Analysis
-
max time kernel
112s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2024 16:54
Static task
static1
Behavioral task
behavioral1
Sample
f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe
Resource
win10v2004-20241007-en
General
-
Target
f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe
-
Size
92KB
-
MD5
471bddb0d9298833db377340d5ae743b
-
SHA1
3772593ed810eb5acc1c1e7e1d4b9fc6ca2eed99
-
SHA256
f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292
-
SHA512
32ab7991589a8d3ad9d5aceafeee589f62e2387472e6df6b380b2adf3eb7f618c70fd544694b9602b38c082355903c25989e1c2ab2628bddaf25496e09a577c5
-
SSDEEP
1536:BxR5bM9oLiCMsJozgKWNJ4NJxPMg2o1Ej7ns:BP5bphozgKWNJ4NJxPR1A7ns
Malware Config
Signatures
-
Andromeda family
-
Detects Andromeda payload. 5 IoCs
resource yara_rule behavioral2/memory/1484-0-0x0000000000400000-0x0000000000409000-memory.dmp family_andromeda behavioral2/memory/1484-3-0x0000000000400000-0x0000000000409000-memory.dmp family_andromeda behavioral2/memory/2328-11-0x0000000001130000-0x0000000001135000-memory.dmp family_andromeda behavioral2/memory/2328-13-0x0000000001130000-0x0000000001135000-memory.dmp family_andromeda behavioral2/memory/2328-17-0x0000000001130000-0x0000000001135000-memory.dmp family_andromeda -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\5614 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\ccmiat.exe" msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 1484 f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe -
Blocklisted process makes network request 25 IoCs
flow pid Process 15 2328 msiexec.exe 16 2328 msiexec.exe 17 2328 msiexec.exe 18 2328 msiexec.exe 19 2328 msiexec.exe 22 2328 msiexec.exe 23 2328 msiexec.exe 24 2328 msiexec.exe 26 2328 msiexec.exe 27 2328 msiexec.exe 28 2328 msiexec.exe 29 2328 msiexec.exe 30 2328 msiexec.exe 57 2328 msiexec.exe 58 2328 msiexec.exe 59 2328 msiexec.exe 60 2328 msiexec.exe 61 2328 msiexec.exe 62 2328 msiexec.exe 63 2328 msiexec.exe 64 2328 msiexec.exe 65 2328 msiexec.exe 66 2328 msiexec.exe 67 2328 msiexec.exe 68 2328 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4424 set thread context of 1484 4424 f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe 83 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\PROGRA~3\LOCALS~1\Temp\ccmiat.exe msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1484 f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe 1484 f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4424 wrote to memory of 1484 4424 f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe 83 PID 4424 wrote to memory of 1484 4424 f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe 83 PID 4424 wrote to memory of 1484 4424 f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe 83 PID 4424 wrote to memory of 1484 4424 f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe 83 PID 4424 wrote to memory of 1484 4424 f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe 83 PID 4424 wrote to memory of 1484 4424 f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe 83 PID 1484 wrote to memory of 2328 1484 f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe 84 PID 1484 wrote to memory of 2328 1484 f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe 84 PID 1484 wrote to memory of 2328 1484 f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe"C:\Users\Admin\AppData\Local\Temp\f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe"C:\Users\Admin\AppData\Local\Temp\f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\syswow64\msiexec.exe3⤵
- Adds policy Run key to start application
- Blocklisted process makes network request
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2328
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe
Filesize92KB
MD5471bddb0d9298833db377340d5ae743b
SHA13772593ed810eb5acc1c1e7e1d4b9fc6ca2eed99
SHA256f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292
SHA51232ab7991589a8d3ad9d5aceafeee589f62e2387472e6df6b380b2adf3eb7f618c70fd544694b9602b38c082355903c25989e1c2ab2628bddaf25496e09a577c5