YARA Detection Rule: MAL_APT_NK_WIN_DTrack_Auto
Repository: Neo23x0/signature-base
Detects: Detects DTrack variant used by Andariel
Author: CISA.gov
Reference: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a

Pattern signatures:
$sequence_0 = { 52 8b 45 08 50 e8 ?? ?? ?? ?? 83 c4 14 8b 4d 10 51 }
      // n = 7, score = 400
      //   52                   | push                edx
      //   8b4508               | mov                 eax, dword ptr [ebp + 8]
      //   50                   | push                eax
      //   e8????????           |                     
      //   83c414               | add                 esp, 0x14
      //   8b4d10               | mov                 ecx, dword ptr [ebp + 0x10]
      //   51                   | push                ecx

      $sequence_1 = { 3a 41 01 75 23 83 85 4c f6 ff ff 02 83 85 50 f6 ff ff 02 80 bd 4a f6 ff ff 00 75 ae c7 85 44 f6 ff ff 00 00 00 00 }
      // n = 7, score = 300
      //   3a4101               | cmp                 al, byte ptr [ecx + 1]
      //    7523                 | jne                 0x25
      //   83854cf6ffff02       | add                 dword ptr [ebp - 0x9b4], 2
      //   838550f6ffff02       | add                 dword ptr 

Detection condition:
filesize < 1700KB and 7 of them

Full rule:
rule MAL_APT_NK_WIN_DTrack_Auto {
   meta:
      author = "CISA.gov"
      description = "Detects DTrack variant used by Andariel"
      reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
      date = "2024-07-25"
      score = 75
      id = "1b40c685-beba-50fa-b484-c1526577cb23"
   strings:
      $sequence_0 = { 52 8b 45 08 50 e8 ?? ?? ?? ?? 83 c4 14 8b 4d 10 51 }
      // n = 7, score = 400
      //   52                   | push                edx
      //   8b4508               | mov                 eax, dword ptr [ebp + 8]
      //   50                   | push                eax
      //   e8????????           |                     
      //   83c414               | add                 esp, 0x14
      //   8b4d10               | mov                 ecx, dword ptr [ebp + 0x10]
      //   51                   | push                ecx

      $sequence_1 = { 3a 41 01 75 23 83 85 4c f6 ff ff 02 83 85 50 f6 ff ff 02 80 bd 4a f6 ff ff 00 75 ae c7 85 44 f6 ff ff 00 00 00 00 }
      // n = 7, score = 300
      //   3a4101               | cmp                 al, byte ptr [ecx + 1]
      //    7523                 | jne                 0x25
      //   83854cf6ffff02       | add                 dword ptr [ebp - 0x9b4], 2
      //   838550f6ffff02       | add                 dword ptr [ebp - 0x9b0], 2
      //   80bd4af6ffff00       | cmp                 byte ptr [ebp - 0x9b6], 0
      //   75ae                 | jne                 0xffffffb0
      //   c78544f6ffff00000000     | mov     dword ptr [ebp - 0x9bc], 0

      $sequence_2 = { 50 ff 15 ?? ?? ?? ?? a3 ?? ?? ?? ?? 68 ?? ?? ?? ?? e8 ?? ?? ?? ?? 83 c4 04 50 }
      // n = 7, score = 300
      //   50                   | push                eax
      //   ff15????????         |                     
      //   a3????????           |                     
      //   68????????           |                     
      //   e8????????           |                     
      //   83c404