Analysis
-
max time kernel
14s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
28-11-2024 20:45
Static task
static1
Behavioral task
behavioral1
Sample
18acea74517245cc402e4c60a863f078de3778ffcd061c48a3d31b41b70ceabfN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
18acea74517245cc402e4c60a863f078de3778ffcd061c48a3d31b41b70ceabfN.exe
Resource
win10v2004-20241007-en
General
-
Target
18acea74517245cc402e4c60a863f078de3778ffcd061c48a3d31b41b70ceabfN.exe
-
Size
147KB
-
MD5
9aba289606cc4e9bc66e68456acbb550
-
SHA1
4629a3f364a1cda02348497e8a9138c22a5eab9a
-
SHA256
18acea74517245cc402e4c60a863f078de3778ffcd061c48a3d31b41b70ceabf
-
SHA512
9ebb1ccfa9767f5a8ccaf7b5e72cc29fb8ca4fb97c79b826f82c9aab8fa73f393959fcd9ee263354e58178ba81324c205be66109b592b2af7df36588e3b7cdff
-
SSDEEP
1536:gkWbhgW5o1oS4l1TfG8Umu3/IdsGmPIxl8F4L0a8fcqR:FW+1oS4l5OeuQdrmwvL8EqR
Malware Config
Signatures
-
Andromeda family
-
Detects Andromeda payload. 3 IoCs
resource yara_rule behavioral1/memory/1612-6-0x0000000000400000-0x0000000000409000-memory.dmp family_andromeda behavioral1/memory/1612-4-0x0000000000400000-0x0000000000409000-memory.dmp family_andromeda behavioral1/memory/1612-9-0x0000000000400000-0x0000000000409000-memory.dmp family_andromeda -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 564 set thread context of 1612 564 18acea74517245cc402e4c60a863f078de3778ffcd061c48a3d31b41b70ceabfN.exe 30 -
Program crash 1 IoCs
pid pid_target Process procid_target 2912 2804 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18acea74517245cc402e4c60a863f078de3778ffcd061c48a3d31b41b70ceabfN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18acea74517245cc402e4c60a863f078de3778ffcd061c48a3d31b41b70ceabfN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1612 18acea74517245cc402e4c60a863f078de3778ffcd061c48a3d31b41b70ceabfN.exe 1612 18acea74517245cc402e4c60a863f078de3778ffcd061c48a3d31b41b70ceabfN.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 564 wrote to memory of 1612 564 18acea74517245cc402e4c60a863f078de3778ffcd061c48a3d31b41b70ceabfN.exe 30 PID 564 wrote to memory of 1612 564 18acea74517245cc402e4c60a863f078de3778ffcd061c48a3d31b41b70ceabfN.exe 30 PID 564 wrote to memory of 1612 564 18acea74517245cc402e4c60a863f078de3778ffcd061c48a3d31b41b70ceabfN.exe 30 PID 564 wrote to memory of 1612 564 18acea74517245cc402e4c60a863f078de3778ffcd061c48a3d31b41b70ceabfN.exe 30 PID 564 wrote to memory of 1612 564 18acea74517245cc402e4c60a863f078de3778ffcd061c48a3d31b41b70ceabfN.exe 30 PID 564 wrote to memory of 1612 564 18acea74517245cc402e4c60a863f078de3778ffcd061c48a3d31b41b70ceabfN.exe 30 PID 564 wrote to memory of 1612 564 18acea74517245cc402e4c60a863f078de3778ffcd061c48a3d31b41b70ceabfN.exe 30 PID 1612 wrote to memory of 2804 1612 18acea74517245cc402e4c60a863f078de3778ffcd061c48a3d31b41b70ceabfN.exe 31 PID 1612 wrote to memory of 2804 1612 18acea74517245cc402e4c60a863f078de3778ffcd061c48a3d31b41b70ceabfN.exe 31 PID 1612 wrote to memory of 2804 1612 18acea74517245cc402e4c60a863f078de3778ffcd061c48a3d31b41b70ceabfN.exe 31 PID 1612 wrote to memory of 2804 1612 18acea74517245cc402e4c60a863f078de3778ffcd061c48a3d31b41b70ceabfN.exe 31 PID 1612 wrote to memory of 2804 1612 18acea74517245cc402e4c60a863f078de3778ffcd061c48a3d31b41b70ceabfN.exe 31 PID 1612 wrote to memory of 2804 1612 18acea74517245cc402e4c60a863f078de3778ffcd061c48a3d31b41b70ceabfN.exe 31 PID 1612 wrote to memory of 2804 1612 18acea74517245cc402e4c60a863f078de3778ffcd061c48a3d31b41b70ceabfN.exe 31 PID 2804 wrote to memory of 2912 2804 msiexec.exe 32 PID 2804 wrote to memory of 2912 2804 msiexec.exe 32 PID 2804 wrote to memory of 2912 2804 msiexec.exe 32 PID 2804 wrote to memory of 2912 2804 msiexec.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\18acea74517245cc402e4c60a863f078de3778ffcd061c48a3d31b41b70ceabfN.exe"C:\Users\Admin\AppData\Local\Temp\18acea74517245cc402e4c60a863f078de3778ffcd061c48a3d31b41b70ceabfN.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Users\Admin\AppData\Local\Temp\18acea74517245cc402e4c60a863f078de3778ffcd061c48a3d31b41b70ceabfN.exe"C:\Users\Admin\AppData\Local\Temp\18acea74517245cc402e4c60a863f078de3778ffcd061c48a3d31b41b70ceabfN.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\syswow64\msiexec.exeC:\Windows\syswow64\msiexec.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 2724⤵
- Program crash
PID:2912
-
-
-