Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-11-2024 08:28
General
-
Target
935d72f947f7d0973dbb4fcdc225a4055face9fa8c78342d5ee6bb209b48013dN.exe
-
Size
108KB
-
MD5
dd38348aadb3add67bfb9a7634238700
-
SHA1
7eda1e24b2c73bfc2c7049c68ff85a12edda77b9
-
SHA256
935d72f947f7d0973dbb4fcdc225a4055face9fa8c78342d5ee6bb209b48013d
-
SHA512
2ac240d3f2c538f8f1bcfe86d956ccb56eaba74f98621f754c46172d1582ed4559351e4ad37aa9ef419d0d635e9946b0b38c9c6ce1f997131d755646aef5e6f9
-
SSDEEP
1536:nsGOCwae1GmXoMx7EMoGsvvqE7KCPdAxCGFEe/ScSRieTBDwXp77Ljh/e:nyha6oMx7EMoGg7KCdAY3cI1VKp5m
Malware Config
Signatures
-
Andromeda family
-
Andromeda, Gamarue
Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.
-
Detects Andromeda payload. 4 IoCs
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\935d72f947f7d0973dbb4fcdc225a4055face9fa8c78342d5ee6bb209b48013dN.exe"C:\Users\Admin\AppData\Local\Temp\935d72f947f7d0973dbb4fcdc225a4055face9fa8c78342d5ee6bb209b48013dN.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\935d72f947f7d0973dbb4fcdc225a4055face9fa8c78342d5ee6bb209b48013dN.exe"C:\Users\Admin\AppData\Local\Temp\935d72f947f7d0973dbb4fcdc225a4055face9fa8c78342d5ee6bb209b48013dN.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\syswow64\svchost.exe3⤵
- Adds policy Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD5dd38348aadb3add67bfb9a7634238700
SHA17eda1e24b2c73bfc2c7049c68ff85a12edda77b9
SHA256935d72f947f7d0973dbb4fcdc225a4055face9fa8c78342d5ee6bb209b48013d
SHA5122ac240d3f2c538f8f1bcfe86d956ccb56eaba74f98621f754c46172d1582ed4559351e4ad37aa9ef419d0d635e9946b0b38c9c6ce1f997131d755646aef5e6f9
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
20KB
-
Filesize
20KB