andromeda | 2fb9f75577fbbe730d75b8cf4e8baebd9cad15c6de976c11800c319173fd0d3b

General

Target

JaffaCakes118_2392128aa5f642053f4ca6ba428173d8.exe
Size

435KB
MD5

2392128aa5f642053f4ca6ba428173d8
SHA1

5dba22fc0ac3a978b12d36126bfd4b0edba645f9
SHA256

2fb9f75577fbbe730d75b8cf4e8baebd9cad15c6de976c11800c319173fd0d3b
SHA512

a1e5d6dfdf50438aacdb1bd3650879b6d8529b58f1ce0d85e04193e3bc98161264158e7703c6dc6676483d8231d40cbc72a0ec6127fb5adc10577387c861685c
SSDEEP

12288:HLJfHjIiVqy7kuHCdcKKabcxVsZQ9kFQKRfrFk5/I:rh5MmJHpfswkGae

Score

10^/10

andromeda backdoor botnet discovery persistence

Malware Config

Signatures

Andromeda family
andromeda
Andromeda, Gamarue
Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.
botnet backdoor andromeda

Detects Andromeda payload. 2 IoCs

resource	yara_rule
behavioral1/memory/2980-17-0x0000000000020000-0x0000000000025000-memory.dmp	family_andromeda
behavioral1/memory/2980-21-0x0000000000020000-0x0000000000025000-memory.dmp	family_andromeda

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe, C:\\Users\\Admin\\AppData\\Roaming\\andro\\andro.exe"	JaffaCakes118_2392128aa5f642053f4ca6ba428173d8.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\37752 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\msrxoqti.com"	svchost.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	vbc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	vbc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2840 set thread context of 2876	2840	JaffaCakes118_2392128aa5f642053f4ca6ba428173d8.exe	29

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\LOCALS~1\Temp\msrxoqti.com	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\MICROS~1.NET\FRAMEW~1\V20~1.507\vbc.exe	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2392128aa5f642053f4ca6ba428173d8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2876	vbc.exe
2840	JaffaCakes118_2392128aa5f642053f4ca6ba428173d8.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2876	vbc.exe
2876	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2840	JaffaCakes118_2392128aa5f642053f4ca6ba428173d8.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2876	2840	JaffaCakes118_2392128aa5f642053f4ca6ba428173d8.exe	29
PID 2840 wrote to memory of 2876	2840	JaffaCakes118_2392128aa5f642053f4ca6ba428173d8.exe	29
PID 2840 wrote to memory of 2876	2840	JaffaCakes118_2392128aa5f642053f4ca6ba428173d8.exe	29
PID 2840 wrote to memory of 2876	2840	JaffaCakes118_2392128aa5f642053f4ca6ba428173d8.exe	29
PID 2840 wrote to memory of 2876	2840	JaffaCakes118_2392128aa5f642053f4ca6ba428173d8.exe	29
PID 2840 wrote to memory of 2876	2840	JaffaCakes118_2392128aa5f642053f4ca6ba428173d8.exe	29
PID 2840 wrote to memory of 2876	2840	JaffaCakes118_2392128aa5f642053f4ca6ba428173d8.exe	29
PID 2876 wrote to memory of 2980	2876	vbc.exe	30
PID 2876 wrote to memory of 2980	2876	vbc.exe	30
PID 2876 wrote to memory of 2980	2876	vbc.exe	30
PID 2876 wrote to memory of 2980	2876	vbc.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2392128aa5f642053f4ca6ba428173d8.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2392128aa5f642053f4ca6ba428173d8.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\syswow64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - Adds policy Run key to start application
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2840-0-0x0000000074611000-0x0000000074612000-memory.dmp

Filesize
4KB

Download
memory/2840-1-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download
memory/2840-2-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download
memory/2840-15-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download
memory/2876-4-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2876-7-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2876-8-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2876-3-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2876-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2980-14-0x0000000000E30000-0x0000000000E38000-memory.dmp

Filesize
32KB

Download
memory/2980-12-0x0000000000E30000-0x0000000000E38000-memory.dmp

Filesize
32KB

Download
memory/2980-17-0x0000000000020000-0x0000000000025000-memory.dmp

Filesize
20KB

Download
memory/2980-21-0x0000000000020000-0x0000000000025000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads