Overview

overview

9

Static

static

7

New_Order.exe

windows7_x64

9

New_Order.exe

windows10_x64

9

Resubmissions

25-01-2022 16:56

220125-vf2xpsbeb5 9

11-01-2022 16:17

220111-trh4asgcb9 9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    New_Order.exe

  • Size

    2.6MB

  • Sample

    220125-vf2xpsbeb5

  • MD5

    3b585ac87a4c039f3685c66cadc62960

  • SHA1

    a7f60a4dd8931e81b736adc744a4e709e8c5ffe7

  • SHA256

    60fb9597e5843c72d761525f73ca728409579d81901860981ebd84f7d153cfa3

  • SHA512

    bf2c4dea4cf1174562b60a6793111aa486e512c4a2e4da1d227ff3852a2c8e7892f1a3bc8ec2eb1315ebaa353f13fa684bade76b4c9c807cf0e86b5ac3903dfd

Score
9/10
collectionevasionthemidatrojan

Malware Config

Targets

    • Target

      New_Order.exe

    • Size

      2.6MB

    • MD5

      3b585ac87a4c039f3685c66cadc62960

    • SHA1

      a7f60a4dd8931e81b736adc744a4e709e8c5ffe7

    • SHA256

      60fb9597e5843c72d761525f73ca728409579d81901860981ebd84f7d153cfa3

    • SHA512

      bf2c4dea4cf1174562b60a6793111aa486e512c4a2e4da1d227ff3852a2c8e7892f1a3bc8ec2eb1315ebaa353f13fa684bade76b4c9c807cf0e86b5ac3903dfd

    Score
    9/10
    collectionevasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Accesses Microsoft Outlook profiles

      collection

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks