Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
06-05-2021 08:12
Static task
static1
Behavioral task
behavioral1
Sample
NEW ORDER.exe
Resource
win7v20210408
General
-
Target
NEW ORDER.exe
-
Size
205KB
-
MD5
51e414df61a38f968f3469b87b55a007
-
SHA1
81e101222f03e27d1e627b36daf2bcf5cfd478ff
-
SHA256
3acd86ada75ac819a4374720b7e4dfbf270974237f9e7794c7cc51d510a9bff9
-
SHA512
fbd6043b5bc059431943e3da68ec25e5a6ef5ecd88feb1703cd395dc33ab3da5e5eb1076577e4f9a969048c7c373e0bd395c293fee708007f61167f8c54c79d4
Malware Config
Extracted
xloader
2.3
http://www.onyxcomputing.com/u8nw/
constructionjadams.com
organicwellnessfarm.com
beautiful.tours
medvows.com
foxparanormal.com
fsmxmc.com
graniterealestategroup.net
qgi1.com
astrologicsolutions.com
rafbar.com
bastiontools.net
emotist.com
stacyleets.com
bloodtypealpha.com
healtybenenfitsplus.com
vavadadoa3.com
chefbenhk.com
dotgz.com
xn--z4qm188e645c.com
ethyi.com
farrellforcouncil.com
everythingcornea.com
pensje.net
haichuanxin.com
codeproper.com
beautyblvdca.com
namastecarrier.com
xtrator.com
alphabrainbalancing.com
sensationalcleaningservices.net
magistv.info
shotsbynox.com
zioninfosystems.net
yourstoryplace.com
ebmulla.com
turkeyvisa-government.com
albertsonsolutions.com
7brochasmagicas.com
revolutiontourselsalvador.com
eastboundanddowntrucking.com
jkskylights.com
ultimatepoolwater.com
diurr.com
investmentfocused.com
dogscanstay.com
inov8digital.com
paragoncraftevents.com
reservesunbeds.com
melaniesalascosmetics.com
vissito.com
axolc-upoc.xyz
customessayjojo.com
kladki.com
online-securegov.com
xn--demirelik-u3a.com
plgmap.com
contorig2.com
dgyzgs8.com
valuedmind.com
sanacolitademarijuana.com
xn--6j1bs50berk.com
labkitsforstudents.com
lifehakershagirl.online
candidanddevout.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1056-117-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1808-124-0x0000000000500000-0x0000000000529000-memory.dmp xloader -
Loads dropped DLL 1 IoCs
Processes:
NEW ORDER.exepid process 3176 NEW ORDER.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
NEW ORDER.exeNEW ORDER.exewscript.exedescription pid process target process PID 3176 set thread context of 1056 3176 NEW ORDER.exe NEW ORDER.exe PID 1056 set thread context of 2716 1056 NEW ORDER.exe Explorer.EXE PID 1808 set thread context of 2716 1808 wscript.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
NEW ORDER.exewscript.exepid process 1056 NEW ORDER.exe 1056 NEW ORDER.exe 1056 NEW ORDER.exe 1056 NEW ORDER.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2716 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
NEW ORDER.exeNEW ORDER.exewscript.exepid process 3176 NEW ORDER.exe 1056 NEW ORDER.exe 1056 NEW ORDER.exe 1056 NEW ORDER.exe 1808 wscript.exe 1808 wscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
NEW ORDER.exewscript.exedescription pid process Token: SeDebugPrivilege 1056 NEW ORDER.exe Token: SeDebugPrivilege 1808 wscript.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2716 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
NEW ORDER.exeExplorer.EXEwscript.exedescription pid process target process PID 3176 wrote to memory of 1056 3176 NEW ORDER.exe NEW ORDER.exe PID 3176 wrote to memory of 1056 3176 NEW ORDER.exe NEW ORDER.exe PID 3176 wrote to memory of 1056 3176 NEW ORDER.exe NEW ORDER.exe PID 3176 wrote to memory of 1056 3176 NEW ORDER.exe NEW ORDER.exe PID 2716 wrote to memory of 1808 2716 Explorer.EXE wscript.exe PID 2716 wrote to memory of 1808 2716 Explorer.EXE wscript.exe PID 2716 wrote to memory of 1808 2716 Explorer.EXE wscript.exe PID 1808 wrote to memory of 3516 1808 wscript.exe cmd.exe PID 1808 wrote to memory of 3516 1808 wscript.exe cmd.exe PID 1808 wrote to memory of 3516 1808 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nshD64.tmp\149krcin7vt4.dllMD5
51bd36292cade7dc6e172f4d13441b83
SHA18fb008c8d2295556d4b7fb6df32628ff00574138
SHA256b37af9d0f9f56778aba08bf2ec6c46a4380faea9b463f98c928b446cf5851336
SHA5126d5618ff913be23a071168cb3e9ffc6bdff5de3894903fbff9d555c062c9ab386ab662c81d617578c398c9834a4abb21fa997a64f045782f75e86210416adf1f
-
memory/1056-119-0x00000000009C0000-0x00000000009D0000-memory.dmpFilesize
64KB
-
memory/1056-116-0x000000000041D0C0-mapping.dmp
-
memory/1056-117-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1056-118-0x0000000000AC0000-0x0000000000DE0000-memory.dmpFilesize
3.1MB
-
memory/1808-121-0x0000000000000000-mapping.dmp
-
memory/1808-123-0x0000000001220000-0x0000000001247000-memory.dmpFilesize
156KB
-
memory/1808-124-0x0000000000500000-0x0000000000529000-memory.dmpFilesize
164KB
-
memory/1808-125-0x0000000004650000-0x0000000004970000-memory.dmpFilesize
3.1MB
-
memory/1808-126-0x0000000000FA0000-0x000000000102F000-memory.dmpFilesize
572KB
-
memory/2716-120-0x0000000005180000-0x00000000052B2000-memory.dmpFilesize
1.2MB
-
memory/2716-127-0x0000000002A70000-0x0000000002B59000-memory.dmpFilesize
932KB
-
memory/3176-115-0x0000000002170000-0x0000000002194000-memory.dmpFilesize
144KB
-
memory/3516-122-0x0000000000000000-mapping.dmp