andromeda | 0461dc2b1fa200c6f1ec4b302f8c5f128f82bab754d8d461e20e494c2015dc8c

General

Target

b011f80f86d655460b74482506ca53f5_JaffaCakes118.exe
Size

833KB
MD5

b011f80f86d655460b74482506ca53f5
SHA1

ec56ada0570ec71ca0fe7fe27587cff040ba99c0
SHA256

0461dc2b1fa200c6f1ec4b302f8c5f128f82bab754d8d461e20e494c2015dc8c
SHA512

e9cdce5edfc2596b87c4eaf278e841f041be78203c8a34c6e44fa17cf855231a5be17a570ecda25901e251f074e891bbfae916b6629e3d5bedfd52b949172620
SSDEEP

24576:kRmJkcoQricOIQxiZY1WNi/NvDAFEeEMuoKq5/Bb:hJZoQrbTFZY1WNiZEWeEMbhB

Score

10^/10

andromeda backdoor botnet discovery persistence

Malware Config

Signatures

Andromeda family
andromeda
Andromeda, Gamarue
Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.
botnet backdoor andromeda

Detects Andromeda payload. 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4348-17-0x00000000007F0000-0x00000000007F5000-memory.dmp	family_andromeda
behavioral2/memory/4348-21-0x00000000007F0000-0x00000000007F5000-memory.dmp	family_andromeda

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\65131 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\mswkawqjd.pif"	svchost.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

calc.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	calc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	calc.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/848-0-0x0000000000400000-0x00000000004CE000-memory.dmp	autoit_exe

Drops file in System32 directory 1 IoCs

Processes:

svchost.exe

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\calc.exe	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b011f80f86d655460b74482506ca53f5_JaffaCakes118.exe

description	pid	Process	procid_target
PID 848 set thread context of 4460	848	b011f80f86d655460b74482506ca53f5_JaffaCakes118.exe	83

Drops file in Program Files directory 1 IoCs

Processes:

svchost.exe

description	ioc	Process
File created	C:\PROGRA~3\LOCALS~1\Temp\mswkawqjd.pif	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

b011f80f86d655460b74482506ca53f5_JaffaCakes118.execalc.exesvchost.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b011f80f86d655460b74482506ca53f5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

calc.exe

pid	Process
4460	calc.exe
4460	calc.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

calc.exe

pid	Process
4460	calc.exe
4460	calc.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

b011f80f86d655460b74482506ca53f5_JaffaCakes118.execalc.exe

description	pid	Process	procid_target
PID 848 wrote to memory of 4460	848	b011f80f86d655460b74482506ca53f5_JaffaCakes118.exe	83
PID 848 wrote to memory of 4460	848	b011f80f86d655460b74482506ca53f5_JaffaCakes118.exe	83
PID 848 wrote to memory of 4460	848	b011f80f86d655460b74482506ca53f5_JaffaCakes118.exe	83
PID 848 wrote to memory of 4460	848	b011f80f86d655460b74482506ca53f5_JaffaCakes118.exe	83
PID 848 wrote to memory of 4460	848	b011f80f86d655460b74482506ca53f5_JaffaCakes118.exe	83
PID 4460 wrote to memory of 4348	4460	calc.exe	84
PID 4460 wrote to memory of 4348	4460	calc.exe	84
PID 4460 wrote to memory of 4348	4460	calc.exe	84

C:\Users\Admin\AppData\Local\Temp\b011f80f86d655460b74482506ca53f5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b011f80f86d655460b74482506ca53f5_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\SysWOW64\calc.exe"
  2⤵
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - Adds policy Run key to start application
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:4348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aut79D3.tmp

Filesize
13KB

MD5
e4131e1ccdd12d34489d41048493c9bd

SHA1
73b86fd33bcd9cbb25138fb66715bd9f5d176397

SHA256
49e7a27bf2210c61713dc10b68ac6fff5b4217d31f30905ea1d4468c95c03035

SHA512
d1e980943902dab187a37c09a45b42d5ebf57e50f0a9ac6c75e5165e819e1d02855b4fb80427f09cc94ef664c11ee3b6ca68394aa9c02cf6a050bdb2bf63319d

Download Submit
memory/848-0-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/4348-13-0x0000000000E00000-0x0000000000E0E000-memory.dmp

Filesize
56KB

Download
memory/4348-15-0x0000000000E00000-0x0000000000E0E000-memory.dmp

Filesize
56KB

Download
memory/4348-17-0x00000000007F0000-0x00000000007F5000-memory.dmp

Filesize
20KB

Download
memory/4348-21-0x00000000007F0000-0x00000000007F5000-memory.dmp

Filesize
20KB

Download
memory/4460-9-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4460-10-0x0000000000F60000-0x0000000000F62000-memory.dmp

Filesize
8KB

Download
memory/4460-12-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads