Malware Analysis Report

2025-01-02 14:38

Sample ID 240910-l92pcsycrm
Target ba612922787e1de06ec6b2bb5e79c2a0N
SHA256 a42c15b4511d886403b5247c8c3b2984ad89574310dbc69d36be6c92f8ca689e
Tags
andromeda backdoor botnet discovery persistence upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a42c15b4511d886403b5247c8c3b2984ad89574310dbc69d36be6c92f8ca689e

Threat Level: Known bad

The file ba612922787e1de06ec6b2bb5e79c2a0N was found to be: Known bad.

Malicious Activity Summary

andromeda backdoor botnet discovery persistence upx

Andromeda, Gamarue

Detects Andromeda payload.

Adds policy Run key to start application

Executes dropped EXE

UPX packed file

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Maps connected drives based on registry

Suspicious use of SetThreadContext

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious behavior: MapViewOfSection

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-10 10:14

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-10 10:14

Reported

2024-09-10 10:16

Platform

win10v2004-20240802-en

Max time kernel

118s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe"

Signatures

Andromeda, Gamarue

botnet backdoor andromeda

Detects Andromeda payload.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\57705 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\msoosg.exe" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Skype = "C:\\Users\\Admin\\AppData\\Roaming\\skype\\skyrpe.exe" C:\Windows\SysWOW64\reg.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\PROGRA~3\LOCALS~1\Temp\msoosg.exe C:\Windows\SysWOW64\svchost.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3384 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe
PID 3384 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe
PID 3384 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe
PID 3384 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe
PID 3384 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe
PID 3384 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe
PID 3384 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe
PID 3384 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe
PID 3652 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Windows\SysWOW64\cmd.exe
PID 3652 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Windows\SysWOW64\cmd.exe
PID 3652 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Windows\SysWOW64\cmd.exe
PID 1304 wrote to memory of 2408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1304 wrote to memory of 2408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1304 wrote to memory of 2408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3652 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3652 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3652 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3536 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3536 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3536 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3536 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3536 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3536 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3536 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3536 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3536 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3536 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3536 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3536 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3536 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 3536 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 1444 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Windows\SysWOW64\svchost.exe
PID 1444 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Windows\SysWOW64\svchost.exe
PID 1444 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe

"C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4344,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe

"C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WBXLY.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Skype" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe" /f

C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe

"C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"

C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe

"C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"

C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe

"C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\syswow64\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 www.update.microsoft.com udp
US 20.109.209.108:80 www.update.microsoft.com tcp
US 8.8.4.4:53 sonic4me.com udp
US 184.105.192.2:80 sonic4me.com tcp
US 8.8.8.8:53 108.209.109.20.in-addr.arpa udp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
US 8.8.8.8:53 2.192.105.184.in-addr.arpa udp
US 8.8.4.4:53 imageshells.com udp
US 184.105.192.2:80 imageshells.com tcp

Files

memory/3384-0-0x0000000000400000-0x0000000000452000-memory.dmp

memory/3384-3-0x0000000002A30000-0x0000000002A31000-memory.dmp

memory/3384-4-0x0000000002A40000-0x0000000002A41000-memory.dmp

memory/3384-5-0x0000000000400000-0x0000000000452000-memory.dmp

memory/3384-6-0x0000000002A30000-0x0000000002A31000-memory.dmp

memory/3384-7-0x0000000002A50000-0x0000000002A51000-memory.dmp

memory/3384-8-0x0000000002A60000-0x0000000002A61000-memory.dmp

memory/3652-9-0x0000000000400000-0x000000000040B000-memory.dmp

memory/3652-11-0x0000000000400000-0x000000000040B000-memory.dmp

memory/3652-13-0x0000000000400000-0x000000000040B000-memory.dmp

memory/3384-15-0x0000000000400000-0x0000000000452000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\WBXLY.txt

MD5 0654f004b2e314bad7f75867e91da37d
SHA1 4232c22e7340b12108d86e3cb35ed288a3dbc7f1
SHA256 ead325a060300a9606a3f0f14694be39a3e4006a60c6c3eb0bea5d6f98192249
SHA512 dda135cdfca90a742d42b4c7a5e7f5df6580ec428302a8f0c311f5b92eb08dda75774e0c7497110faffbe2dfa02b30d2dfe35ec2848a275f53be8d930c7aa553

C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe

MD5 059b5df2e91b4f858d38c6e0cdc95a4f
SHA1 43c6a8cd28de879835e2f1541221f4189313c994
SHA256 14e94431e7ca00b10912bdd101ebf025971e2a3cc5f19a3566b2b44b8c4c5e6f
SHA512 9ba3009b3a4e0394099ade8b99a506ff60948f9025d05b183f7cab360216fe3559b4b503090edee2a8f22b585aa755f80247f0884242c91fc1f2da64b6a884a8

memory/3536-38-0x0000000000400000-0x0000000000452000-memory.dmp

memory/3536-41-0x0000000000400000-0x0000000000452000-memory.dmp

memory/3536-42-0x0000000000400000-0x0000000000452000-memory.dmp

memory/3652-43-0x0000000000400000-0x000000000040B000-memory.dmp

memory/3536-47-0x0000000000400000-0x0000000000452000-memory.dmp

memory/1444-56-0x0000000000400000-0x0000000000405000-memory.dmp

memory/1444-53-0x0000000000400000-0x0000000000405000-memory.dmp

memory/3536-58-0x0000000000400000-0x0000000000452000-memory.dmp

memory/3652-62-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2624-64-0x0000000000FA0000-0x0000000000FA5000-memory.dmp

memory/2624-66-0x0000000000FD0000-0x0000000000FD5000-memory.dmp

memory/2624-70-0x0000000000FD0000-0x0000000000FD5000-memory.dmp

memory/2488-71-0x0000000000400000-0x000000000040B000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-10 10:14

Reported

2024-09-10 10:16

Platform

win7-20240704-en

Max time kernel

111s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\Skype = "C:\\Users\\Admin\\AppData\\Roaming\\skype\\skyrpe.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2936 set thread context of 184084 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2936 wrote to memory of 184084 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe
PID 2936 wrote to memory of 184084 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe
PID 2936 wrote to memory of 184084 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe
PID 2936 wrote to memory of 184084 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe
PID 2936 wrote to memory of 184084 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe
PID 2936 wrote to memory of 184084 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe
PID 2936 wrote to memory of 184084 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe
PID 2936 wrote to memory of 184084 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe
PID 184084 wrote to memory of 35152 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Windows\SysWOW64\cmd.exe
PID 184084 wrote to memory of 35152 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Windows\SysWOW64\cmd.exe
PID 184084 wrote to memory of 35152 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Windows\SysWOW64\cmd.exe
PID 184084 wrote to memory of 35152 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Windows\SysWOW64\cmd.exe
PID 35152 wrote to memory of 35208 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 35152 wrote to memory of 35208 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 35152 wrote to memory of 35208 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 35152 wrote to memory of 35208 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 184084 wrote to memory of 35232 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 184084 wrote to memory of 35232 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 184084 wrote to memory of 35232 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 184084 wrote to memory of 35232 N/A C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe

"C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe"

C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe

"C:\Users\Admin\AppData\Local\Temp\ba612922787e1de06ec6b2bb5e79c2a0N.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\EPMLP.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Skype" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe" /f

C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe

"C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"

Network

N/A

Files

memory/2936-0-0x0000000000400000-0x0000000000452000-memory.dmp

memory/2936-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/2936-76-0x0000000000404000-0x0000000000405000-memory.dmp

memory/2936-223-0x0000000000400000-0x0000000000452000-memory.dmp

memory/2936-9355-0x0000000000090000-0x0000000000190000-memory.dmp

memory/2936-9337-0x0000000000090000-0x0000000000190000-memory.dmp

memory/2936-53491-0x0000000000400000-0x0000000000452000-memory.dmp

memory/184084-53490-0x0000000000400000-0x000000000040B000-memory.dmp

memory/184084-53489-0x0000000000400000-0x000000000040B000-memory.dmp

memory/184084-53488-0x0000000000400000-0x000000000040B000-memory.dmp

memory/184084-53487-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/184084-53485-0x0000000000400000-0x000000000040B000-memory.dmp

memory/184084-53483-0x0000000000400000-0x000000000040B000-memory.dmp

memory/184084-53481-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2936-9365-0x0000000000090000-0x0000000000190000-memory.dmp

memory/2936-9364-0x0000000000090000-0x0000000000190000-memory.dmp

memory/2936-9363-0x0000000000090000-0x0000000000190000-memory.dmp

memory/2936-9362-0x0000000000090000-0x0000000000190000-memory.dmp

memory/2936-9361-0x0000000000090000-0x0000000000190000-memory.dmp

memory/2936-9360-0x0000000000090000-0x0000000000190000-memory.dmp

memory/2936-9359-0x0000000000090000-0x0000000000190000-memory.dmp

memory/2936-9358-0x0000000000090000-0x0000000000190000-memory.dmp

memory/2936-9357-0x0000000000090000-0x0000000000190000-memory.dmp

memory/2936-9356-0x0000000000090000-0x0000000000190000-memory.dmp

memory/2936-9354-0x0000000000090000-0x0000000000190000-memory.dmp

memory/2936-9353-0x0000000000090000-0x0000000000190000-memory.dmp

memory/2936-9352-0x0000000000090000-0x0000000000190000-memory.dmp

memory/2936-9351-0x0000000000090000-0x0000000000190000-memory.dmp

memory/2936-9350-0x0000000000090000-0x0000000000190000-memory.dmp

memory/2936-9338-0x0000000000090000-0x0000000000190000-memory.dmp

memory/2936-9336-0x0000000000090000-0x0000000000190000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\EPMLP.bat

MD5 0654f004b2e314bad7f75867e91da37d
SHA1 4232c22e7340b12108d86e3cb35ed288a3dbc7f1
SHA256 ead325a060300a9606a3f0f14694be39a3e4006a60c6c3eb0bea5d6f98192249
SHA512 dda135cdfca90a742d42b4c7a5e7f5df6580ec428302a8f0c311f5b92eb08dda75774e0c7497110faffbe2dfa02b30d2dfe35ec2848a275f53be8d930c7aa553

\Users\Admin\AppData\Roaming\skype\skyrpe.exe

MD5 f9fd08ea74852183843e1c126c102e6e
SHA1 80bdecad93c5fc7c4e1691f6f93b9876c01ab902
SHA256 136f35afc4fdebd7667ed37345a7f5d9e0a9aa55c5ec4f0f8ba3121f360c0194
SHA512 1bb2b728f270fdaeff1459e91458a79fa378720b450fb52ce2b27c2a4246de5da0ca0e4f5254da379c09248a8bc946b106a37635ab751cfff4355987d3782225

memory/184084-53522-0x00000000025E0000-0x0000000002632000-memory.dmp

memory/184084-53524-0x00000000025E0000-0x0000000002632000-memory.dmp

memory/184084-53539-0x0000000000400000-0x000000000040B000-memory.dmp

memory/184084-53538-0x00000000025E0000-0x0000000002632000-memory.dmp

memory/184084-53537-0x00000000025E0000-0x0000000002632000-memory.dmp

memory/184084-53536-0x00000000025E0000-0x0000000002632000-memory.dmp

memory/184084-53693-0x00000000025E0000-0x0000000002632000-memory.dmp

memory/184084-53694-0x00000000025E0000-0x0000000002632000-memory.dmp

memory/35232-53695-0x0000000000400000-0x0000000000452000-memory.dmp