Analysis
- max time kernel
150s - max time network
146s - platform
windows10_x64 - resource
win10v200430 - submitted
02/07/2020, 06:58
Static task
static1
Behavioral task
behavioral1
Sample
NEW ORDER.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
NEW ORDER.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target NEW ORDER.exe
- Size 293KB
- Sample200702-7rffsqsxe6
- SHA256 ba47cf38b9634cbe5fd3ae81f2f7cef3554b8f57f59501b9ea5fde8c73ff4a4e
- MD5 e85777a9fee0c12ab94d82bbd4f4e5cc
- SHA1 f3dd55dabb0c0dc1e5d7c672fe2598f06c0f322a
- SHA512 ad921f91ba2fb2674c499bef705a2211178b2dcabb14cede38eebd108cfb2b82ed61a428b1fc45ad0a68b23c54dcfbc5a2fc598ab2cd2a3b6747e0e3e83f9ffa
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 896 set thread context of 2172 896 NEW ORDER.exe 72 PID 2172 set thread context of 3008 2172 NEW ORDER.exe 56 PID 2724 set thread context of 3008 2724 ipconfig.exe 56 - Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 2172 NEW ORDER.exe 2172 NEW ORDER.exe 2172 NEW ORDER.exe 2172 NEW ORDER.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe 2724 ipconfig.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 2172 NEW ORDER.exe Token: SeDebugPrivilege 2724 ipconfig.exe Token: SeShutdownPrivilege 3008 Explorer.EXE Token: SeCreatePagefilePrivilege 3008 Explorer.EXE Token: SeShutdownPrivilege 3008 Explorer.EXE Token: SeCreatePagefilePrivilege 3008 Explorer.EXE Token: SeShutdownPrivilege 3008 Explorer.EXE Token: SeCreatePagefilePrivilege 3008 Explorer.EXE Token: SeShutdownPrivilege 3008 Explorer.EXE Token: SeCreatePagefilePrivilege 3008 Explorer.EXE Token: SeShutdownPrivilege 3008 Explorer.EXE Token: SeCreatePagefilePrivilege 3008 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2172 NEW ORDER.exe 2172 NEW ORDER.exe 2172 NEW ORDER.exe 2724 ipconfig.exe 2724 ipconfig.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\A1b3dufw\rpxdprotehe.exe ipconfig.exe - Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\8PG4WNLXG = "C:\\Program Files (x86)\\A1b3dufw\\rpxdprotehe.exe" ipconfig.exe Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run ipconfig.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 896 wrote to memory of 2172 896 NEW ORDER.exe 72 PID 896 wrote to memory of 2172 896 NEW ORDER.exe 72 PID 896 wrote to memory of 2172 896 NEW ORDER.exe 72 PID 896 wrote to memory of 2172 896 NEW ORDER.exe 72 PID 896 wrote to memory of 2172 896 NEW ORDER.exe 72 PID 896 wrote to memory of 2172 896 NEW ORDER.exe 72 PID 3008 wrote to memory of 2724 3008 Explorer.EXE 73 PID 3008 wrote to memory of 2724 3008 Explorer.EXE 73 PID 3008 wrote to memory of 2724 3008 Explorer.EXE 73 PID 2724 wrote to memory of 2880 2724 ipconfig.exe 74 PID 2724 wrote to memory of 2880 2724 ipconfig.exe 74 PID 2724 wrote to memory of 2880 2724 ipconfig.exe 74 PID 2724 wrote to memory of 3512 2724 ipconfig.exe 78 PID 2724 wrote to memory of 3512 2724 ipconfig.exe 78 PID 2724 wrote to memory of 3512 2724 ipconfig.exe 78 -
description ioc Process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 ipconfig.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:2172
-
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Drops file in Program Files directory
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
- Modifies Internet Explorer settings
PID:2724 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"3⤵PID:2880
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3512
-
-