f332ebde8b3dc026728bf80e7edd9b0c0809e8df2e28f6baabaaa3327a295dca

General

Target
New Order-PI.exe
Size 500KB
Sample201022-tye24trfre
SHA256 f332ebde8b3dc026728bf80e7edd9b0c0809e8df2e28f6baabaaa3327a295dca
MD5 ef6260889c044dc08a788a983efa52a3
SHA1 ea8c11aff84790e64eb93981306bafa4400a846f
SHA512 9c8a32ea373ea0b5ce8177b4a76c72188de3bf52befd0d1eacef3fe59ecc632a7d2f3c5ef6deef99e6d5cb8a5e78fb8452518a6d82d490d41c4aecd1f7f090a7
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3728	winlogs.exe
1016	InstallUtil.exe

Loads dropped DLL 3 IoCs

pid	Process
3952	New Order-PI.exe
3728	winlogs.exe
3728	winlogs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3728 set thread context of 1016	3728	winlogs.exe	82

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
3952	New Order-PI.exe
3952	New Order-PI.exe
3952	New Order-PI.exe
3952	New Order-PI.exe
3952	New Order-PI.exe
3952	New Order-PI.exe
3952	New Order-PI.exe
3952	New Order-PI.exe
3952	New Order-PI.exe
3952	New Order-PI.exe
3952	New Order-PI.exe
3952	New Order-PI.exe
3952	New Order-PI.exe
3952	New Order-PI.exe
3728	winlogs.exe
1016	InstallUtil.exe
1016	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3952	New Order-PI.exe
Token: SeTakeOwnershipPrivilege	3952	New Order-PI.exe
Token: SeRestorePrivilege	3952	New Order-PI.exe
Token: SeDebugPrivilege	3728	winlogs.exe
Token: SeTakeOwnershipPrivilege	3728	winlogs.exe
Token: SeRestorePrivilege	3728	winlogs.exe
Token: SeDebugPrivilege	1016	InstallUtil.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 2420	3952	New Order-PI.exe	75
PID 3952 wrote to memory of 2420	3952	New Order-PI.exe	75
PID 3952 wrote to memory of 2420	3952	New Order-PI.exe	75
PID 2420 wrote to memory of 2812	2420	cmd.exe	77
PID 2420 wrote to memory of 2812	2420	cmd.exe	77
PID 2420 wrote to memory of 2812	2420	cmd.exe	77
PID 3952 wrote to memory of 3728	3952	New Order-PI.exe	78
PID 3952 wrote to memory of 3728	3952	New Order-PI.exe	78
PID 3952 wrote to memory of 3728	3952	New Order-PI.exe	78
PID 3728 wrote to memory of 208	3728	winlogs.exe	79
PID 3728 wrote to memory of 208	3728	winlogs.exe	79
PID 3728 wrote to memory of 208	3728	winlogs.exe	79
PID 208 wrote to memory of 2596	208	cmd.exe	81
PID 208 wrote to memory of 2596	208	cmd.exe	81
PID 208 wrote to memory of 2596	208	cmd.exe	81
PID 3728 wrote to memory of 1016	3728	winlogs.exe	82
PID 3728 wrote to memory of 1016	3728	winlogs.exe	82
PID 3728 wrote to memory of 1016	3728	winlogs.exe	82
PID 3728 wrote to memory of 1016	3728	winlogs.exe	82
PID 3728 wrote to memory of 1016	3728	winlogs.exe	82
PID 3728 wrote to memory of 1016	3728	winlogs.exe	82
PID 3728 wrote to memory of 1016	3728	winlogs.exe	82
PID 3728 wrote to memory of 1016	3728	winlogs.exe	82

C:\Users\Admin\AppData\Local\Temp\New Order-PI.exe
"C:\Users\Admin\AppData\Local\Temp\New Order-PI.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\winlogs.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\winlogs.exe"
    3⤵
    PID:2812
- C:\Users\Admin\AppData\Roaming\winlogs.exe
  "C:\Users\Admin\AppData\Roaming\winlogs.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\winlogs.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:208
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\winlogs.exe"
      4⤵
      PID:2596
- - C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
    "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-29-0x0000000074000000-0x00000000746EE000-memory.dmp

Download

memory/1016-33-0x00000000049F0000-0x00000000049F1000-memory.dmp

Download

memory/1016-34-0x00000000049D0000-0x00000000049D1000-memory.dmp

Download

memory/1016-35-0x0000000005540000-0x0000000005541000-memory.dmp

Download

memory/1016-25-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3728-13-0x0000000074000000-0x00000000746EE000-memory.dmp

Download

memory/3728-23-0x0000000005550000-0x0000000005566000-memory.dmp

Download

memory/3952-0-0x0000000074000000-0x00000000746EE000-memory.dmp

Download

memory/3952-7-0x0000000005F50000-0x0000000005F51000-memory.dmp

Download

memory/3952-6-0x0000000005B80000-0x0000000005B81000-memory.dmp

Download

memory/3952-5-0x0000000005FE0000-0x0000000005FE1000-memory.dmp

Download

memory/3952-3-0x00000000028A0000-0x00000000028D2000-memory.dmp

Download

memory/3952-1-0x00000000004D0000-0x00000000004D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads