Analysis
-
max time kernel
112s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2024 17:59
Static task
static1
Behavioral task
behavioral1
Sample
e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe
Resource
win10v2004-20241007-en
General
-
Target
e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe
-
Size
188KB
-
MD5
c688ed5964c126491c7dadb1a24593c0
-
SHA1
c62f72d8dd6321b00001a61478ae724e6828b899
-
SHA256
e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7
-
SHA512
ef85cb478cdb38d9fefb46f1c9d6cccbc26fb24e83eea2e3934a41f2a8cc7dd10e45f1bb22d05c2ddf7dc3aa41b296ac604ea8eb59fbc958cf087f3f4dc8ac46
-
SSDEEP
3072:FW+1oS4l5OeuQdrmwvL8EqL0WTb6mw6erykkA+qiD0WR48pEjGbs4Eo6R6FB6e1F:Ffwl5IQdyfEFkA+qiD0WR48pEjGbsbCj
Malware Config
Signatures
-
Andromeda family
-
Detects Andromeda payload. 5 IoCs
resource yara_rule behavioral2/memory/2908-0-0x0000000000400000-0x0000000000409000-memory.dmp family_andromeda behavioral2/memory/2908-2-0x0000000000400000-0x0000000000409000-memory.dmp family_andromeda behavioral2/memory/4740-10-0x00000000001D0000-0x00000000001D5000-memory.dmp family_andromeda behavioral2/memory/4740-12-0x00000000001D0000-0x00000000001D5000-memory.dmp family_andromeda behavioral2/memory/4740-16-0x00000000001D0000-0x00000000001D5000-memory.dmp family_andromeda -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\52067 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\ccaglpt.com" msiexec.exe -
Blocklisted process makes network request 25 IoCs
flow pid Process 16 4740 msiexec.exe 17 4740 msiexec.exe 18 4740 msiexec.exe 19 4740 msiexec.exe 20 4740 msiexec.exe 21 4740 msiexec.exe 22 4740 msiexec.exe 26 4740 msiexec.exe 27 4740 msiexec.exe 28 4740 msiexec.exe 29 4740 msiexec.exe 30 4740 msiexec.exe 31 4740 msiexec.exe 53 4740 msiexec.exe 54 4740 msiexec.exe 55 4740 msiexec.exe 56 4740 msiexec.exe 57 4740 msiexec.exe 58 4740 msiexec.exe 59 4740 msiexec.exe 60 4740 msiexec.exe 61 4740 msiexec.exe 62 4740 msiexec.exe 63 4740 msiexec.exe 64 4740 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3716 set thread context of 2908 3716 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe 83 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\PROGRA~3\LOCALS~1\Temp\ccaglpt.com msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2908 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe 2908 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3716 wrote to memory of 2908 3716 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe 83 PID 3716 wrote to memory of 2908 3716 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe 83 PID 3716 wrote to memory of 2908 3716 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe 83 PID 3716 wrote to memory of 2908 3716 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe 83 PID 3716 wrote to memory of 2908 3716 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe 83 PID 3716 wrote to memory of 2908 3716 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe 83 PID 2908 wrote to memory of 4740 2908 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe 84 PID 2908 wrote to memory of 4740 2908 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe 84 PID 2908 wrote to memory of 4740 2908 e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe"C:\Users\Admin\AppData\Local\Temp\e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe"C:\Users\Admin\AppData\Local\Temp\e5f8f92f0942557fcd92f4bf5d91e96a03d83ad41435dcb3f61d8069d384a3f7N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\syswow64\msiexec.exe3⤵
- Adds policy Run key to start application
- Blocklisted process makes network request
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4740
-
-