Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2024 17:01
Static task
static1
Behavioral task
behavioral1
Sample
f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe
Resource
win10v2004-20241007-en
General
-
Target
f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe
-
Size
92KB
-
MD5
471bddb0d9298833db377340d5ae743b
-
SHA1
3772593ed810eb5acc1c1e7e1d4b9fc6ca2eed99
-
SHA256
f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292
-
SHA512
32ab7991589a8d3ad9d5aceafeee589f62e2387472e6df6b380b2adf3eb7f618c70fd544694b9602b38c082355903c25989e1c2ab2628bddaf25496e09a577c5
-
SSDEEP
1536:BxR5bM9oLiCMsJozgKWNJ4NJxPMg2o1Ej7ns:BP5bphozgKWNJ4NJxPR1A7ns
Malware Config
Signatures
-
Andromeda family
-
Detects Andromeda payload. 5 IoCs
resource yara_rule behavioral2/memory/5012-0-0x0000000000400000-0x0000000000409000-memory.dmp family_andromeda behavioral2/memory/5012-3-0x0000000000400000-0x0000000000409000-memory.dmp family_andromeda behavioral2/memory/4048-11-0x0000000000C30000-0x0000000000C35000-memory.dmp family_andromeda behavioral2/memory/4048-13-0x0000000000C30000-0x0000000000C35000-memory.dmp family_andromeda behavioral2/memory/4048-17-0x0000000000C30000-0x0000000000C35000-memory.dmp family_andromeda -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\60061 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\ccejtub.com" msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 5012 f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe -
Blocklisted process makes network request 37 IoCs
flow pid Process 14 4048 msiexec.exe 15 4048 msiexec.exe 16 4048 msiexec.exe 17 4048 msiexec.exe 18 4048 msiexec.exe 21 4048 msiexec.exe 22 4048 msiexec.exe 25 4048 msiexec.exe 27 4048 msiexec.exe 28 4048 msiexec.exe 29 4048 msiexec.exe 30 4048 msiexec.exe 31 4048 msiexec.exe 54 4048 msiexec.exe 55 4048 msiexec.exe 56 4048 msiexec.exe 57 4048 msiexec.exe 58 4048 msiexec.exe 59 4048 msiexec.exe 60 4048 msiexec.exe 61 4048 msiexec.exe 62 4048 msiexec.exe 63 4048 msiexec.exe 64 4048 msiexec.exe 65 4048 msiexec.exe 69 4048 msiexec.exe 70 4048 msiexec.exe 71 4048 msiexec.exe 72 4048 msiexec.exe 73 4048 msiexec.exe 74 4048 msiexec.exe 75 4048 msiexec.exe 76 4048 msiexec.exe 77 4048 msiexec.exe 78 4048 msiexec.exe 79 4048 msiexec.exe 80 4048 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3340 set thread context of 5012 3340 f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe 83 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\PROGRA~3\LOCALS~1\Temp\ccejtub.com msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 5012 f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe 5012 f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3340 wrote to memory of 5012 3340 f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe 83 PID 3340 wrote to memory of 5012 3340 f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe 83 PID 3340 wrote to memory of 5012 3340 f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe 83 PID 3340 wrote to memory of 5012 3340 f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe 83 PID 3340 wrote to memory of 5012 3340 f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe 83 PID 3340 wrote to memory of 5012 3340 f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe 83 PID 5012 wrote to memory of 4048 5012 f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe 84 PID 5012 wrote to memory of 4048 5012 f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe 84 PID 5012 wrote to memory of 4048 5012 f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe"C:\Users\Admin\AppData\Local\Temp\f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe"C:\Users\Admin\AppData\Local\Temp\f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\syswow64\msiexec.exe3⤵
- Adds policy Run key to start application
- Blocklisted process makes network request
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4048
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292.exe
Filesize92KB
MD5471bddb0d9298833db377340d5ae743b
SHA13772593ed810eb5acc1c1e7e1d4b9fc6ca2eed99
SHA256f254a28733492fdd057ba80624b0c63b78e2bba0743a9a4e07fd29481cd48292
SHA51232ab7991589a8d3ad9d5aceafeee589f62e2387472e6df6b380b2adf3eb7f618c70fd544694b9602b38c082355903c25989e1c2ab2628bddaf25496e09a577c5