000000040B000-memory.dmp

memory/10224-106982-0x0000000000400000-0x0000000000405000-memory.dmp

memory/10148-106990-0x0000000000400000-0x000000000040B000-memory.dmp