c744751ad79f737ac78fe9c69afac4c7b8940951b2fe67d20175d27e77721371

Analysis

Target
097663899 NEW ORDER.exe
Size 806KB
Sample200701-mmflnav59x
SHA256 c744751ad79f737ac78fe9c69afac4c7b8940951b2fe67d20175d27e77721371
MD5 7fa6a760ba0703205ba51d9bd39d67b3
SHA1 965538e4662b0b2d628c1f3f72f2ec0b570d2424
SHA512 3d906e71f364e4ebd915634094a49ea4223c27bfb76529be9d49b65044610305022492d6e235952cb480f6a3da0477a98c71a450e8a8511803cc4efdc652c00e
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 4032	3680	097663899 NEW ORDER.exe	67
PID 3680 wrote to memory of 4032	3680	097663899 NEW ORDER.exe	67
PID 3680 wrote to memory of 4032	3680	097663899 NEW ORDER.exe	67
PID 3680 wrote to memory of 3900	3680	097663899 NEW ORDER.exe	68
PID 3680 wrote to memory of 3900	3680	097663899 NEW ORDER.exe	68
PID 3680 wrote to memory of 3900	3680	097663899 NEW ORDER.exe	68
PID 3680 wrote to memory of 3900	3680	097663899 NEW ORDER.exe	68
PID 3680 wrote to memory of 3900	3680	097663899 NEW ORDER.exe	68
PID 3680 wrote to memory of 3900	3680	097663899 NEW ORDER.exe	68
PID 3680 wrote to memory of 3900	3680	097663899 NEW ORDER.exe	68
PID 3680 wrote to memory of 3900	3680	097663899 NEW ORDER.exe	68
PID 3900 wrote to memory of 3496	3900	RegSvcs.exe	69
PID 3900 wrote to memory of 3496	3900	RegSvcs.exe	69
PID 3900 wrote to memory of 3496	3900	RegSvcs.exe	69

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3680 set thread context of 3900	3680	097663899 NEW ORDER.exe	68

C:\Users\Admin\AppData\Local\Temp\097663899 NEW ORDER.exe
"C:\Users\Admin\AppData\Local\Temp\097663899 NEW ORDER.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:3680
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  PID:4032
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 696
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    PID:3496

memory/3496-3-0x0000000002630000-0x0000000002631000-memory.dmp

Download

memory/3496-4-0x00000000029C0000-0x00000000029C1000-memory.dmp

Download

memory/3496-5-0x00000000029C0000-0x00000000029C1000-memory.dmp

Download

memory/3496-12-0x0000000002F00000-0x0000000002F01000-memory.dmp

Download

memory/3900-0-0x0000000000400000-0x000000000048E000-memory.dmp

Download