5f885377d87bbb8384fa51505cbb454bd758c621febcfb5e5aff42e1379c1430

General

Target

New Order.exe
Size

461KB
MD5

f43dbc77e78eec495daef1fa8c28021d
SHA1

0ec7cffae73e2d248a74d2ebf399222ceb9d5a31
SHA256

5f885377d87bbb8384fa51505cbb454bd758c621febcfb5e5aff42e1379c1430
SHA512

ed4e90b9991a0dec069ec1ad6ed459d45c6ca46948ed2b6ed4abb762a96aab3cac6278c484a7dec4863408f4dc27df8540e03143d9299ea50c118a83cbfe4e26

Score

7^/10

evasion trojan

Malware Config

Signatures

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

New Order.exeNETSTAT.EXE

pid process

784 New Order.exe
784 New Order.exe
784 New Order.exe
1092 NETSTAT.EXE
1092 NETSTAT.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1296 Explorer.EXE
1296 Explorer.EXE
1296 Explorer.EXE
1296 Explorer.EXE

pid	process
1296	Explorer.EXE
1296	Explorer.EXE
1296	Explorer.EXE
1296	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

New Order.exeExplorer.EXENETSTAT.EXE

description	pid	process	target process
PID 1424 wrote to memory of 784	1424	New Order.exe	New Order.exe
PID 1424 wrote to memory of 784	1424	New Order.exe	New Order.exe
PID 1424 wrote to memory of 784	1424	New Order.exe	New Order.exe
PID 1424 wrote to memory of 784	1424	New Order.exe	New Order.exe
PID 1424 wrote to memory of 784	1424	New Order.exe	New Order.exe
PID 1424 wrote to memory of 784	1424	New Order.exe	New Order.exe
PID 1424 wrote to memory of 784	1424	New Order.exe	New Order.exe
PID 1296 wrote to memory of 1092	1296	Explorer.EXE	NETSTAT.EXE
PID 1296 wrote to memory of 1092	1296	Explorer.EXE	NETSTAT.EXE
PID 1296 wrote to memory of 1092	1296	Explorer.EXE	NETSTAT.EXE
PID 1296 wrote to memory of 1092	1296	Explorer.EXE	NETSTAT.EXE
PID 1092 wrote to memory of 1672	1092	NETSTAT.EXE	cmd.exe
PID 1092 wrote to memory of 1672	1092	NETSTAT.EXE	cmd.exe
PID 1092 wrote to memory of 1672	1092	NETSTAT.EXE	cmd.exe
PID 1092 wrote to memory of 1672	1092	NETSTAT.EXE	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

New Order.exeNew Order.exeNETSTAT.EXE

description	pid	process	target process
PID 1424 set thread context of 784	1424	New Order.exe	New Order.exe
PID 784 set thread context of 1296	784	New Order.exe	Explorer.EXE
PID 1092 set thread context of 1296	1092	NETSTAT.EXE	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

New Order.exeNETSTAT.EXE

pid	process
784	New Order.exe
784	New Order.exe
1092	NETSTAT.EXE
1092	NETSTAT.EXE
1092	NETSTAT.EXE
1092	NETSTAT.EXE
1092	NETSTAT.EXE
1092	NETSTAT.EXE
1092	NETSTAT.EXE
1092	NETSTAT.EXE
1092	NETSTAT.EXE
1092	NETSTAT.EXE
1092	NETSTAT.EXE
1092	NETSTAT.EXE
1092	NETSTAT.EXE
1092	NETSTAT.EXE
1092	NETSTAT.EXE
1092	NETSTAT.EXE
1092	NETSTAT.EXE
1092	NETSTAT.EXE
1092	NETSTAT.EXE
1092	NETSTAT.EXE
1092	NETSTAT.EXE
1092	NETSTAT.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

New Order.exeNETSTAT.EXEExplorer.EXE

description pid process

Token: SeDebugPrivilege 784 New Order.exe
Token: SeDebugPrivilege 1092 NETSTAT.EXE
Token: SeShutdownPrivilege 1296 Explorer.EXE
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1672 cmd.exe
Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

Explorer.EXE

pid process

1296 Explorer.EXE
1296 Explorer.EXE
1296 Explorer.EXE
1296 Explorer.EXE
1296 Explorer.EXE
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Explorer.EXE

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	784	New Order.exe
Token: SeDebugPrivilege	1092	NETSTAT.EXE
Token: SeShutdownPrivilege	1296	Explorer.EXE

pid	process
1672	cmd.exe

pid	process
1296	Explorer.EXE
1296	Explorer.EXE
1296	Explorer.EXE
1296	Explorer.EXE
1296	Explorer.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
PID:1296

C:\Users\Admin\AppData\Local\Temp\New Order.exe
"C:\Users\Admin\AppData\Local\Temp\New Order.exe"
2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1424

C:\Users\Admin\AppData\Local\Temp\New Order.exe
"{path}"
3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:784

C:\Windows\SysWOW64\NETSTAT.EXE
"C:\Windows\SysWOW64\NETSTAT.EXE"
2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1092

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\New Order.exe"
3⤵
- Deletes itself
PID:1672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/784-2-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/784-3-0x000000000041E360-mapping.dmp

Download
memory/1092-4-0x0000000000000000-mapping.dmp

Download
memory/1092-5-0x0000000000DB0000-0x0000000000DB9000-memory.dmp

Filesize
36KB

Download
memory/1092-7-0x00000000030A0000-0x000000000322B000-memory.dmp

Filesize
1.5MB

Download
memory/1424-1-0x0000000000000000-0x0000000000000000-disk.dmp

Download
memory/1672-6-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads