Analysis
- max time kernel
113s - max time network
99s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 12:45
Behavioral task
behavioral1
Sample
26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
120 seconds
General
- Target 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe
- Size 60KB
- Sample241109-py9sdavckk
- SHA256 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167
- MD5 57d890b155d2cefdfd7276b5fac85ae0
- SHA1 5c473153d087f128454d0d68f0823fd5db355dba
- SHA512 754f6c3514e192f0869c66a8e0ef7500e6dd887cb5c5b665850adffb43e9a57d982716dc59fc140e8eba13d76dd534f93998e23e5865d5b1cc47e0b78d637f43
- SSDEEP 1536:RRkDnTSWukyxHE+JBWC7KnI4KTwTPGsvvkC:KnT6kyxdL9L0bGdC
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Andromeda family
- Detects Andromeda payload. 4 IoCs
resource yara_rule behavioral2/memory/828-1-0x0000000000400000-0x0000000000409000-memory.dmp family_andromeda behavioral2/memory/828-5-0x0000000000400000-0x0000000000409000-memory.dmp family_andromeda behavioral2/memory/2504-14-0x0000000000DF0000-0x0000000000DF5000-memory.dmp family_andromeda behavioral2/memory/2504-18-0x0000000000DF0000-0x0000000000DF5000-memory.dmp family_andromeda - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\6923 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\cceopjfae.pif" svchost.exe - Executes dropped EXE 1 IoCs
pid Process 828 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2060 set thread context of 828 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 88 -
resource yara_rule behavioral2/memory/2060-0-0x0000000000400000-0x000000000059D000-memory.dmp upx behavioral2/files/0x000a000000023ba9-2.dat upx behavioral2/memory/2060-7-0x0000000000400000-0x000000000059D000-memory.dmp upx - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\PROGRA~3\LOCALS~1\Temp\cceopjfae.pif svchost.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe - Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 828 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 828 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2060 wrote to memory of 828 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 88 PID 2060 wrote to memory of 828 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 88 PID 2060 wrote to memory of 828 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 88 PID 2060 wrote to memory of 828 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 88 PID 2060 wrote to memory of 828 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 88 PID 2060 wrote to memory of 828 2060 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 88 PID 828 wrote to memory of 2504 828 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 89 PID 828 wrote to memory of 2504 828 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 89 PID 828 wrote to memory of 2504 828 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe"C:\Users\Admin\AppData\Local\Temp\26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe"C:\Users\Admin\AppData\Local\Temp\26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\syswow64\svchost.exe3⤵
- Adds policy Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2504
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167N.exe
- Size 60KB
- SHA256 26e9e20a4cf3ff91d974578c9ba7e4575b776ac9697514dae94234f6f3453167
- MD5 57d890b155d2cefdfd7276b5fac85ae0
- SHA1 5c473153d087f128454d0d68f0823fd5db355dba
- SHA512 754f6c3514e192f0869c66a8e0ef7500e6dd887cb5c5b665850adffb43e9a57d982716dc59fc140e8eba13d76dd534f93998e23e5865d5b1cc47e0b78d637f43
- SSDEEP 1536:RRkDnTSWukyxHE+JBWC7KnI4KTwTPGsvvkC:KnT6kyxdL9L0bGdC
- MD5 SHA1 SHA512 SSDEEP