Analysis
-
max time kernel
94s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:16
Static task
static1
Behavioral task
behavioral1
Sample
Order List.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Order List.exe
Resource
win10v2004-20220414-en
General
-
Target
Order List.exe
-
Size
937KB
-
MD5
f7ce9ae72c2106ca0b0b85188b43f758
-
SHA1
0a542637796e19ea1cb3379471ba69fcdd9b239e
-
SHA256
112d707367a7101031fb617c9514187ca68b817a27b6b6a2ecc1b737dc974a1a
-
SHA512
9acc72e4fbaaea6b720e9da0d6649d55d18e201d41d252a8e62dde77a5b4a9e709ffbaa2ca533217176c149c485e6a4390a402ebce29aa91af0cb6d957d8ede2
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\F95B724EDE\Log.txt
masslogger
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Order List.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Order List.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Order List.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Order List.exeOrder List.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation Order List.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation Order List.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 30 api.ipify.org -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Order List.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Order List.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 Order List.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Order List.exedescription pid process target process PID 1496 set thread context of 1880 1496 Order List.exe Order List.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
Order List.exeOrder List.exepid process 1496 Order List.exe 1880 Order List.exe 1880 Order List.exe 1880 Order List.exe 1880 Order List.exe 1880 Order List.exe 1880 Order List.exe 1880 Order List.exe 1880 Order List.exe 1880 Order List.exe 1880 Order List.exe 1880 Order List.exe 1880 Order List.exe 1880 Order List.exe 1880 Order List.exe 1880 Order List.exe 1880 Order List.exe 1880 Order List.exe 1880 Order List.exe 1880 Order List.exe 1880 Order List.exe 1880 Order List.exe 1880 Order List.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Order List.exeOrder List.exedescription pid process Token: SeDebugPrivilege 1496 Order List.exe Token: SeDebugPrivilege 1880 Order List.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Order List.exedescription pid process target process PID 1496 wrote to memory of 1232 1496 Order List.exe schtasks.exe PID 1496 wrote to memory of 1232 1496 Order List.exe schtasks.exe PID 1496 wrote to memory of 1232 1496 Order List.exe schtasks.exe PID 1496 wrote to memory of 1880 1496 Order List.exe Order List.exe PID 1496 wrote to memory of 1880 1496 Order List.exe Order List.exe PID 1496 wrote to memory of 1880 1496 Order List.exe Order List.exe PID 1496 wrote to memory of 1880 1496 Order List.exe Order List.exe PID 1496 wrote to memory of 1880 1496 Order List.exe Order List.exe PID 1496 wrote to memory of 1880 1496 Order List.exe Order List.exe PID 1496 wrote to memory of 1880 1496 Order List.exe Order List.exe PID 1496 wrote to memory of 1880 1496 Order List.exe Order List.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order List.exe"C:\Users\Admin\AppData\Local\Temp\Order List.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kkJqtFyYwn" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA5E9.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Order List.exe"{path}"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA5E9.tmpFilesize
1KB
MD50aef30f1949bb573fe6bce0be37453ec
SHA1b28ab65b11ef2399dc356c50a1f049311ff39ec4
SHA2568385d223ecce729000de8c611ba56763c983cf8bf41870fe4a66f263588e5b23
SHA5123e9c50ceef2765339412676466b6e5515a55ae54d7e316563b1253b8b474bda73a7c6b1dfd4909020ce7431bd669ef5f95ca8be74a754d4dda2c0f403d1605ab
-
memory/1232-136-0x0000000000000000-mapping.dmp
-
memory/1496-130-0x0000000000BD0000-0x0000000000CC0000-memory.dmpFilesize
960KB
-
memory/1496-131-0x0000000007F00000-0x00000000084A4000-memory.dmpFilesize
5.6MB
-
memory/1496-132-0x0000000007A30000-0x0000000007AC2000-memory.dmpFilesize
584KB
-
memory/1496-133-0x0000000007A10000-0x0000000007A1A000-memory.dmpFilesize
40KB
-
memory/1496-134-0x000000000B720000-0x000000000B7BC000-memory.dmpFilesize
624KB
-
memory/1496-135-0x000000000B8C0000-0x000000000B926000-memory.dmpFilesize
408KB
-
memory/1880-161-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-171-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-141-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-143-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-145-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-147-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-149-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-151-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-153-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-155-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-157-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-159-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-138-0x0000000000000000-mapping.dmp
-
memory/1880-163-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-165-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-167-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-169-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-139-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-173-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-175-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-177-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-179-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-181-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-183-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-185-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-187-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-189-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-191-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-193-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-195-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-197-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-199-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1880-201-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB