Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
06-05-2021 07:11
Static task
static1
Behavioral task
behavioral1
Sample
NEW ORDER.exe
Resource
win7v20210408
General
-
Target
NEW ORDER.exe
-
Size
205KB
-
MD5
51e414df61a38f968f3469b87b55a007
-
SHA1
81e101222f03e27d1e627b36daf2bcf5cfd478ff
-
SHA256
3acd86ada75ac819a4374720b7e4dfbf270974237f9e7794c7cc51d510a9bff9
-
SHA512
fbd6043b5bc059431943e3da68ec25e5a6ef5ecd88feb1703cd395dc33ab3da5e5eb1076577e4f9a969048c7c373e0bd395c293fee708007f61167f8c54c79d4
Malware Config
Extracted
xloader
2.3
http://www.onyxcomputing.com/u8nw/
constructionjadams.com
organicwellnessfarm.com
beautiful.tours
medvows.com
foxparanormal.com
fsmxmc.com
graniterealestategroup.net
qgi1.com
astrologicsolutions.com
rafbar.com
bastiontools.net
emotist.com
stacyleets.com
bloodtypealpha.com
healtybenenfitsplus.com
vavadadoa3.com
chefbenhk.com
dotgz.com
xn--z4qm188e645c.com
ethyi.com
farrellforcouncil.com
everythingcornea.com
pensje.net
haichuanxin.com
codeproper.com
beautyblvdca.com
namastecarrier.com
xtrator.com
alphabrainbalancing.com
sensationalcleaningservices.net
magistv.info
shotsbynox.com
zioninfosystems.net
yourstoryplace.com
ebmulla.com
turkeyvisa-government.com
albertsonsolutions.com
7brochasmagicas.com
revolutiontourselsalvador.com
eastboundanddowntrucking.com
jkskylights.com
ultimatepoolwater.com
diurr.com
investmentfocused.com
dogscanstay.com
inov8digital.com
paragoncraftevents.com
reservesunbeds.com
melaniesalascosmetics.com
vissito.com
axolc-upoc.xyz
customessayjojo.com
kladki.com
online-securegov.com
xn--demirelik-u3a.com
plgmap.com
contorig2.com
dgyzgs8.com
valuedmind.com
sanacolitademarijuana.com
xn--6j1bs50berk.com
labkitsforstudents.com
lifehakershagirl.online
candidanddevout.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3948-117-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3736-127-0x0000000001030000-0x0000000001059000-memory.dmp xloader -
Loads dropped DLL 1 IoCs
Processes:
NEW ORDER.exepid process 2112 NEW ORDER.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
NEW ORDER.exeNEW ORDER.exemsiexec.exedescription pid process target process PID 2112 set thread context of 3948 2112 NEW ORDER.exe NEW ORDER.exe PID 3948 set thread context of 2996 3948 NEW ORDER.exe Explorer.EXE PID 3948 set thread context of 2996 3948 NEW ORDER.exe Explorer.EXE PID 3736 set thread context of 2996 3736 msiexec.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
NEW ORDER.exemsiexec.exepid process 3948 NEW ORDER.exe 3948 NEW ORDER.exe 3948 NEW ORDER.exe 3948 NEW ORDER.exe 3948 NEW ORDER.exe 3948 NEW ORDER.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe 3736 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2996 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
NEW ORDER.exeNEW ORDER.exemsiexec.exepid process 2112 NEW ORDER.exe 3948 NEW ORDER.exe 3948 NEW ORDER.exe 3948 NEW ORDER.exe 3948 NEW ORDER.exe 3736 msiexec.exe 3736 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
NEW ORDER.exeExplorer.EXEmsiexec.exedescription pid process Token: SeDebugPrivilege 3948 NEW ORDER.exe Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeDebugPrivilege 3736 msiexec.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2996 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
NEW ORDER.exeExplorer.EXEmsiexec.exedescription pid process target process PID 2112 wrote to memory of 3948 2112 NEW ORDER.exe NEW ORDER.exe PID 2112 wrote to memory of 3948 2112 NEW ORDER.exe NEW ORDER.exe PID 2112 wrote to memory of 3948 2112 NEW ORDER.exe NEW ORDER.exe PID 2112 wrote to memory of 3948 2112 NEW ORDER.exe NEW ORDER.exe PID 2996 wrote to memory of 3736 2996 Explorer.EXE msiexec.exe PID 2996 wrote to memory of 3736 2996 Explorer.EXE msiexec.exe PID 2996 wrote to memory of 3736 2996 Explorer.EXE msiexec.exe PID 3736 wrote to memory of 1792 3736 msiexec.exe cmd.exe PID 3736 wrote to memory of 1792 3736 msiexec.exe cmd.exe PID 3736 wrote to memory of 1792 3736 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3948 -
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:3004
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:740
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:3576
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:4004
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:752
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"3⤵PID:1792
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsl15A2.tmp\149krcin7vt4.dllMD5
51bd36292cade7dc6e172f4d13441b83
SHA18fb008c8d2295556d4b7fb6df32628ff00574138
SHA256b37af9d0f9f56778aba08bf2ec6c46a4380faea9b463f98c928b446cf5851336
SHA5126d5618ff913be23a071168cb3e9ffc6bdff5de3894903fbff9d555c062c9ab386ab662c81d617578c398c9834a4abb21fa997a64f045782f75e86210416adf1f
-
memory/1792-129-0x0000000000000000-mapping.dmp
-
memory/2112-116-0x00000000027E0000-0x00000000027E2000-memory.dmpFilesize
8KB
-
memory/2996-120-0x0000000004D10000-0x0000000004E24000-memory.dmpFilesize
1.1MB
-
memory/2996-131-0x0000000002740000-0x0000000002818000-memory.dmpFilesize
864KB
-
memory/2996-122-0x0000000004E30000-0x0000000004F37000-memory.dmpFilesize
1.0MB
-
memory/3736-128-0x0000000005070000-0x0000000005390000-memory.dmpFilesize
3.1MB
-
memory/3736-123-0x0000000000000000-mapping.dmp
-
memory/3736-126-0x0000000001060000-0x0000000001072000-memory.dmpFilesize
72KB
-
memory/3736-127-0x0000000001030000-0x0000000001059000-memory.dmpFilesize
164KB
-
memory/3736-130-0x0000000004EF0000-0x0000000004F7F000-memory.dmpFilesize
572KB
-
memory/3948-121-0x0000000000470000-0x00000000005BA000-memory.dmpFilesize
1.3MB
-
memory/3948-119-0x0000000000450000-0x0000000000460000-memory.dmpFilesize
64KB
-
memory/3948-118-0x0000000000A30000-0x0000000000D50000-memory.dmpFilesize
3.1MB
-
memory/3948-117-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3948-115-0x000000000041D0C0-mapping.dmp