andromeda | 5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f

General

Target

5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe
Size

168KB
MD5

25aec122773f3a73c32ed71402fef96f
SHA1

c3773e2413975f4c4c98d91df9a690ef7390a1b2
SHA256

5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f
SHA512

aaa06b4cad26ef1dd7e496559a61ec6420eaefa2afacd8e59bc65468f1eee1229e38f967d07800bcd589b23423539fb29758e84c938daaa0bd2e2e0cadf5a0e4
SSDEEP

1536:8haN2fh0+TTQInoWGJcJJleqt1+Wgx3lFnHmleHSWgLAyXnnLm+AnqO5EU:2++TFnoWTTYBB1hHgN1Anq6

Score

10^/10

andromeda backdoor botnet discovery

Malware Config

Signatures

Andromeda family
andromeda
Andromeda, Gamarue
Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.
botnet backdoor andromeda

Detects Andromeda payload. 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2380-6-0x0000000000400000-0x0000000000409000-memory.dmp	family_andromeda
behavioral1/memory/2380-4-0x0000000000400000-0x0000000000409000-memory.dmp	family_andromeda
behavioral1/memory/2380-8-0x0000000000400000-0x0000000000409000-memory.dmp	family_andromeda

Suspicious use of SetThreadContext 1 IoCs

Processes:

5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe

description	pid	Process	procid_target
PID 2124 set thread context of 2380	2124	5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe	30

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2312	2608	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exemsiexec.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe

pid	Process
2380	5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe
2380	5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exemsiexec.exe

description	pid	Process	procid_target
PID 2124 wrote to memory of 2380	2124	5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe	30
PID 2124 wrote to memory of 2380	2124	5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe	30
PID 2124 wrote to memory of 2380	2124	5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe	30
PID 2124 wrote to memory of 2380	2124	5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe	30
PID 2124 wrote to memory of 2380	2124	5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe	30
PID 2124 wrote to memory of 2380	2124	5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe	30
PID 2124 wrote to memory of 2380	2124	5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe	30
PID 2380 wrote to memory of 2608	2380	5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe	31
PID 2380 wrote to memory of 2608	2380	5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe	31
PID 2380 wrote to memory of 2608	2380	5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe	31
PID 2380 wrote to memory of 2608	2380	5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe	31
PID 2380 wrote to memory of 2608	2380	5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe	31
PID 2380 wrote to memory of 2608	2380	5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe	31
PID 2380 wrote to memory of 2608	2380	5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe	31
PID 2608 wrote to memory of 2312	2608	msiexec.exe	32
PID 2608 wrote to memory of 2312	2608	msiexec.exe	32
PID 2608 wrote to memory of 2312	2608	msiexec.exe	32
PID 2608 wrote to memory of 2312	2608	msiexec.exe	32

C:\Users\Admin\AppData\Local\Temp\5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe
"C:\Users\Admin\AppData\Local\Temp\5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Users\Admin\AppData\Local\Temp\5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe
  "C:\Users\Admin\AppData\Local\Temp\5d8d767674e0c750a7079db17d3fb54859b6c8095935d7176af8a7c11a77b84f.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\syswow64\msiexec.exe
    C:\Windows\syswow64\msiexec.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 268
      4⤵
      Program crash
      PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2380-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2380-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2380-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2380-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2380-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2608-11-0x0000000000BB0000-0x0000000000BC4000-memory.dmp

Filesize
80KB

Download
memory/2608-12-0x0000000000BB0000-0x0000000000BC4000-memory.dmp

Filesize
80KB

Download
memory/2608-14-0x0000000000BB0000-0x0000000000BC4000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads