Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
06-05-2021 08:12
Static task
static1
Behavioral task
behavioral1
Sample
NEW ORDER.exe
Resource
win7v20210408
General
-
Target
NEW ORDER.exe
-
Size
205KB
-
MD5
51e414df61a38f968f3469b87b55a007
-
SHA1
81e101222f03e27d1e627b36daf2bcf5cfd478ff
-
SHA256
3acd86ada75ac819a4374720b7e4dfbf270974237f9e7794c7cc51d510a9bff9
-
SHA512
fbd6043b5bc059431943e3da68ec25e5a6ef5ecd88feb1703cd395dc33ab3da5e5eb1076577e4f9a969048c7c373e0bd395c293fee708007f61167f8c54c79d4
Malware Config
Extracted
xloader
2.3
http://www.onyxcomputing.com/u8nw/
constructionjadams.com
organicwellnessfarm.com
beautiful.tours
medvows.com
foxparanormal.com
fsmxmc.com
graniterealestategroup.net
qgi1.com
astrologicsolutions.com
rafbar.com
bastiontools.net
emotist.com
stacyleets.com
bloodtypealpha.com
healtybenenfitsplus.com
vavadadoa3.com
chefbenhk.com
dotgz.com
xn--z4qm188e645c.com
ethyi.com
farrellforcouncil.com
everythingcornea.com
pensje.net
haichuanxin.com
codeproper.com
beautyblvdca.com
namastecarrier.com
xtrator.com
alphabrainbalancing.com
sensationalcleaningservices.net
magistv.info
shotsbynox.com
zioninfosystems.net
yourstoryplace.com
ebmulla.com
turkeyvisa-government.com
albertsonsolutions.com
7brochasmagicas.com
revolutiontourselsalvador.com
eastboundanddowntrucking.com
jkskylights.com
ultimatepoolwater.com
diurr.com
investmentfocused.com
dogscanstay.com
inov8digital.com
paragoncraftevents.com
reservesunbeds.com
melaniesalascosmetics.com
vissito.com
axolc-upoc.xyz
customessayjojo.com
kladki.com
online-securegov.com
xn--demirelik-u3a.com
plgmap.com
contorig2.com
dgyzgs8.com
valuedmind.com
sanacolitademarijuana.com
xn--6j1bs50berk.com
labkitsforstudents.com
lifehakershagirl.online
candidanddevout.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/776-63-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1560-70-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1648 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
NEW ORDER.exepid process 1848 NEW ORDER.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
NEW ORDER.exeNEW ORDER.execmmon32.exedescription pid process target process PID 1848 set thread context of 776 1848 NEW ORDER.exe NEW ORDER.exe PID 776 set thread context of 1200 776 NEW ORDER.exe Explorer.EXE PID 1560 set thread context of 1200 1560 cmmon32.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
NEW ORDER.execmmon32.exepid process 776 NEW ORDER.exe 776 NEW ORDER.exe 1560 cmmon32.exe 1560 cmmon32.exe 1560 cmmon32.exe 1560 cmmon32.exe 1560 cmmon32.exe 1560 cmmon32.exe 1560 cmmon32.exe 1560 cmmon32.exe 1560 cmmon32.exe 1560 cmmon32.exe 1560 cmmon32.exe 1560 cmmon32.exe 1560 cmmon32.exe 1560 cmmon32.exe 1560 cmmon32.exe 1560 cmmon32.exe 1560 cmmon32.exe 1560 cmmon32.exe 1560 cmmon32.exe 1560 cmmon32.exe 1560 cmmon32.exe 1560 cmmon32.exe 1560 cmmon32.exe 1560 cmmon32.exe 1560 cmmon32.exe 1560 cmmon32.exe 1560 cmmon32.exe 1560 cmmon32.exe 1560 cmmon32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
NEW ORDER.exeNEW ORDER.execmmon32.exepid process 1848 NEW ORDER.exe 776 NEW ORDER.exe 776 NEW ORDER.exe 776 NEW ORDER.exe 1560 cmmon32.exe 1560 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
NEW ORDER.execmmon32.exedescription pid process Token: SeDebugPrivilege 776 NEW ORDER.exe Token: SeDebugPrivilege 1560 cmmon32.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
NEW ORDER.exeExplorer.EXEcmmon32.exedescription pid process target process PID 1848 wrote to memory of 776 1848 NEW ORDER.exe NEW ORDER.exe PID 1848 wrote to memory of 776 1848 NEW ORDER.exe NEW ORDER.exe PID 1848 wrote to memory of 776 1848 NEW ORDER.exe NEW ORDER.exe PID 1848 wrote to memory of 776 1848 NEW ORDER.exe NEW ORDER.exe PID 1848 wrote to memory of 776 1848 NEW ORDER.exe NEW ORDER.exe PID 1200 wrote to memory of 1560 1200 Explorer.EXE cmmon32.exe PID 1200 wrote to memory of 1560 1200 Explorer.EXE cmmon32.exe PID 1200 wrote to memory of 1560 1200 Explorer.EXE cmmon32.exe PID 1200 wrote to memory of 1560 1200 Explorer.EXE cmmon32.exe PID 1560 wrote to memory of 1648 1560 cmmon32.exe cmd.exe PID 1560 wrote to memory of 1648 1560 cmmon32.exe cmd.exe PID 1560 wrote to memory of 1648 1560 cmmon32.exe cmd.exe PID 1560 wrote to memory of 1648 1560 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nssA14F.tmp\149krcin7vt4.dllMD5
51bd36292cade7dc6e172f4d13441b83
SHA18fb008c8d2295556d4b7fb6df32628ff00574138
SHA256b37af9d0f9f56778aba08bf2ec6c46a4380faea9b463f98c928b446cf5851336
SHA5126d5618ff913be23a071168cb3e9ffc6bdff5de3894903fbff9d555c062c9ab386ab662c81d617578c398c9834a4abb21fa997a64f045782f75e86210416adf1f
-
memory/776-61-0x000000000041D0C0-mapping.dmp
-
memory/776-63-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/776-65-0x00000000001C0000-0x00000000001D0000-memory.dmpFilesize
64KB
-
memory/776-64-0x0000000000700000-0x0000000000A03000-memory.dmpFilesize
3.0MB
-
memory/1200-73-0x0000000004AC0000-0x0000000004BE7000-memory.dmpFilesize
1.2MB
-
memory/1200-66-0x0000000006130000-0x00000000062A2000-memory.dmpFilesize
1.4MB
-
memory/1560-69-0x0000000000410000-0x000000000041D000-memory.dmpFilesize
52KB
-
memory/1560-67-0x0000000000000000-mapping.dmp
-
memory/1560-72-0x0000000001D40000-0x0000000001DCF000-memory.dmpFilesize
572KB
-
memory/1560-70-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1560-71-0x0000000002010000-0x0000000002313000-memory.dmpFilesize
3.0MB
-
memory/1648-68-0x0000000000000000-mapping.dmp
-
memory/1848-59-0x00000000757C1000-0x00000000757C3000-memory.dmpFilesize
8KB
-
memory/1848-62-0x0000000002460000-0x00000000030AA000-memory.dmpFilesize
12.3MB