Analysis
-
max time kernel
152s -
max time network
150s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
05-05-2021 12:56
Static task
static1
Behavioral task
behavioral1
Sample
New Order.exe
Resource
win7v20210408
General
-
Target
New Order.exe
-
Size
208KB
-
MD5
e3ef839d952e85b861b7b15faad53f8e
-
SHA1
feec9cf7cd91f7d3ba245388ff4655f5b3aecf21
-
SHA256
d3501787751324e615bd13ed80417360fbd7558385662ac34c51b34802f9b9d4
-
SHA512
91b5018a2fcb8a758f9a4d76a005095035e7f90b91d71eba345e0f3ab625c4479172e5b580cac4713643f2162feacfc66a7a983d32cf0c7e47862862a956dc5f
Malware Config
Extracted
xloader
2.3
http://www.onyxcomputing.com/u8nw/
constructionjadams.com
organicwellnessfarm.com
beautiful.tours
medvows.com
foxparanormal.com
fsmxmc.com
graniterealestategroup.net
qgi1.com
astrologicsolutions.com
rafbar.com
bastiontools.net
emotist.com
stacyleets.com
bloodtypealpha.com
healtybenenfitsplus.com
vavadadoa3.com
chefbenhk.com
dotgz.com
xn--z4qm188e645c.com
ethyi.com
farrellforcouncil.com
everythingcornea.com
pensje.net
haichuanxin.com
codeproper.com
beautyblvdca.com
namastecarrier.com
xtrator.com
alphabrainbalancing.com
sensationalcleaningservices.net
magistv.info
shotsbynox.com
zioninfosystems.net
yourstoryplace.com
ebmulla.com
turkeyvisa-government.com
albertsonsolutions.com
7brochasmagicas.com
revolutiontourselsalvador.com
eastboundanddowntrucking.com
jkskylights.com
ultimatepoolwater.com
diurr.com
investmentfocused.com
dogscanstay.com
inov8digital.com
paragoncraftevents.com
reservesunbeds.com
melaniesalascosmetics.com
vissito.com
axolc-upoc.xyz
customessayjojo.com
kladki.com
online-securegov.com
xn--demirelik-u3a.com
plgmap.com
contorig2.com
dgyzgs8.com
valuedmind.com
sanacolitademarijuana.com
xn--6j1bs50berk.com
labkitsforstudents.com
lifehakershagirl.online
candidanddevout.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1472-64-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1904-72-0x00000000000E0000-0x0000000000109000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1032 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
New Order.exepid process 1848 New Order.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
New Order.exeNew Order.execmmon32.exedescription pid process target process PID 1848 set thread context of 1472 1848 New Order.exe New Order.exe PID 1472 set thread context of 1200 1472 New Order.exe Explorer.EXE PID 1472 set thread context of 1200 1472 New Order.exe Explorer.EXE PID 1904 set thread context of 1200 1904 cmmon32.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
New Order.execmmon32.exepid process 1472 New Order.exe 1472 New Order.exe 1472 New Order.exe 1904 cmmon32.exe 1904 cmmon32.exe 1904 cmmon32.exe 1904 cmmon32.exe 1904 cmmon32.exe 1904 cmmon32.exe 1904 cmmon32.exe 1904 cmmon32.exe 1904 cmmon32.exe 1904 cmmon32.exe 1904 cmmon32.exe 1904 cmmon32.exe 1904 cmmon32.exe 1904 cmmon32.exe 1904 cmmon32.exe 1904 cmmon32.exe 1904 cmmon32.exe 1904 cmmon32.exe 1904 cmmon32.exe 1904 cmmon32.exe 1904 cmmon32.exe 1904 cmmon32.exe 1904 cmmon32.exe 1904 cmmon32.exe 1904 cmmon32.exe 1904 cmmon32.exe 1904 cmmon32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
New Order.exeNew Order.execmmon32.exepid process 1848 New Order.exe 1472 New Order.exe 1472 New Order.exe 1472 New Order.exe 1472 New Order.exe 1904 cmmon32.exe 1904 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
New Order.execmmon32.exedescription pid process Token: SeDebugPrivilege 1472 New Order.exe Token: SeDebugPrivilege 1904 cmmon32.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
New Order.exeNew Order.execmmon32.exedescription pid process target process PID 1848 wrote to memory of 1472 1848 New Order.exe New Order.exe PID 1848 wrote to memory of 1472 1848 New Order.exe New Order.exe PID 1848 wrote to memory of 1472 1848 New Order.exe New Order.exe PID 1848 wrote to memory of 1472 1848 New Order.exe New Order.exe PID 1848 wrote to memory of 1472 1848 New Order.exe New Order.exe PID 1472 wrote to memory of 1904 1472 New Order.exe cmmon32.exe PID 1472 wrote to memory of 1904 1472 New Order.exe cmmon32.exe PID 1472 wrote to memory of 1904 1472 New Order.exe cmmon32.exe PID 1472 wrote to memory of 1904 1472 New Order.exe cmmon32.exe PID 1904 wrote to memory of 1032 1904 cmmon32.exe cmd.exe PID 1904 wrote to memory of 1032 1904 cmmon32.exe cmd.exe PID 1904 wrote to memory of 1032 1904 cmmon32.exe cmd.exe PID 1904 wrote to memory of 1032 1904 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\New Order.exe"C:\Users\Admin\AppData\Local\Temp\New Order.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\New Order.exe"C:\Users\Admin\AppData\Local\Temp\New Order.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\New Order.exe"5⤵
- Deletes itself
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsdA891.tmp\qa710hh.dllMD5
0aae4bc5f5cf93acb20784cd7df703dc
SHA19bfd9be2d3f92636b86e658684fc1cc25f18e611
SHA256275285c37d855d300ec1da03896538f21b1cebad07a63bc50861d0cf0050ac79
SHA5127a78df6f3ad321807bfa8dc2e350cc7f9096a8c9cf9283c41f2cb5529145fb069ff48d5607965e860d0bbc1616ea8d96fe1ef58c6aedf842b4b7127978c9563d
-
memory/1032-73-0x0000000000000000-mapping.dmp
-
memory/1200-67-0x0000000004A30000-0x0000000004BC6000-memory.dmpFilesize
1.6MB
-
memory/1200-76-0x0000000007030000-0x0000000007182000-memory.dmpFilesize
1.3MB
-
memory/1200-69-0x00000000044E0000-0x0000000004598000-memory.dmpFilesize
736KB
-
memory/1472-68-0x00000000002F0000-0x0000000000300000-memory.dmpFilesize
64KB
-
memory/1472-66-0x00000000002B0000-0x00000000002C0000-memory.dmpFilesize
64KB
-
memory/1472-64-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1472-65-0x0000000000840000-0x0000000000B43000-memory.dmpFilesize
3.0MB
-
memory/1472-63-0x000000000041D0C0-mapping.dmp
-
memory/1848-60-0x00000000757C1000-0x00000000757C3000-memory.dmpFilesize
8KB
-
memory/1848-62-0x0000000000510000-0x0000000000512000-memory.dmpFilesize
8KB
-
memory/1904-70-0x0000000000000000-mapping.dmp
-
memory/1904-71-0x0000000000F70000-0x0000000000F7D000-memory.dmpFilesize
52KB
-
memory/1904-72-0x00000000000E0000-0x0000000000109000-memory.dmpFilesize
164KB
-
memory/1904-74-0x0000000000B50000-0x0000000000E53000-memory.dmpFilesize
3.0MB
-
memory/1904-75-0x0000000000910000-0x000000000099F000-memory.dmpFilesize
572KB