Analysis
-
max time kernel
141s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:10
Static task
static1
Behavioral task
behavioral1
Sample
CONTRACT PO CONFIRMATION!.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
CONTRACT PO CONFIRMATION!.exe
Resource
win10v2004-20220414-en
General
-
Target
CONTRACT PO CONFIRMATION!.exe
-
Size
1.1MB
-
MD5
bacf582001e91e3393c2aef245ace9a0
-
SHA1
c53e68fe71b695e2c7fb6c05aedb422bf5856f7b
-
SHA256
4474bd1e6a8472755ccac7d31beeefa7575b8b89610b71d1d08cf95a0ca17358
-
SHA512
0f7f7117b8551f1f91da85bc933185b1f3729bca987471ef29ba779e328eefbc9d1d6e0cdc3183cbac674800d32eb2f3eccdc2ae28561d57bce3731b910b99cc
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4248-139-0x0000000000400000-0x00000000004B8000-memory.dmp family_masslogger -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
CONTRACT PO CONFIRMATION!.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion CONTRACT PO CONFIRMATION!.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion CONTRACT PO CONFIRMATION!.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
CONTRACT PO CONFIRMATION!.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum CONTRACT PO CONFIRMATION!.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 CONTRACT PO CONFIRMATION!.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
CONTRACT PO CONFIRMATION!.exedescription pid process target process PID 2992 set thread context of 4248 2992 CONTRACT PO CONFIRMATION!.exe CONTRACT PO CONFIRMATION!.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
CONTRACT PO CONFIRMATION!.exeCONTRACT PO CONFIRMATION!.exepowershell.exepid process 2992 CONTRACT PO CONFIRMATION!.exe 2992 CONTRACT PO CONFIRMATION!.exe 4248 CONTRACT PO CONFIRMATION!.exe 4248 CONTRACT PO CONFIRMATION!.exe 4520 powershell.exe 4520 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
CONTRACT PO CONFIRMATION!.exeCONTRACT PO CONFIRMATION!.exepowershell.exedescription pid process Token: SeDebugPrivilege 2992 CONTRACT PO CONFIRMATION!.exe Token: SeDebugPrivilege 4248 CONTRACT PO CONFIRMATION!.exe Token: SeDebugPrivilege 4520 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
CONTRACT PO CONFIRMATION!.exeCONTRACT PO CONFIRMATION!.execmd.exedescription pid process target process PID 2992 wrote to memory of 5112 2992 CONTRACT PO CONFIRMATION!.exe CONTRACT PO CONFIRMATION!.exe PID 2992 wrote to memory of 5112 2992 CONTRACT PO CONFIRMATION!.exe CONTRACT PO CONFIRMATION!.exe PID 2992 wrote to memory of 5112 2992 CONTRACT PO CONFIRMATION!.exe CONTRACT PO CONFIRMATION!.exe PID 2992 wrote to memory of 4248 2992 CONTRACT PO CONFIRMATION!.exe CONTRACT PO CONFIRMATION!.exe PID 2992 wrote to memory of 4248 2992 CONTRACT PO CONFIRMATION!.exe CONTRACT PO CONFIRMATION!.exe PID 2992 wrote to memory of 4248 2992 CONTRACT PO CONFIRMATION!.exe CONTRACT PO CONFIRMATION!.exe PID 2992 wrote to memory of 4248 2992 CONTRACT PO CONFIRMATION!.exe CONTRACT PO CONFIRMATION!.exe PID 2992 wrote to memory of 4248 2992 CONTRACT PO CONFIRMATION!.exe CONTRACT PO CONFIRMATION!.exe PID 2992 wrote to memory of 4248 2992 CONTRACT PO CONFIRMATION!.exe CONTRACT PO CONFIRMATION!.exe PID 2992 wrote to memory of 4248 2992 CONTRACT PO CONFIRMATION!.exe CONTRACT PO CONFIRMATION!.exe PID 2992 wrote to memory of 4248 2992 CONTRACT PO CONFIRMATION!.exe CONTRACT PO CONFIRMATION!.exe PID 4248 wrote to memory of 2880 4248 CONTRACT PO CONFIRMATION!.exe cmd.exe PID 4248 wrote to memory of 2880 4248 CONTRACT PO CONFIRMATION!.exe cmd.exe PID 4248 wrote to memory of 2880 4248 CONTRACT PO CONFIRMATION!.exe cmd.exe PID 2880 wrote to memory of 4520 2880 cmd.exe powershell.exe PID 2880 wrote to memory of 4520 2880 cmd.exe powershell.exe PID 2880 wrote to memory of 4520 2880 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CONTRACT PO CONFIRMATION!.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACT PO CONFIRMATION!.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CONTRACT PO CONFIRMATION!.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACT PO CONFIRMATION!.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\CONTRACT PO CONFIRMATION!.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACT PO CONFIRMATION!.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\CONTRACT PO CONFIRMATION!.exe' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\CONTRACT PO CONFIRMATION!.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CONTRACT PO CONFIRMATION!.exe.logFilesize
1KB
MD55200da2e50f24d5d543c3f10674acdcb
SHA1b574a3336839882d799c0a7f635ea238efb934ee
SHA256d2d81c1c9d35bc66149beaa77029bee68664d8512fc1efe373180bab77d61026
SHA51224722a7de3250a6027a411c8b79d0720554c4efd59553f54b94ab77dc21efbf3191e0912901db475f08a6e9c1855d9e9594504d80d27300097418f4384a9d9cb
-
memory/2880-141-0x0000000000000000-mapping.dmp
-
memory/2992-135-0x00000000052F0000-0x0000000005346000-memory.dmpFilesize
344KB
-
memory/2992-131-0x0000000005140000-0x00000000051DC000-memory.dmpFilesize
624KB
-
memory/2992-134-0x00000000050D0000-0x00000000050DA000-memory.dmpFilesize
40KB
-
memory/2992-130-0x0000000000620000-0x0000000000740000-memory.dmpFilesize
1.1MB
-
memory/2992-136-0x0000000006490000-0x00000000064F6000-memory.dmpFilesize
408KB
-
memory/2992-133-0x0000000005250000-0x00000000052E2000-memory.dmpFilesize
584KB
-
memory/2992-132-0x0000000005800000-0x0000000005DA4000-memory.dmpFilesize
5.6MB
-
memory/4248-138-0x0000000000000000-mapping.dmp
-
memory/4248-139-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/4520-145-0x00000000054C0000-0x00000000054E2000-memory.dmpFilesize
136KB
-
memory/4520-142-0x0000000000000000-mapping.dmp
-
memory/4520-143-0x0000000002B50000-0x0000000002B86000-memory.dmpFilesize
216KB
-
memory/4520-144-0x0000000005670000-0x0000000005C98000-memory.dmpFilesize
6.2MB
-
memory/4520-146-0x0000000005CA0000-0x0000000005D06000-memory.dmpFilesize
408KB
-
memory/4520-147-0x00000000064E0000-0x00000000064FE000-memory.dmpFilesize
120KB
-
memory/4520-148-0x0000000007B30000-0x00000000081AA000-memory.dmpFilesize
6.5MB
-
memory/4520-149-0x00000000069C0000-0x00000000069DA000-memory.dmpFilesize
104KB
-
memory/4520-150-0x0000000007750000-0x00000000077E6000-memory.dmpFilesize
600KB
-
memory/4520-151-0x0000000006AB0000-0x0000000006AD2000-memory.dmpFilesize
136KB
-
memory/5112-137-0x0000000000000000-mapping.dmp