Analysis
-
max time kernel
86s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:16
Static task
static1
Behavioral task
behavioral1
Sample
Order List.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Order List.exe
Resource
win10v2004-20220414-en
General
-
Target
Order List.exe
-
Size
937KB
-
MD5
f7ce9ae72c2106ca0b0b85188b43f758
-
SHA1
0a542637796e19ea1cb3379471ba69fcdd9b239e
-
SHA256
112d707367a7101031fb617c9514187ca68b817a27b6b6a2ecc1b737dc974a1a
-
SHA512
9acc72e4fbaaea6b720e9da0d6649d55d18e201d41d252a8e62dde77a5b4a9e709ffbaa2ca533217176c149c485e6a4390a402ebce29aa91af0cb6d957d8ede2
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\AEF946DCB4\Log.txt
masslogger
Signatures
-
CoreEntity .NET Packer 1 IoCs
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
Processes:
resource yara_rule behavioral1/memory/1824-56-0x00000000006A0000-0x00000000006A8000-memory.dmp coreentity -
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
Processes:
resource yara_rule behavioral1/memory/1824-57-0x0000000007670000-0x0000000007720000-memory.dmp rezer0 -
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Order List.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Order List.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Order List.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Order List.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation Order List.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Order List.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 Order List.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Order List.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Order List.exedescription pid process target process PID 1824 set thread context of 432 1824 Order List.exe Order List.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Order List.exeOrder List.exepid process 1824 Order List.exe 432 Order List.exe 432 Order List.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Order List.exeOrder List.exedescription pid process Token: SeDebugPrivilege 1824 Order List.exe Token: SeDebugPrivilege 432 Order List.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Order List.exedescription pid process target process PID 1824 wrote to memory of 1780 1824 Order List.exe schtasks.exe PID 1824 wrote to memory of 1780 1824 Order List.exe schtasks.exe PID 1824 wrote to memory of 1780 1824 Order List.exe schtasks.exe PID 1824 wrote to memory of 1780 1824 Order List.exe schtasks.exe PID 1824 wrote to memory of 432 1824 Order List.exe Order List.exe PID 1824 wrote to memory of 432 1824 Order List.exe Order List.exe PID 1824 wrote to memory of 432 1824 Order List.exe Order List.exe PID 1824 wrote to memory of 432 1824 Order List.exe Order List.exe PID 1824 wrote to memory of 432 1824 Order List.exe Order List.exe PID 1824 wrote to memory of 432 1824 Order List.exe Order List.exe PID 1824 wrote to memory of 432 1824 Order List.exe Order List.exe PID 1824 wrote to memory of 432 1824 Order List.exe Order List.exe PID 1824 wrote to memory of 432 1824 Order List.exe Order List.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order List.exe"C:\Users\Admin\AppData\Local\Temp\Order List.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kkJqtFyYwn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2BF1.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Order List.exe"{path}"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp2BF1.tmpFilesize
1KB
MD551f6623349f7cba434ddfb10ab948af4
SHA14cc186d43fbc1e849e85566cd111ba70366d8019
SHA2562936bbf65cb3f66decdbf1eb7c8124b2453c5d5b22e1c34636a70c48dd1a126f
SHA51249face211a7b60cb360abc8b6dc2ddc4e3efb1aa45f4062c1d8ab9afa87d9764d90db618e15d9504e520047b482b6b5534cbc5667c6831b72f53d1402767de16
-
memory/432-84-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-110-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-580-0x0000000004CF5000-0x0000000004D06000-memory.dmpFilesize
68KB
-
memory/432-122-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-116-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-60-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-82-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-63-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-64-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-66-0x00000000004A3DEE-mapping.dmp
-
memory/432-65-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-70-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-68-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-72-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-74-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-76-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-78-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-86-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-61-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-118-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-80-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-88-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-90-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-96-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-98-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-94-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-92-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-102-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-100-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-108-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-106-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-104-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-114-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-112-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/432-120-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1780-58-0x0000000000000000-mapping.dmp
-
memory/1824-54-0x0000000000940000-0x0000000000A30000-memory.dmpFilesize
960KB
-
memory/1824-56-0x00000000006A0000-0x00000000006A8000-memory.dmpFilesize
32KB
-
memory/1824-55-0x0000000075E31000-0x0000000075E33000-memory.dmpFilesize
8KB
-
memory/1824-57-0x0000000007670000-0x0000000007720000-memory.dmpFilesize
704KB