Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
14-04-2021 07:13
Static task
static1
Behavioral task
behavioral1
Sample
New Order QDT 206864.exe
Resource
win7v20210410
General
-
Target
New Order QDT 206864.exe
-
Size
659KB
-
MD5
c589d8078ef698aa0b05fdbe324e7520
-
SHA1
dfdbd8800698285753c7b484988bb49560856805
-
SHA256
3070367628094bec21e5643057a992d9c6a3935b66d425d68cdfb2d070b91240
-
SHA512
f32805d7981d5af41c4b3cda3ecce80bc093187a8a7b9e2530ab0839b1ae7b668a73e4147f7119ebaae35dde59464bdafc6323cb080965ef9379e07bd943c807
Malware Config
Extracted
remcos
103.89.88.238:3322
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
New Order QDT 206864.exedescription pid process target process PID 1084 set thread context of 568 1084 New Order QDT 206864.exe New Order QDT 206864.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
New Order QDT 206864.exepid process 568 New Order QDT 206864.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
New Order QDT 206864.exedescription pid process target process PID 1084 wrote to memory of 1784 1084 New Order QDT 206864.exe schtasks.exe PID 1084 wrote to memory of 1784 1084 New Order QDT 206864.exe schtasks.exe PID 1084 wrote to memory of 1784 1084 New Order QDT 206864.exe schtasks.exe PID 1084 wrote to memory of 1784 1084 New Order QDT 206864.exe schtasks.exe PID 1084 wrote to memory of 568 1084 New Order QDT 206864.exe New Order QDT 206864.exe PID 1084 wrote to memory of 568 1084 New Order QDT 206864.exe New Order QDT 206864.exe PID 1084 wrote to memory of 568 1084 New Order QDT 206864.exe New Order QDT 206864.exe PID 1084 wrote to memory of 568 1084 New Order QDT 206864.exe New Order QDT 206864.exe PID 1084 wrote to memory of 568 1084 New Order QDT 206864.exe New Order QDT 206864.exe PID 1084 wrote to memory of 568 1084 New Order QDT 206864.exe New Order QDT 206864.exe PID 1084 wrote to memory of 568 1084 New Order QDT 206864.exe New Order QDT 206864.exe PID 1084 wrote to memory of 568 1084 New Order QDT 206864.exe New Order QDT 206864.exe PID 1084 wrote to memory of 568 1084 New Order QDT 206864.exe New Order QDT 206864.exe PID 1084 wrote to memory of 568 1084 New Order QDT 206864.exe New Order QDT 206864.exe PID 1084 wrote to memory of 568 1084 New Order QDT 206864.exe New Order QDT 206864.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Order QDT 206864.exe"C:\Users\Admin\AppData\Local\Temp\New Order QDT 206864.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vtfkRptuXVWYOU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp92AE.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\New Order QDT 206864.exe"{path}"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp92AE.tmpMD5
d3698bd84707a83350abd42d6bcdcd2b
SHA1eba9d7a865897accf8e42d736f9dda7052856c20
SHA2561b9bb8edaf947a84afc9e9c6ee5c9be65c7071c8048cf1174335ea9187959ec1
SHA51238ae720db8b2f581a3253e16308fa34c02d6ecdb81c66506302bdc851f13c8192086d584815868c86867d2df67fac6fc1eb8fd20658fb451d05fa01bab7f0096
-
memory/568-68-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/568-69-0x0000000000413FA4-mapping.dmp
-
memory/568-70-0x0000000075411000-0x0000000075413000-memory.dmpFilesize
8KB
-
memory/568-71-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1084-60-0x0000000000E90000-0x0000000000E91000-memory.dmpFilesize
4KB
-
memory/1084-62-0x00000000004D0000-0x00000000004D1000-memory.dmpFilesize
4KB
-
memory/1084-63-0x00000000004B0000-0x00000000004B5000-memory.dmpFilesize
20KB
-
memory/1084-64-0x0000000005E30000-0x0000000005ED6000-memory.dmpFilesize
664KB
-
memory/1084-65-0x0000000004710000-0x000000000476D000-memory.dmpFilesize
372KB
-
memory/1784-66-0x0000000000000000-mapping.dmp