Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2024 16:45
Static task
static1
Behavioral task
behavioral1
Sample
BBB report.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
BBB report.exe
Resource
win10v2004-20241007-en
General
-
Target
BBB report.exe
-
Size
49KB
-
MD5
0a639fab96cc0517efaaa476b2bbbcc2
-
SHA1
f351d57e0fd8e5e54ac92f5739d87239ee22ebdf
-
SHA256
e4d9b77dc0c6a90f27442a8a817593aced65e274cfecdedff1ffb4a6f118ff49
-
SHA512
95616c97675da315532c78b361443ccf67523ec29dc0d7627a8a96bf2e68aaf15e408e183ab1cc45223d2140d69cff72c170e1deaeae6601dc6f9eab878cf062
-
SSDEEP
768:ReK7M/8VNUef7eW7jzMAhqCB0u00aY3GM1JpOKn1lDTew:Y/8NUaf7huGGqHJT
Malware Config
Signatures
-
Andromeda family
-
Detects Andromeda payload. 2 IoCs
resource yara_rule behavioral2/memory/3376-8-0x0000000001280000-0x0000000001285000-memory.dmp family_andromeda behavioral2/memory/3376-12-0x0000000001280000-0x0000000001285000-memory.dmp family_andromeda -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\5801 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\mslcapjx.com" svchost.exe -
Deletes itself 1 IoCs
pid Process 3376 svchost.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum BBB report.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 BBB report.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2420 set thread context of 3792 2420 BBB report.exe 84 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\PROGRA~3\LOCALS~1\Temp\mslcapjx.com svchost.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBB report.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBB report.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3792 BBB report.exe 3792 BBB report.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 3792 BBB report.exe 3792 BBB report.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2420 wrote to memory of 3792 2420 BBB report.exe 84 PID 2420 wrote to memory of 3792 2420 BBB report.exe 84 PID 2420 wrote to memory of 3792 2420 BBB report.exe 84 PID 2420 wrote to memory of 3792 2420 BBB report.exe 84 PID 2420 wrote to memory of 3792 2420 BBB report.exe 84 PID 2420 wrote to memory of 3792 2420 BBB report.exe 84 PID 3792 wrote to memory of 3376 3792 BBB report.exe 85 PID 3792 wrote to memory of 3376 3792 BBB report.exe 85 PID 3792 wrote to memory of 3376 3792 BBB report.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\BBB report.exe"C:\Users\Admin\AppData\Local\Temp\BBB report.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\BBB report.exe"C:\Users\Admin\AppData\Local\Temp\BBB report.exe"2⤵
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\syswow64\svchost.exe3⤵
- Adds policy Run key to start application
- Deletes itself
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3376
-
-