Analysis
-
max time kernel
111s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2024 12:29
Static task
static1
Behavioral task
behavioral1
Sample
9eb16bdb9d9e6e437c317d53a2328f4b16991824d8ffa31064d7a48165bbc731N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9eb16bdb9d9e6e437c317d53a2328f4b16991824d8ffa31064d7a48165bbc731N.exe
Resource
win10v2004-20241007-en
General
-
Target
9eb16bdb9d9e6e437c317d53a2328f4b16991824d8ffa31064d7a48165bbc731N.exe
-
Size
116KB
-
MD5
9fcda4e666ba0d02b67cc8e5714abb60
-
SHA1
9a3057420c1881929536cd91de45e7a8d373890d
-
SHA256
9eb16bdb9d9e6e437c317d53a2328f4b16991824d8ffa31064d7a48165bbc731
-
SHA512
fc4bdb3665fcbbaed9e31156f2af040cc7bb45003da7568dc108eedddce20b1f40717663e6274c417b1fdfaf8533a028fdf42905546c949604beecac0b8c2516
-
SSDEEP
1536:mvy50tV44aqwoa9ujdbNyVXa1lgNdaOCt1kTWf:mtWZqwoa9Xa1Idart19f
Malware Config
Signatures
-
Andromeda family
-
Detects Andromeda payload. 5 IoCs
resource yara_rule behavioral2/memory/4184-0-0x0000000000400000-0x0000000000409000-memory.dmp family_andromeda behavioral2/memory/4184-3-0x0000000000400000-0x0000000000409000-memory.dmp family_andromeda behavioral2/memory/2104-11-0x0000000000740000-0x0000000000745000-memory.dmp family_andromeda behavioral2/memory/2104-13-0x0000000000740000-0x0000000000745000-memory.dmp family_andromeda behavioral2/memory/2104-17-0x0000000000740000-0x0000000000745000-memory.dmp family_andromeda -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\34949 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\ccrghngam.pif" msiexec.exe -
Blocklisted process makes network request 25 IoCs
flow pid Process 13 2104 msiexec.exe 14 2104 msiexec.exe 16 2104 msiexec.exe 17 2104 msiexec.exe 18 2104 msiexec.exe 19 2104 msiexec.exe 20 2104 msiexec.exe 21 2104 msiexec.exe 22 2104 msiexec.exe 26 2104 msiexec.exe 27 2104 msiexec.exe 28 2104 msiexec.exe 29 2104 msiexec.exe 50 2104 msiexec.exe 51 2104 msiexec.exe 52 2104 msiexec.exe 53 2104 msiexec.exe 54 2104 msiexec.exe 55 2104 msiexec.exe 56 2104 msiexec.exe 57 2104 msiexec.exe 58 2104 msiexec.exe 59 2104 msiexec.exe 60 2104 msiexec.exe 61 2104 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2292 set thread context of 4184 2292 9eb16bdb9d9e6e437c317d53a2328f4b16991824d8ffa31064d7a48165bbc731N.exe 83 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\PROGRA~3\LOCALS~1\Temp\ccrghngam.pif msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9eb16bdb9d9e6e437c317d53a2328f4b16991824d8ffa31064d7a48165bbc731N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9eb16bdb9d9e6e437c317d53a2328f4b16991824d8ffa31064d7a48165bbc731N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 4184 9eb16bdb9d9e6e437c317d53a2328f4b16991824d8ffa31064d7a48165bbc731N.exe 4184 9eb16bdb9d9e6e437c317d53a2328f4b16991824d8ffa31064d7a48165bbc731N.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2292 wrote to memory of 4184 2292 9eb16bdb9d9e6e437c317d53a2328f4b16991824d8ffa31064d7a48165bbc731N.exe 83 PID 2292 wrote to memory of 4184 2292 9eb16bdb9d9e6e437c317d53a2328f4b16991824d8ffa31064d7a48165bbc731N.exe 83 PID 2292 wrote to memory of 4184 2292 9eb16bdb9d9e6e437c317d53a2328f4b16991824d8ffa31064d7a48165bbc731N.exe 83 PID 2292 wrote to memory of 4184 2292 9eb16bdb9d9e6e437c317d53a2328f4b16991824d8ffa31064d7a48165bbc731N.exe 83 PID 2292 wrote to memory of 4184 2292 9eb16bdb9d9e6e437c317d53a2328f4b16991824d8ffa31064d7a48165bbc731N.exe 83 PID 2292 wrote to memory of 4184 2292 9eb16bdb9d9e6e437c317d53a2328f4b16991824d8ffa31064d7a48165bbc731N.exe 83 PID 4184 wrote to memory of 2104 4184 9eb16bdb9d9e6e437c317d53a2328f4b16991824d8ffa31064d7a48165bbc731N.exe 84 PID 4184 wrote to memory of 2104 4184 9eb16bdb9d9e6e437c317d53a2328f4b16991824d8ffa31064d7a48165bbc731N.exe 84 PID 4184 wrote to memory of 2104 4184 9eb16bdb9d9e6e437c317d53a2328f4b16991824d8ffa31064d7a48165bbc731N.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\9eb16bdb9d9e6e437c317d53a2328f4b16991824d8ffa31064d7a48165bbc731N.exe"C:\Users\Admin\AppData\Local\Temp\9eb16bdb9d9e6e437c317d53a2328f4b16991824d8ffa31064d7a48165bbc731N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\9eb16bdb9d9e6e437c317d53a2328f4b16991824d8ffa31064d7a48165bbc731N.exe"C:\Users\Admin\AppData\Local\Temp\9eb16bdb9d9e6e437c317d53a2328f4b16991824d8ffa31064d7a48165bbc731N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\syswow64\msiexec.exe3⤵
- Adds policy Run key to start application
- Blocklisted process makes network request
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2104
-
-