andromeda | ed71009996602ffafcd1b36d1d36d96a422c06bec90be098fa8e36c5b6801888

General

Target
jaffacakes118_Trojan.Win32.Inject.sbjd.exe
Size 93KB
Sample261018-vqaafastex
SHA256 ed71009996602ffafcd1b36d1d36d96a422c06bec90be098fa8e36c5b6801888
MD5 ac6ca7e2c54c145fd0e6171a65f09ce0
SHA1 de18398329df1f213702924a1babbb560289ab3a
SHA512 0f4bf5d089588109e3c3f6fe6327915ca52c53ef7d404d4495f347eda188d94b2fec084bb5b22c6575ba4b1b30a618e627fef0e34c806ca20f7ca86a6ca0aaf7
SSDEEP 1536:l6u6YB56XJ6owvzbNfURp4VntUhtH7Vi4Bh0Q:l6uB28owvlrVnihVVi4H0Q
TLSH
T1F2938D65FF828876D080007086ABAF523B7BD975756227E3BE850D0EFF642409FD3916
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor botnet defense_evasion discovery andromeda persistence privilege_escalation

Malware Config

Signatures

Family: Andromeda, Gamarue
Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.
botnet backdoor andromeda

Detects Andromeda payload. 4 IoCs

resource	yara_rule
behavioral1/memory/3368-0-0x0000000000400000-0x0000000000409000-memory.dmp	family_andromeda
behavioral1/memory/3368-4-0x0000000000400000-0x0000000000409000-memory.dmp	family_andromeda
behavioral1/memory/1908-11-0x0000000000F80000-0x0000000000F85000-memory.dmp	family_andromeda
behavioral1/memory/1908-15-0x0000000000F80000-0x0000000000F85000-memory.dmp	family_andromeda

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\53549 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\cccpmgajo.exe"	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
3368	jaffacakes118_Trojan.Win32.Inject.sbjd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2056 set thread context of 3368	2056	jaffacakes118_Trojan.Win32.Inject.sbjd.exe	83

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\LOCALS~1\Temp\cccpmgajo.exe	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Inject.sbjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Inject.sbjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
3368	jaffacakes118_Trojan.Win32.Inject.sbjd.exe
3368	jaffacakes118_Trojan.Win32.Inject.sbjd.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 3368	2056	jaffacakes118_Trojan.Win32.Inject.sbjd.exe	83
PID 2056 wrote to memory of 3368	2056	jaffacakes118_Trojan.Win32.Inject.sbjd.exe	83
PID 2056 wrote to memory of 3368	2056	jaffacakes118_Trojan.Win32.Inject.sbjd.exe	83
PID 2056 wrote to memory of 3368	2056	jaffacakes118_Trojan.Win32.Inject.sbjd.exe	83
PID 3368 wrote to memory of 1908	3368	jaffacakes118_Trojan.Win32.Inject.sbjd.exe	84

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.sbjd.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.sbjd.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.sbjd.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.sbjd.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3368
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - Adds policy Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:1908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Process Injection

Defense Evasion

Modify Registry

Process Injection

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_Trojan.Win32.Inject.sbjd.exe

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.sbjd.exe
Size 93KB
SHA256 ed71009996602ffafcd1b36d1d36d96a422c06bec90be098fa8e36c5b6801888
MD5 ac6ca7e2c54c145fd0e6171a65f09ce0
SHA1 de18398329df1f213702924a1babbb560289ab3a
SHA512 0f4bf5d089588109e3c3f6fe6327915ca52c53ef7d404d4495f347eda188d94b2fec084bb5b22c6575ba4b1b30a618e627fef0e34c806ca20f7ca86a6ca0aaf7
SSDEEP 1536:l6u6YB56XJ6owvzbNfURp4VntUhtH7Vi4Bh0Q:l6uB28owvlrVnihVVi4H0Q
TLSH
T1F2938D65FF828876D080007086ABAF523B7BD975756227E3BE850D0EFF642409FD3916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1908-9-0x0000000000A80000-0x0000000000A8E000-memory.dmp

Download

memory/1908-7-0x0000000000A80000-0x0000000000A8E000-memory.dmp

Download

memory/1908-11-0x0000000000F80000-0x0000000000F85000-memory.dmp

Download

memory/1908-15-0x0000000000F80000-0x0000000000F85000-memory.dmp

Download

memory/3368-0-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/3368-4-0x0000000000400000-0x0000000000409000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads