Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02-12-2024 17:59
Static task
static1
Behavioral task
behavioral1
Sample
e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe
Resource
win10v2004-20241007-en
General
-
Target
e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe
-
Size
188KB
-
MD5
c688ed5964c126491c7dadb1a24593c0
-
SHA1
c62f72d8dd6321b00001a61478ae724e6828b899
-
SHA256
e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7
-
SHA512
ef85cb478cdb38d9fefb46f1c9d6cccbc26fb24e83eea2e3934a41f2a8cc7dd10e45f1bb22d05c2ddf7dc3aa41b296ac604ea8eb59fbc958cf087f3f4dc8ac46
-
SSDEEP
3072:FW+1oS4l5OeuQdrmwvL8EqL0WTb6mw6erykkA+qiD0WR48pEjGbs4Eo6R6FB6e1F:Ffwl5IQdyfEFkA+qiD0WR48pEjGbsbCj
Malware Config
Signatures
-
Andromeda family
-
Detects Andromeda payload. 3 IoCs
resource yara_rule behavioral1/memory/1644-4-0x0000000000400000-0x0000000000409000-memory.dmp family_andromeda behavioral1/memory/1644-6-0x0000000000400000-0x0000000000409000-memory.dmp family_andromeda behavioral1/memory/1644-8-0x0000000000400000-0x0000000000409000-memory.dmp family_andromeda -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1732 set thread context of 1644 1732 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe 30 -
Program crash 1 IoCs
pid pid_target Process procid_target 1788 2280 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1644 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe 1644 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1732 wrote to memory of 1644 1732 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe 30 PID 1732 wrote to memory of 1644 1732 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe 30 PID 1732 wrote to memory of 1644 1732 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe 30 PID 1732 wrote to memory of 1644 1732 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe 30 PID 1732 wrote to memory of 1644 1732 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe 30 PID 1732 wrote to memory of 1644 1732 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe 30 PID 1732 wrote to memory of 1644 1732 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe 30 PID 1644 wrote to memory of 2280 1644 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe 31 PID 1644 wrote to memory of 2280 1644 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe 31 PID 1644 wrote to memory of 2280 1644 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe 31 PID 1644 wrote to memory of 2280 1644 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe 31 PID 1644 wrote to memory of 2280 1644 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe 31 PID 1644 wrote to memory of 2280 1644 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe 31 PID 1644 wrote to memory of 2280 1644 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe 31 PID 2280 wrote to memory of 1788 2280 msiexec.exe 32 PID 2280 wrote to memory of 1788 2280 msiexec.exe 32 PID 2280 wrote to memory of 1788 2280 msiexec.exe 32 PID 2280 wrote to memory of 1788 2280 msiexec.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe"C:\Users\Admin\AppData\Local\Temp\e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe"C:\Users\Admin\AppData\Local\Temp\e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\syswow64\msiexec.exeC:\Windows\syswow64\msiexec.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 2684⤵
- Program crash
PID:1788
-
-
-