20ec6cdb323f2e2eea0bfb107e820a079a41a3fc6afdf8378de930d7aa7b4160

Analysis

max time kernel
147s
max time network
61s
platform
windows10_x64
resource
win10v200722
submitted
20/08/2020, 06:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New_Order.exe
Size 1.4MB
Sample200820-by4d1cvyxe
SHA256 20ec6cdb323f2e2eea0bfb107e820a079a41a3fc6afdf8378de930d7aa7b4160
MD5 13acc68e0a13b3ad443c4fb9c223cdd5
SHA1 6c0eba3ef285cf18c845823b71327b774ca1cba9
SHA512 e5333ad504d0729820d72ae0679bb9383e0395680d18d1459506ccdec3f2333e5642df502320e0b372953f702d41f5142eddee7f9c6bcedf8608dd15adc23490
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4036 set thread context of 2676	4036	New_Order.exe	72

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2676	New_Order.exe
2676	New_Order.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4036	New_Order.exe
Token: SeDebugPrivilege	2676	New_Order.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 2676	4036	New_Order.exe	72
PID 4036 wrote to memory of 2676	4036	New_Order.exe	72
PID 4036 wrote to memory of 2676	4036	New_Order.exe	72
PID 4036 wrote to memory of 2676	4036	New_Order.exe	72
PID 4036 wrote to memory of 2676	4036	New_Order.exe	72
PID 4036 wrote to memory of 2676	4036	New_Order.exe	72
PID 4036 wrote to memory of 2676	4036	New_Order.exe	72
PID 4036 wrote to memory of 2676	4036	New_Order.exe	72
PID 2676 wrote to memory of 3604	2676	New_Order.exe	74
PID 2676 wrote to memory of 3604	2676	New_Order.exe	74
PID 2676 wrote to memory of 3604	2676	New_Order.exe	74
PID 3604 wrote to memory of 1944	3604	cmd.exe	76
PID 3604 wrote to memory of 1944	3604	cmd.exe	76
PID 3604 wrote to memory of 1944	3604	cmd.exe	76

C:\Users\Admin\AppData\Local\Temp\New_Order.exe
"C:\Users\Admin\AppData\Local\Temp\New_Order.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Users\Admin\AppData\Local\Temp\New_Order.exe
  "C:\Users\Admin\AppData\Local\Temp\New_Order.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\New_Order.exe' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3604
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\New_Order.exe'
      4⤵
      PID:1944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2676-11-0x0000000000400000-0x00000000004B8000-memory.dmp

Download

memory/2676-19-0x00000000051E0000-0x00000000051E1000-memory.dmp

Download

memory/2676-18-0x00000000050F0000-0x0000000005161000-memory.dmp

Download

memory/2676-13-0x0000000073A60000-0x000000007414E000-memory.dmp

Download

memory/4036-5-0x00000000059D0000-0x00000000059D1000-memory.dmp

Download

memory/4036-10-0x00000000068F0000-0x00000000069B4000-memory.dmp

Download

memory/4036-9-0x00000000066D0000-0x00000000067AC000-memory.dmp

Download

memory/4036-8-0x0000000005E30000-0x0000000005E33000-memory.dmp

Download

memory/4036-7-0x0000000005BA0000-0x0000000005BA1000-memory.dmp

Download

memory/4036-6-0x00000000058F0000-0x00000000058F1000-memory.dmp

Download

memory/4036-0-0x0000000073A60000-0x000000007414E000-memory.dmp

Download

memory/4036-4-0x0000000005ED0000-0x0000000005ED1000-memory.dmp

Download

memory/4036-3-0x0000000005910000-0x0000000005911000-memory.dmp

Download

memory/4036-1-0x0000000000F70000-0x0000000000F71000-memory.dmp

Download