Resubmissions

13-04-2024 10:04

240413-l3z7yscg32 10

13-04-2024 10:00

240413-l1mtvacg22 10

Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-04-2024 10:04

General

  • Target

    PO No. 44 Master Group Trading & Contracting.exe

  • Size

    815KB

  • MD5

    77fceb05a851e129ceac74ad35a49669

  • SHA1

    9b2d4653f5aa38a9fc64e0eca19268e4da547b79

  • SHA256

    dafe6d74868c243d4f818aab7c3f8d5d95b7d69aa1492e34e1e38d80d15e1532

  • SHA512

    e818dce4d5f7f323148dea9a0dea3e77f8bfdc2e3010735fd97d45e8a69ee3c1f2b658f142bd47e3ca2833307486555a6464f39a0e3169b8294c0d540a9df4f9

  • SSDEEP

    24576:PRuoOBrBlsQJKlQA3fqRCAL3V6wREYy9mE:PL0Bld6QA3S0ALlbREYy9m

Malware Config

Signatures

  • Detect Neshta payload 5 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO No. 44 Master Group Trading & Contracting.exe
    "C:\Users\Admin\AppData\Local\Temp\PO No. 44 Master Group Trading & Contracting.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4968
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO No. 44 Master Group Trading & Contracting.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1764
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QxvrCwK.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2176
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QxvrCwK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp58BA.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:3188
    • C:\Users\Admin\AppData\Local\Temp\PO No. 44 Master Group Trading & Contracting.exe
      "C:\Users\Admin\AppData\Local\Temp\PO No. 44 Master Group Trading & Contracting.exe"
      2⤵
        PID:1548
      • C:\Users\Admin\AppData\Local\Temp\PO No. 44 Master Group Trading & Contracting.exe
        "C:\Users\Admin\AppData\Local\Temp\PO No. 44 Master Group Trading & Contracting.exe"
        2⤵
          PID:1176
        • C:\Users\Admin\AppData\Local\Temp\PO No. 44 Master Group Trading & Contracting.exe
          "C:\Users\Admin\AppData\Local\Temp\PO No. 44 Master Group Trading & Contracting.exe"
          2⤵
          • Checks computer location settings
          • Modifies system executable filetype association
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies registry class
          PID:4440
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4228 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:1608

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

          Filesize

          1KB

          MD5

          33b19d75aa77114216dbc23f43b195e3

          SHA1

          36a6c3975e619e0c5232aa4f5b7dc1fec9525535

          SHA256

          b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

          SHA512

          676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          64B

          MD5

          14d29780a1a948b64fd87f02b94b7109

          SHA1

          66f9d7d57c2a1284c29350b7e6171eedc34f36f7

          SHA256

          e6835cf77d69df3cdbac40cb814b39fa4cc06bcabf8c4a8b3c0de633f9332e31

          SHA512

          f10205998c7576e5723a60b40ea485b552dbd40f3583ecf51c1b28a53d6e4a1324e104e911714e0f93ddb302ce08d10b4abb5b550c0e519e3fa6b336f3c9ecec

        • C:\Users\Admin\AppData\Local\Temp\3582-490\PO No. 44 Master Group Trading & Contracting.exe

          Filesize

          774KB

          MD5

          57886e3196900b7df0c72dd68d70064f

          SHA1

          2d74b0bdd34615f885e53db417368725ea21a2b0

          SHA256

          42307edb22a10f3de80cae4df709339e53ac4defc20a40dbfe773741ddbc80ba

          SHA512

          86c0ee4a2caf3b59916a6398e6d36215b457b05d3720e84fc5f3e47a642ade87705f038c0bf9c4823860ecfe54b4de2f21dcc096b8b01592b15670e00c5d6e60

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gaivcwl4.ola.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\tmp58BA.tmp

          Filesize

          1KB

          MD5

          05f3e33e07233ffa7a7beaedb07b59dd

          SHA1

          16570a98f1120a8c744f2baf2c634b78c9e5050e

          SHA256

          d981a360804e84dc593fd00cef04adb4a6f5f898839165055073357c44189ffc

          SHA512

          08c6aca29948b78eb6a4bec33eff37c767a2ad3133a9bd8b3ffaaea73c86d6856a1afcab25162173c5fbfb6326764895fbd8290f1c1ca432c96675fca518aee6

        • C:\Users\Admin\AppData\Roaming\QxvrCwK.exe

          Filesize

          815KB

          MD5

          77fceb05a851e129ceac74ad35a49669

          SHA1

          9b2d4653f5aa38a9fc64e0eca19268e4da547b79

          SHA256

          dafe6d74868c243d4f818aab7c3f8d5d95b7d69aa1492e34e1e38d80d15e1532

          SHA512

          e818dce4d5f7f323148dea9a0dea3e77f8bfdc2e3010735fd97d45e8a69ee3c1f2b658f142bd47e3ca2833307486555a6464f39a0e3169b8294c0d540a9df4f9

        • C:\odt\OFFICE~1.EXE

          Filesize

          5.1MB

          MD5

          4cf5b2fab9c53267a72bb468cb6bafd3

          SHA1

          fb764bd2157b466b82875509facebd93d22b4087

          SHA256

          66be765cbd1a483017792e4212666600cc7ef585853adcaecec9bdc505db32c1

          SHA512

          3e474fa59ac1ed3dc2abbd04f389df0f1217831b2f354658d949094ba31802328b8dde7dc2777068f692e6b21dd14ced66e64d8ec4e1fadaaae818749395da3b

        • memory/1764-70-0x0000000074AD0000-0x0000000075280000-memory.dmp

          Filesize

          7.7MB

        • memory/1764-65-0x00000000067B0000-0x00000000067CE000-memory.dmp

          Filesize

          120KB

        • memory/1764-66-0x0000000006850000-0x000000000689C000-memory.dmp

          Filesize

          304KB

        • memory/1764-27-0x00000000057F0000-0x0000000005856000-memory.dmp

          Filesize

          408KB

        • memory/1764-13-0x0000000002EA0000-0x0000000002ED6000-memory.dmp

          Filesize

          216KB

        • memory/1764-15-0x0000000074AD0000-0x0000000075280000-memory.dmp

          Filesize

          7.7MB

        • memory/1764-18-0x0000000002E90000-0x0000000002EA0000-memory.dmp

          Filesize

          64KB

        • memory/1764-16-0x0000000002E90000-0x0000000002EA0000-memory.dmp

          Filesize

          64KB

        • memory/1764-26-0x0000000005780000-0x00000000057E6000-memory.dmp

          Filesize

          408KB

        • memory/1764-20-0x0000000005970000-0x0000000005F98000-memory.dmp

          Filesize

          6.2MB

        • memory/2176-84-0x0000000007670000-0x0000000007713000-memory.dmp

          Filesize

          652KB

        • memory/2176-87-0x0000000007830000-0x000000000783A000-memory.dmp

          Filesize

          40KB

        • memory/2176-23-0x0000000002BA0000-0x0000000002BB0000-memory.dmp

          Filesize

          64KB

        • memory/2176-21-0x0000000074AD0000-0x0000000075280000-memory.dmp

          Filesize

          7.7MB

        • memory/2176-25-0x00000000053D0000-0x00000000053F2000-memory.dmp

          Filesize

          136KB

        • memory/2176-97-0x0000000074AD0000-0x0000000075280000-memory.dmp

          Filesize

          7.7MB

        • memory/2176-93-0x0000000007AE0000-0x0000000007AE8000-memory.dmp

          Filesize

          32KB

        • memory/2176-92-0x0000000007B00000-0x0000000007B1A000-memory.dmp

          Filesize

          104KB

        • memory/2176-91-0x0000000007A00000-0x0000000007A14000-memory.dmp

          Filesize

          80KB

        • memory/2176-90-0x00000000079F0000-0x00000000079FE000-memory.dmp

          Filesize

          56KB

        • memory/2176-89-0x00000000079C0000-0x00000000079D1000-memory.dmp

          Filesize

          68KB

        • memory/2176-88-0x0000000007A40000-0x0000000007AD6000-memory.dmp

          Filesize

          600KB

        • memory/2176-22-0x0000000002BA0000-0x0000000002BB0000-memory.dmp

          Filesize

          64KB

        • memory/2176-86-0x00000000077C0000-0x00000000077DA000-memory.dmp

          Filesize

          104KB

        • memory/2176-46-0x0000000005E80000-0x00000000061D4000-memory.dmp

          Filesize

          3.3MB

        • memory/2176-85-0x0000000007E00000-0x000000000847A000-memory.dmp

          Filesize

          6.5MB

        • memory/2176-83-0x0000000006A50000-0x0000000006A6E000-memory.dmp

          Filesize

          120KB

        • memory/2176-73-0x0000000070E00000-0x0000000070E4C000-memory.dmp

          Filesize

          304KB

        • memory/2176-72-0x0000000006A70000-0x0000000006AA2000-memory.dmp

          Filesize

          200KB

        • memory/2176-67-0x0000000002BA0000-0x0000000002BB0000-memory.dmp

          Filesize

          64KB

        • memory/2176-71-0x000000007F430000-0x000000007F440000-memory.dmp

          Filesize

          64KB

        • memory/4440-34-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/4440-194-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/4440-28-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/4440-29-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/4440-30-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/4968-0-0x0000000074AD0000-0x0000000075280000-memory.dmp

          Filesize

          7.7MB

        • memory/4968-6-0x0000000007D90000-0x0000000007DAC000-memory.dmp

          Filesize

          112KB

        • memory/4968-8-0x000000000D450000-0x000000000D45C000-memory.dmp

          Filesize

          48KB

        • memory/4968-9-0x0000000004BB0000-0x0000000004C3C000-memory.dmp

          Filesize

          560KB

        • memory/4968-32-0x00000000053E0000-0x00000000053F0000-memory.dmp

          Filesize

          64KB

        • memory/4968-4-0x00000000053E0000-0x00000000053F0000-memory.dmp

          Filesize

          64KB

        • memory/4968-7-0x000000000A430000-0x000000000A438000-memory.dmp

          Filesize

          32KB

        • memory/4968-45-0x0000000074AD0000-0x0000000075280000-memory.dmp

          Filesize

          7.7MB

        • memory/4968-10-0x0000000010F80000-0x000000001101C000-memory.dmp

          Filesize

          624KB

        • memory/4968-3-0x0000000005130000-0x00000000051C2000-memory.dmp

          Filesize

          584KB

        • memory/4968-2-0x00000000057A0000-0x0000000005D44000-memory.dmp

          Filesize

          5.6MB

        • memory/4968-19-0x0000000074AD0000-0x0000000075280000-memory.dmp

          Filesize

          7.7MB

        • memory/4968-5-0x00000000050B0000-0x00000000050BA000-memory.dmp

          Filesize

          40KB

        • memory/4968-1-0x0000000000620000-0x00000000006F2000-memory.dmp

          Filesize

          840KB