f3aa1512832e308956898dc2985062be4e57602ae28619b9760a289139943e45

General

Target

KONTRAKT-pdf.exe
Size

443KB
MD5

b41dd3bd3df55870e2f940fe81373df2
SHA1

269f30b33075c280a050d5315d9ddaa7953b7a2f
SHA256

f3aa1512832e308956898dc2985062be4e57602ae28619b9760a289139943e45
SHA512

0a9d976f0a2482ee373ec4e3e332c7e9f8875acbb20b209136b6d4d94ea83f32b92830821cc58b2f6cc89b05f748470638420133d7304a9b2bb706f3efa8ba4e
SSDEEP

6144:FmGIhJFHs4wfO1AJcmmCAmP+vYjL27rbc4Zk/4Rd5Dj0IDY:QvSJPmUPoYjLerg4egRdt0I0

Score

7^/10

Malware Config

Signatures

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	KONTRAKT-pdf.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	caspol.exe

Loads dropped DLL 2 IoCs

pid	Process
2964	KONTRAKT-pdf.exe
2964	KONTRAKT-pdf.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1892	caspol.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2964	KONTRAKT-pdf.exe
1892	caspol.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2964 set thread context of 1892	2964	KONTRAKT-pdf.exe	88

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\henrietta\acidise\artisan\adriane.Fle	KONTRAKT-pdf.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\Baarebuketternes\warpath\Forstemmelsens.ini	KONTRAKT-pdf.exe
File opened for modification	C:\Windows\resources\ostrogothian.Poo	KONTRAKT-pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4052	1892	WerFault.exe	88

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1892	caspol.exe
1892	caspol.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2964	KONTRAKT-pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1892	caspol.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 1892	2964	KONTRAKT-pdf.exe	88
PID 2964 wrote to memory of 1892	2964	KONTRAKT-pdf.exe	88
PID 2964 wrote to memory of 1892	2964	KONTRAKT-pdf.exe	88
PID 2964 wrote to memory of 1892	2964	KONTRAKT-pdf.exe	88
PID 2964 wrote to memory of 1892	2964	KONTRAKT-pdf.exe	88

C:\Users\Admin\AppData\Local\Temp\KONTRAKT-pdf.exe
"C:\Users\Admin\AppData\Local\Temp\KONTRAKT-pdf.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
  "C:\Users\Admin\AppData\Local\Temp\KONTRAKT-pdf.exe"
  2⤵
  - Checks QEMU agent file
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 2004
    3⤵
    - Program crash
    PID:4052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1892 -ip 1892
1⤵
PID:4644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsv6EC8.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv6EC8.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv6EC8.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
memory/1892-152-0x0000000001120000-0x0000000007026000-memory.dmp

Filesize
95.0MB

Download
memory/1892-154-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1892-147-0x0000000000400000-0x00000000005E4000-memory.dmp

Filesize
1.9MB

Download
memory/1892-148-0x0000000076FF1000-0x0000000077111000-memory.dmp

Filesize
1.1MB

Download
memory/1892-149-0x0000000077078000-0x0000000077079000-memory.dmp

Filesize
4KB

Download
memory/1892-150-0x0000000077095000-0x0000000077096000-memory.dmp

Filesize
4KB

Download
memory/1892-151-0x0000000000400000-0x00000000005E4000-memory.dmp

Filesize
1.9MB

Download
memory/1892-163-0x0000000071D90000-0x0000000072540000-memory.dmp

Filesize
7.7MB

Download
memory/1892-153-0x0000000071D90000-0x0000000072540000-memory.dmp

Filesize
7.7MB

Download
memory/1892-161-0x0000000001120000-0x0000000007026000-memory.dmp

Filesize
95.0MB

Download
memory/1892-155-0x0000000039F50000-0x000000003A4F4000-memory.dmp

Filesize
5.6MB

Download
memory/1892-157-0x0000000076FF1000-0x0000000077111000-memory.dmp

Filesize
1.1MB

Download
memory/1892-158-0x0000000039990000-0x00000000399A0000-memory.dmp

Filesize
64KB

Download
memory/1892-159-0x00000000397F0000-0x0000000039856000-memory.dmp

Filesize
408KB

Download
memory/1892-160-0x0000000071D90000-0x0000000072540000-memory.dmp

Filesize
7.7MB

Download
memory/2964-146-0x0000000073CE0000-0x0000000073CE7000-memory.dmp

Filesize
28KB

Download
memory/2964-145-0x0000000076FF1000-0x0000000077111000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing