Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows10_x64 -
resource
win10 -
submitted
13-07-2020 11:17
Static task
static1
Behavioral task
behavioral1
Sample
New Order.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
New Order.exe
Resource
win10
General
-
Target
New Order.exe
-
Size
950KB
-
MD5
f6322a4b7fd5bc7a3ba41034f69e84b3
-
SHA1
fc18e16938986b31d12c5ed51ed48f2764cf181c
-
SHA256
f49917c2ce68563710e7d801c8a5793a592cc03a7cf803740195acf55ea11ae6
-
SHA512
97964d1e7faf0ecdf4f4ccc6893d130898ad6d3f05d51518116e6d9a45084acde3648763aca1e8990cd6338eec7a9b67fb8f8ce1f8fab43719433c1848237926
Malware Config
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
ikem123456789
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
New Order.exedescription pid process Token: SeDebugPrivilege 3996 New Order.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
New Order.exepid process 3672 New Order.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
New Order.exedescription pid process target process PID 3672 set thread context of 3996 3672 New Order.exe New Order.exe -
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
Processes:
resource yara_rule behavioral2/memory/3996-0-0x0000000000400000-0x00000000004B0000-memory.dmp upx behavioral2/memory/3996-2-0x0000000000400000-0x00000000004B0000-memory.dmp upx behavioral2/memory/3996-3-0x0000000000400000-0x00000000004B0000-memory.dmp upx -
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
New Order.exeNew Order.exepid process 3672 New Order.exe 3672 New Order.exe 3996 New Order.exe 3996 New Order.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
New Order.exeNew Order.exedescription pid process target process PID 3672 wrote to memory of 3996 3672 New Order.exe New Order.exe PID 3672 wrote to memory of 3996 3672 New Order.exe New Order.exe PID 3672 wrote to memory of 3996 3672 New Order.exe New Order.exe PID 3996 wrote to memory of 3428 3996 New Order.exe netsh.exe PID 3996 wrote to memory of 3428 3996 New Order.exe netsh.exe PID 3996 wrote to memory of 3428 3996 New Order.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Order.exe"C:\Users\Admin\AppData\Local\Temp\New Order.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\New Order.exe"C:\Users\Admin\AppData\Local\Temp\New Order.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3428-6-0x0000000000000000-mapping.dmp
-
memory/3996-0-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/3996-1-0x00000000004AEE50-mapping.dmp
-
memory/3996-2-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/3996-3-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/3996-4-0x00000000021F0000-0x0000000002242000-memory.dmpFilesize
328KB
-
memory/3996-5-0x0000000002182000-0x0000000002183000-memory.dmpFilesize
4KB