MAL_APT_NK_WIN_DTrack_Auto


Description

Detects DTrack variant used by Andariel

Query · yara

strings:
      $sequence_0 = { 52 8b 45 08 50 e8 ?? ?? ?? ?? 83 c4 14 8b 4d 10 51 }
      // n = 7, score = 400
      //   52                   | push                edx
      //   8b4508               | mov                 eax, dword ptr [ebp + 8]
      //   50                   | push                eax
      //   e8????????           |                     
      //   83c414               | add                 esp, 0x14
      //   8b4d10               | mov                 ecx, dword ptr [ebp + 0x10]
      //   51                   | push                ecx

      $sequence_1 = { 3a 41 01 75 23 83 85 4c f6 ff ff 02 83 85 50 f6 ff ff 02 80 bd 4a f6 ff ff 00 75 ae c7 85 44 f6 ff ff 00 00 00 00 }
      // n = 7, score = 300
      //   3a4101               | cmp                 al, byte ptr [ecx + 1]
      //    7523                 | jne                 0x25
      //   83854cf6ffff02       | add                 dword ptr [ebp - 0x9b4], 2
      //   838550f6ffff02       | add                 dword ptr [ebp - 0x9b0], 2
      //   80bd4af6ffff00       | cmp                 byte ptr [ebp - 0x9b6], 0
      //   75ae                 | jne                 0xffffffb0
      //   c78544f6ffff00000000     | mov     dword ptr [ebp - 0x9bc], 0

      $sequence_2 = { 50 ff 15 ?? ?? ?? ?? a3 ?? ?? ?? ?? 68 ?? ?? ?? ?? e8 ?? ?? ?? ?? 83 c4 04 50 }
      // n = 7, score = 300
      //   50                   | push                eax
      //   ff15????????         |                     
      //   a3????????           |                     
      //   68????????           |                     
      //   e8????????           |                     
      //   83c404               | add                 esp, 4
      //   50                   | push                eax

      $sequence_3 = { 8d 8d d4 fa ff ff 51 e8 ?? ?? ?? ?? 83 c4 08 8b 15 ?? ?? ?? ?? }
      // n = 5, score = 300
      //   8d8dd4faffff         | lea                 ecx, [ebp - 0x52c]
      //   51                   | push                ecx
      //   e8????????           |                     
      //   83c408               | add                 esp, 8
      //   8b15????????         |                     

      $sequence_4 = { 88 55 f5 6a 5c 8b 45 0c 50 e8 ?? ?? ?? ?? }
      // n = 5, score = 300
      //   8855f5               | mov                 byte ptr [ebp - 0xb], dl
      //   6a5c                 | push                0x5c
      //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
      //   50                   | push                eax
      //   e8????????           |                     

      $sequence_5 = { 51 e8 ?? ?? ?? ?? 83 c4 10 8b 55 8c 52 }
      // n = 5, score = 300
      //   51                   | push                ecx
      //   e8????????           |                     
      //   83c410               | add                 esp, 0x10
      //   8b558c                | mov                 edx, dword ptr [ebp - 0x74]
      //   52                   | push                edx

      $sequence_6 = { 8b 4d 0c 51 68 ?? ?? ?? ?? 8d 95 60 ea ff ff 52 e8 ?? ?? ?? ?? }
      // n = 6, score = 300
      //   8b4d0c               | mov                 ecx, dword ptr [ebp + 0xc]
      //   51                   | push                ecx
      //   68????????           |                     
      //   8d9560eaffff         | lea                 edx, [ebp - 0x15a0]
      //   52                   | push                edx
      //   e8????????           |                     

      $sequence_7 = { 83 c0 01 89 45 f4 83 7d f4 20 7d 2c 8b 4d f8 }
      // n = 5, score = 300
      //   83c001               | add                 eax, 1
      //   8945f4               | mov                 dword ptr [ebp - 0xc], eax
      //   837df420             | cmp                 dword ptr [ebp - 0xc], 0x20
      //   7d2c                 | jge                 0x2e
      //   8b4df8               | mov                 ecx, dword ptr [ebp - 8]

      $sequence_8 = { 83 c0 01 89 85 6c f6 ff ff 8b 8d 70 f6 ff ff 8a 11 }
      // n = 4, score = 300
      //   83c001               | add                 eax, 1
      //   89856cf6ffff         | mov                 dword ptr [ebp - 0x994], eax
      //   8b8d70f6ffff         | mov                 ecx, dword ptr [ebp - 0x990]
      //   8a11                 | mov                 dl, byte ptr [ecx]

      $sequence_9 = { 03 55 f0 0f b6 02 0f b6 4d f7 33 c1 0f b6 55 fc 33 c2 }
      // n = 6, score = 200
      //   0355f0               | add                 edx, dword ptr [ebp - 0x10]
      //   0fb602               | movzx               eax, byte ptr [edx]
      //   0fb64df7             | movzx               ecx, byte ptr [ebp - 9]
      //   33c1                 | xor                 eax, ecx
      //    0fb655fc             | movzx               edx, byte ptr [ebp - 4]
      //   33c2                 | xor                 eax, edx

      $sequence_10 = { d1 e9 89 4d f8 8b 55 18 89 55 fc c7 45 f0 00 00 00 00 }
      // n = 5, score = 200
      //   d1e9                 | shr                 ecx, 1
      //   894df8               | mov                 dword ptr [ebp - 8], ecx
      //   8b5518               | mov                 edx, dword ptr [ebp + 0x18]
      //   8955fc               | mov                 dword ptr [ebp - 4], edx
      //   c745f000000000       | mov                 dword ptr [ebp - 0x10], 0

      $sequence_11 = { 8b 4d f0 3b 4d 10 0f 8d 90 00 00 00 8b 55 08 03 55 f0 0f b6 02 }
      // n = 6, score = 200
      //   8b4df0               | mov                 ecx, dword ptr [ebp - 0x10]
      //   3b4d10               | cmp                 ecx, dword ptr [ebp + 0x10]
      //   0f8d90000000         | jge                 0x96
      //   8b5508               | mov                 edx, dword ptr [ebp + 8]
      //   0355f0               | add                 edx, dword ptr [ebp - 0x10]
      //   0fb602               | movzx               eax, byte ptr [edx]

      $sequence_12 = { 89 4d 14 8b 45 f8 c1 e0 18 8b 4d fc c1 e9 08 0b c1 }
      // n = 6, score = 200
      //   894d14               | mov                 dword ptr [ebp + 0x14], ecx
      //   8b45f8               | mov                 eax, dword ptr [ebp - 8]
      //   c1e018               | shl                 eax, 0x18
      //   8b4dfc               | mov                 ecx, dword ptr [ebp - 4]
      //   c1e908               | shr                 ecx, 8
      //   0bc1                 | or                  eax, ecx

      $sequence_13 = { 0b c1 89 45 18 8b 55 14 89 55 f8 }
      // n = 4, score = 200
      //   0bc1                 | or                  eax, ecx
      //   894518               | mov                 dword ptr [ebp + 0x18], eax
      //   8b5514               | mov                 edx, dword ptr [ebp + 0x14]
      //   8955f8               | mov                 dword ptr [ebp - 8], edx

      $sequence_14 = { 8b 55 14 89 55 f8 8b 45 18 89 45 fc e9 ?? ?? ?? ?? 8b e5 }
   // n = 6, score = 200
   //   8b5514               | mov                 edx, dword ptr [ebp + 0x14]
   //   8955f8               | mov                 dword ptr [ebp - 8], edx
   //   8b4518               | mov                 eax, dword ptr [ebp + 0x18]
   //   8945fc               | mov                 dword ptr [ebp - 4], eax
   //   e9????????           |                     
   //   8be5                 | mov                 esp, ebp
   condition:
      filesize < 1700KB and 7 of them
Raw source MAL_APT_NK_WIN_DTrack_Auto · YARA
Esc
Published by Neo23x0/signature-base ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified.
rule MAL_APT_NK_WIN_DTrack_Auto {
   meta:
      author = "CISA.gov"
      description = "Detects DTrack variant used by Andariel"
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
      date = "2024-07-25"
      score = 75
      id = "1b40c685-beba-50fa-b484-c1526577cb23"
   strings:
      $sequence_0 = { 52 8b 45 08 50 e8 ?? ?? ?? ?? 83 c4 14 8b 4d 10 51 }
      // n = 7, score = 400
      //   52                   | push                edx
      //   8b4508               | mov                 eax, dword ptr [ebp + 8]
      //   50                   | push                eax
      //   e8????????           |                     
      //   83c414               | add                 esp, 0x14
      //   8b4d10               | mov                 ecx, dword ptr [ebp + 0x10]
      //   51                   | push                ecx

      $sequence_1 = { 3a 41 01 75 23 83 85 4c f6 ff ff 02 83 85 50 f6 ff ff 02 80 bd 4a f6 ff ff 00 75 ae c7 85 44 f6 ff ff 00 00 00 00 }
      // n = 7, score = 300
      //   3a4101               | cmp                 al, byte ptr [ecx + 1]
      //    7523                 | jne                 0x25
      //   83854cf6ffff02       | add                 dword ptr [ebp - 0x9b4], 2
      //   838550f6ffff02       | add                 dword ptr [ebp - 0x9b0], 2
      //   80bd4af6ffff00       | cmp                 byte ptr [ebp - 0x9b6], 0
      //   75ae                 | jne                 0xffffffb0
      //   c78544f6ffff00000000     | mov     dword ptr [ebp - 0x9bc], 0

      $sequence_2 = { 50 ff 15 ?? ?? ?? ?? a3 ?? ?? ?? ?? 68 ?? ?? ?? ?? e8 ?? ?? ?? ?? 83 c4 04 50 }
      // n = 7, score = 300
      //   50                   | push                eax
      //   ff15????????         |                     
      //   a3????????           |                     
      //   68????????           |                     
      //   e8????????           |                     
      //   83c404               | add                 esp, 4
      //   50                   | push                eax

      $sequence_3 = { 8d 8d d4 fa ff ff 51 e8 ?? ?? ?? ?? 83 c4 08 8b 15 ?? ?? ?? ?? }
      // n = 5, score = 300
      //   8d8dd4faffff         | lea                 ecx, [ebp - 0x52c]
      //   51                   | push                ecx
      //   e8????????           |                     
      //   83c408               | add                 esp, 8
      //   8b15????????         |                     

      $sequence_4 = { 88 55 f5 6a 5c 8b 45 0c 50 e8 ?? ?? ?? ?? }
      // n = 5, score = 300
      //   8855f5               | mov                 byte ptr [ebp - 0xb], dl
      //   6a5c                 | push                0x5c
      //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
      //   50                   | push                eax
      //   e8????????           |                     

      $sequence_5 = { 51 e8 ?? ?? ?? ?? 83 c4 10 8b 55 8c 52 }
      // n = 5, score = 300
      //   51                   | push                ecx
      //   e8????????           |                     
      //   83c410               | add                 esp, 0x10
      //   8b558c                | mov                 edx, dword ptr [ebp - 0x74]
      //   52                   | push                edx

      $sequence_6 = { 8b 4d 0c 51 68 ?? ?? ?? ?? 8d 95 60 ea ff ff 52 e8 ?? ?? ?? ?? }
      // n = 6, score = 300
      //   8b4d0c               | mov                 ecx, dword ptr [ebp + 0xc]
      //   51                   | push                ecx
      //   68????????           |                     
      //   8d9560eaffff         | lea                 edx, [ebp - 0x15a0]
      //   52                   | push                edx
      //   e8????????           |                     

      $sequence_7 = { 83 c0 01 89 45 f4 83 7d f4 20 7d 2c 8b 4d f8 }
      // n = 5, score = 300
      //   83c001               | add                 eax, 1
      //   8945f4               | mov                 dword ptr [ebp - 0xc], eax
      //   837df420             | cmp                 dword ptr [ebp - 0xc], 0x20
      //   7d2c                 | jge                 0x2e
      //   8b4df8               | mov                 ecx, dword ptr [ebp - 8]

      $sequence_8 = { 83 c0 01 89 85 6c f6 ff ff 8b 8d 70 f6 ff ff 8a 11 }
      // n = 4, score = 300
      //   83c001               | add                 eax, 1
      //   89856cf6ffff         | mov                 dword ptr [ebp - 0x994], eax
      //   8b8d70f6ffff         | mov                 ecx, dword ptr [ebp - 0x990]
      //   8a11                 | mov                 dl, byte ptr [ecx]

      $sequence_9 = { 03 55 f0 0f b6 02 0f b6 4d f7 33 c1 0f b6 55 fc 33 c2 }
      // n = 6, score = 200
      //   0355f0               | add                 edx, dword ptr [ebp - 0x10]
      //   0fb602               | movzx               eax, byte ptr [edx]
      //   0fb64df7             | movzx               ecx, byte ptr [ebp - 9]
      //   33c1                 | xor                 eax, ecx
      //    0fb655fc             | movzx               edx, byte ptr [ebp - 4]
      //   33c2                 | xor                 eax, edx

      $sequence_10 = { d1 e9 89 4d f8 8b 55 18 89 55 fc c7 45 f0 00 00 00 00 }
      // n = 5, score = 200
      //   d1e9                 | shr                 ecx, 1
      //   894df8               | mov                 dword ptr [ebp - 8], ecx
      //   8b5518               | mov                 edx, dword ptr [ebp + 0x18]
      //   8955fc               | mov                 dword ptr [ebp - 4], edx
      //   c745f000000000       | mov                 dword ptr [ebp - 0x10], 0

      $sequence_11 = { 8b 4d f0 3b 4d 10 0f 8d 90 00 00 00 8b 55 08 03 55 f0 0f b6 02 }
      // n = 6, score = 200
      //   8b4df0               | mov                 ecx, dword ptr [ebp - 0x10]
      //   3b4d10               | cmp                 ecx, dword ptr [ebp + 0x10]
      //   0f8d90000000         | jge                 0x96
      //   8b5508               | mov                 edx, dword ptr [ebp + 8]
      //   0355f0               | add                 edx, dword ptr [ebp - 0x10]
      //   0fb602               | movzx               eax, byte ptr [edx]

      $sequence_12 = { 89 4d 14 8b 45 f8 c1 e0 18 8b 4d fc c1 e9 08 0b c1 }
      // n = 6, score = 200
      //   894d14               | mov                 dword ptr [ebp + 0x14], ecx
      //   8b45f8               | mov                 eax, dword ptr [ebp - 8]
      //   c1e018               | shl                 eax, 0x18
      //   8b4dfc               | mov                 ecx, dword ptr [ebp - 4]
      //   c1e908               | shr                 ecx, 8
      //   0bc1                 | or                  eax, ecx

      $sequence_13 = { 0b c1 89 45 18 8b 55 14 89 55 f8 }
      // n = 4, score = 200
      //   0bc1                 | or                  eax, ecx
      //   894518               | mov                 dword ptr [ebp + 0x18], eax
      //   8b5514               | mov                 edx, dword ptr [ebp + 0x14]
      //   8955f8               | mov                 dword ptr [ebp - 8], edx

      $sequence_14 = { 8b 55 14 89 55 f8 8b 45 18 89 45 fc e9 ?? ?? ?? ?? 8b e5 }
   // n = 6, score = 200
   //   8b5514               | mov                 edx, dword ptr [ebp + 0x14]
   //   8955f8               | mov                 dword ptr [ebp - 8], edx
   //   8b4518               | mov                 eax, dword ptr [ebp + 0x18]
   //   8945fc               | mov                 dword ptr [ebp - 4], eax
   //   e9????????           |                     
   //   8be5                 | mov                 esp, ebp
   condition:
      filesize < 1700KB and 7 of them
}

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.