Resubmissions

11-04-2024 17:20

240411-vwq55sgb88 10

11-04-2024 03:47

240411-ecc66see8w 10

Analysis

  • max time kernel
    146s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-04-2024 03:47

General

  • Target

    PO No. 44 Master Group Trading & Contracting.exe

  • Size

    815KB

  • MD5

    77fceb05a851e129ceac74ad35a49669

  • SHA1

    9b2d4653f5aa38a9fc64e0eca19268e4da547b79

  • SHA256

    dafe6d74868c243d4f818aab7c3f8d5d95b7d69aa1492e34e1e38d80d15e1532

  • SHA512

    e818dce4d5f7f323148dea9a0dea3e77f8bfdc2e3010735fd97d45e8a69ee3c1f2b658f142bd47e3ca2833307486555a6464f39a0e3169b8294c0d540a9df4f9

  • SSDEEP

    24576:PRuoOBrBlsQJKlQA3fqRCAL3V6wREYy9mE:PL0Bld6QA3S0ALlbREYy9m

Malware Config

Signatures

  • Detect Neshta payload 6 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO No. 44 Master Group Trading & Contracting.exe
    "C:\Users\Admin\AppData\Local\Temp\PO No. 44 Master Group Trading & Contracting.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1704
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO No. 44 Master Group Trading & Contracting.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:216
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QxvrCwK.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2732
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QxvrCwK" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA6FE.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2892
    • C:\Users\Admin\AppData\Local\Temp\PO No. 44 Master Group Trading & Contracting.exe
      "C:\Users\Admin\AppData\Local\Temp\PO No. 44 Master Group Trading & Contracting.exe"
      2⤵
        PID:4376
      • C:\Users\Admin\AppData\Local\Temp\PO No. 44 Master Group Trading & Contracting.exe
        "C:\Users\Admin\AppData\Local\Temp\PO No. 44 Master Group Trading & Contracting.exe"
        2⤵
        • Checks computer location settings
        • Modifies system executable filetype association
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        PID:2728

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      1KB

      MD5

      33b19d75aa77114216dbc23f43b195e3

      SHA1

      36a6c3975e619e0c5232aa4f5b7dc1fec9525535

      SHA256

      b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

      SHA512

      676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      593ea4288513d26ef016e97d153259b9

      SHA1

      3411496d68706a4fa0532691625ce7a22b6f58f4

      SHA256

      db7a078122209538fd69facac589f643238f331d8dc1632ec2ae42f57ee12cd4

      SHA512

      8d0e1ef5b5960b94c0cd731217f82cdc4f156e1e1a8fdd327268ac5ddf82b29b93caf80b17fa3188d34d639a703ff8ac5ee714b4e3ec220d8e911cb84427e543

    • C:\Users\Admin\AppData\Local\Temp\3582-490\PO No. 44 Master Group Trading & Contracting.exe

      Filesize

      774KB

      MD5

      57886e3196900b7df0c72dd68d70064f

      SHA1

      2d74b0bdd34615f885e53db417368725ea21a2b0

      SHA256

      42307edb22a10f3de80cae4df709339e53ac4defc20a40dbfe773741ddbc80ba

      SHA512

      86c0ee4a2caf3b59916a6398e6d36215b457b05d3720e84fc5f3e47a642ade87705f038c0bf9c4823860ecfe54b4de2f21dcc096b8b01592b15670e00c5d6e60

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5sfxzpfa.n3n.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\tmpA6FE.tmp

      Filesize

      1KB

      MD5

      201ea7f0c5fc972ed9b855b7e1ad0a17

      SHA1

      c17c9e2cb4798c8b394f32f9c2c32b781a5c4be5

      SHA256

      b4e9157ba4f8954eec648416abad1f86c24106c8ef128b4974febed8a10fa7ae

      SHA512

      2b141c22b565610d6f3181205441f4ace255b0c86582a5c8aa3a2e5deb5752ba367d1c0b6f7dd3f30c22808b1248065751593e5ceefada71cbe9654827031ea4

    • C:\Users\Admin\AppData\Roaming\QxvrCwK.exe

      Filesize

      815KB

      MD5

      77fceb05a851e129ceac74ad35a49669

      SHA1

      9b2d4653f5aa38a9fc64e0eca19268e4da547b79

      SHA256

      dafe6d74868c243d4f818aab7c3f8d5d95b7d69aa1492e34e1e38d80d15e1532

      SHA512

      e818dce4d5f7f323148dea9a0dea3e77f8bfdc2e3010735fd97d45e8a69ee3c1f2b658f142bd47e3ca2833307486555a6464f39a0e3169b8294c0d540a9df4f9

    • C:\odt\OFFICE~1.EXE

      Filesize

      5.1MB

      MD5

      4cf5b2fab9c53267a72bb468cb6bafd3

      SHA1

      fb764bd2157b466b82875509facebd93d22b4087

      SHA256

      66be765cbd1a483017792e4212666600cc7ef585853adcaecec9bdc505db32c1

      SHA512

      3e474fa59ac1ed3dc2abbd04f389df0f1217831b2f354658d949094ba31802328b8dde7dc2777068f692e6b21dd14ced66e64d8ec4e1fadaaae818749395da3b

    • memory/216-65-0x00000000029C0000-0x00000000029D0000-memory.dmp

      Filesize

      64KB

    • memory/216-21-0x00000000029C0000-0x00000000029D0000-memory.dmp

      Filesize

      64KB

    • memory/216-62-0x0000000006100000-0x000000000611E000-memory.dmp

      Filesize

      120KB

    • memory/216-22-0x0000000005010000-0x0000000005032000-memory.dmp

      Filesize

      136KB

    • memory/216-15-0x00000000027B0000-0x00000000027E6000-memory.dmp

      Filesize

      216KB

    • memory/216-16-0x0000000074500000-0x0000000074CB0000-memory.dmp

      Filesize

      7.7MB

    • memory/216-17-0x0000000005370000-0x0000000005998000-memory.dmp

      Filesize

      6.2MB

    • memory/216-63-0x00000000064C0000-0x000000000650C000-memory.dmp

      Filesize

      304KB

    • memory/216-68-0x0000000074500000-0x0000000074CB0000-memory.dmp

      Filesize

      7.7MB

    • memory/1704-8-0x000000000D4B0000-0x000000000D4BC000-memory.dmp

      Filesize

      48KB

    • memory/1704-5-0x0000000005210000-0x000000000521A000-memory.dmp

      Filesize

      40KB

    • memory/1704-0-0x0000000074500000-0x0000000074CB0000-memory.dmp

      Filesize

      7.7MB

    • memory/1704-1-0x0000000000780000-0x0000000000852000-memory.dmp

      Filesize

      840KB

    • memory/1704-10-0x0000000010FD0000-0x000000001106C000-memory.dmp

      Filesize

      624KB

    • memory/1704-9-0x0000000004CC0000-0x0000000004D4C000-memory.dmp

      Filesize

      560KB

    • memory/1704-7-0x000000000A490000-0x000000000A498000-memory.dmp

      Filesize

      32KB

    • memory/1704-6-0x0000000005880000-0x000000000589C000-memory.dmp

      Filesize

      112KB

    • memory/1704-2-0x00000000058A0000-0x0000000005E44000-memory.dmp

      Filesize

      5.6MB

    • memory/1704-3-0x0000000005240000-0x00000000052D2000-memory.dmp

      Filesize

      584KB

    • memory/1704-50-0x0000000074500000-0x0000000074CB0000-memory.dmp

      Filesize

      7.7MB

    • memory/1704-4-0x00000000054A0000-0x00000000054B0000-memory.dmp

      Filesize

      64KB

    • memory/2728-48-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/2728-182-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/2728-51-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/2728-46-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/2728-45-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/2728-184-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/2732-20-0x00000000050B0000-0x00000000050C0000-memory.dmp

      Filesize

      64KB

    • memory/2732-64-0x00000000050B0000-0x00000000050C0000-memory.dmp

      Filesize

      64KB

    • memory/2732-69-0x000000007F720000-0x000000007F730000-memory.dmp

      Filesize

      64KB

    • memory/2732-70-0x0000000006AF0000-0x0000000006B22000-memory.dmp

      Filesize

      200KB

    • memory/2732-71-0x0000000070A40000-0x0000000070A8C000-memory.dmp

      Filesize

      304KB

    • memory/2732-81-0x0000000006AB0000-0x0000000006ACE000-memory.dmp

      Filesize

      120KB

    • memory/2732-82-0x00000000074F0000-0x0000000007593000-memory.dmp

      Filesize

      652KB

    • memory/2732-83-0x0000000007E60000-0x00000000084DA000-memory.dmp

      Filesize

      6.5MB

    • memory/2732-84-0x0000000007820000-0x000000000783A000-memory.dmp

      Filesize

      104KB

    • memory/2732-99-0x0000000007890000-0x000000000789A000-memory.dmp

      Filesize

      40KB

    • memory/2732-100-0x0000000007AA0000-0x0000000007B36000-memory.dmp

      Filesize

      600KB

    • memory/2732-101-0x0000000007A20000-0x0000000007A31000-memory.dmp

      Filesize

      68KB

    • memory/2732-123-0x0000000007A50000-0x0000000007A5E000-memory.dmp

      Filesize

      56KB

    • memory/2732-130-0x0000000007A60000-0x0000000007A74000-memory.dmp

      Filesize

      80KB

    • memory/2732-138-0x0000000007B60000-0x0000000007B7A000-memory.dmp

      Filesize

      104KB

    • memory/2732-147-0x0000000007B40000-0x0000000007B48000-memory.dmp

      Filesize

      32KB

    • memory/2732-44-0x0000000005F20000-0x0000000006274000-memory.dmp

      Filesize

      3.3MB

    • memory/2732-25-0x0000000005680000-0x00000000056E6000-memory.dmp

      Filesize

      408KB

    • memory/2732-158-0x0000000074500000-0x0000000074CB0000-memory.dmp

      Filesize

      7.7MB

    • memory/2732-23-0x0000000005560000-0x00000000055C6000-memory.dmp

      Filesize

      408KB

    • memory/2732-18-0x0000000074500000-0x0000000074CB0000-memory.dmp

      Filesize

      7.7MB

    • memory/2732-19-0x00000000050B0000-0x00000000050C0000-memory.dmp

      Filesize

      64KB