Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17-01-2025 04:39
General
-
Target
5fdc8a83e8eea70f40a7b459d64e0a1c00dab1f8ad6b0639e072f16d5853ace0.exe
-
Size
256KB
-
MD5
14e301480a696569f9b540f1d6d5def1
-
SHA1
a30157c5215fc2dcaebcb7b876b957d1ae86653d
-
SHA256
5fdc8a83e8eea70f40a7b459d64e0a1c00dab1f8ad6b0639e072f16d5853ace0
-
SHA512
f8ab5a4171f382716173fbbc8d78f350a731206c0f828a9bccd0988809eaa7154706314ab7801bd7e1bb5dacd6fb1cc6e6a9b5d035497996035d07c01194c94a
-
SSDEEP
3072:8p/eo907aqrza8YQPAqAlPGphUpI4a8yfRkENI6HW4Jvrm:8pXIa8YQlAlmh+yrq
Malware Config
Signatures
-
Andromeda family
-
Andromeda, Gamarue
Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.
-
Detects Andromeda payload. 4 IoCs
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fdc8a83e8eea70f40a7b459d64e0a1c00dab1f8ad6b0639e072f16d5853ace0.exe"C:\Users\Admin\AppData\Local\Temp\5fdc8a83e8eea70f40a7b459d64e0a1c00dab1f8ad6b0639e072f16d5853ace0.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5fdc8a83e8eea70f40a7b459d64e0a1c00dab1f8ad6b0639e072f16d5853ace0.exe"C:\Users\Admin\AppData\Local\Temp\5fdc8a83e8eea70f40a7b459d64e0a1c00dab1f8ad6b0639e072f16d5853ace0.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\syswow64\svchost.exe3⤵
- Adds policy Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD514e301480a696569f9b540f1d6d5def1
SHA1a30157c5215fc2dcaebcb7b876b957d1ae86653d
SHA2565fdc8a83e8eea70f40a7b459d64e0a1c00dab1f8ad6b0639e072f16d5853ace0
SHA512f8ab5a4171f382716173fbbc8d78f350a731206c0f828a9bccd0988809eaa7154706314ab7801bd7e1bb5dacd6fb1cc6e6a9b5d035497996035d07c01194c94a
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
20KB
-
Filesize
20KB