Analysis
-
max time kernel
146s -
max time network
138s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
29-01-2022 09:58
Static task
static1
Behavioral task
behavioral1
Sample
NEW ORDER.scr
Resource
win7-en-20211208
General
-
Target
NEW ORDER.scr
-
Size
818KB
-
MD5
7735f514bfc4111a49a0ed6078206788
-
SHA1
766933ccc287d5734ae351ca42fcb5ee6c1bd56f
-
SHA256
f2d58fc68302fb9cfc6ba93ca4f01f17c8baf7fef4cdfef59638e61fa4f54ad4
-
SHA512
a566f4372171517129aed5370937dfe6abb23aec230bb4ecefb63ec62c0df414d9708e7e8f97ece1c3ab6de5c64c9d6d7460d34b18e9199370e253e06cf18bae
Malware Config
Extracted
formbook
4.1
s16r
kellieroysellsnc.com
valleylowvoltage.com
mltuo900.xyz
visitingpuntacana.com
weiwushi.com
austintechjob.com
rxstarcbd.com
shopstudioesi.com
filetto-server.xyz
relianceltdbnk.com
unethical.world
yedd.store
esthershhs.com
magaddis.com
scenicdrivetours.com
123gest.com
2020mortagelifeinsurance.com
faceinle.com
integritymarking.com
alfatoto.xyz
nwebcam.com
wu8hx5cpgl3i.xyz
shiningbellsscrubs.com
visitorego.com
101-bg.com
blaccforestsociety.com
caremeinternational.com
devanharle.com
d2h7e3q.xyz
excaliburteacher.com
tatouagejaponais.com
gallematias.com
sobacoffee.com
thetravelbanana.com
artandmag.com
swoutfit.com
pecintaotomotif.com
realkezorup.xyz
shoplitumi.com
taylorhudak.net
prime-links.net
openvmsdatabasemigration.com
digitaltradingforex.com
vocenoazulnovamente.com
ertyuhjul.xyz
yunshangzhongwen.com
psalm686.com
breastfeedcare.com
matjaralmona.com
insurancesalesreps.com
octets.biz
reviewopenaccess.biz
parvatakrachka.com
vector-center.xyz
hatchvi.com
hmamah.com
a-home4you.com
lq-safe-keepingyuchand91.xyz
amplexus.xyz
h3ssel.xyz
aims-colorado.com
clickforrichesvision.com
belcantato.com
minidentalimplantsdaytonoh.com
mlniubi.xyz
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1132-60-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/616-67-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1896 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
NEW ORDER.scrNEW ORDER.scrraserver.exedescription pid process target process PID 1508 set thread context of 1132 1508 NEW ORDER.scr NEW ORDER.scr PID 1132 set thread context of 1316 1132 NEW ORDER.scr Explorer.EXE PID 616 set thread context of 1316 616 raserver.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
NEW ORDER.scrraserver.exepid process 1132 NEW ORDER.scr 1132 NEW ORDER.scr 616 raserver.exe 616 raserver.exe 616 raserver.exe 616 raserver.exe 616 raserver.exe 616 raserver.exe 616 raserver.exe 616 raserver.exe 616 raserver.exe 616 raserver.exe 616 raserver.exe 616 raserver.exe 616 raserver.exe 616 raserver.exe 616 raserver.exe 616 raserver.exe 616 raserver.exe 616 raserver.exe 616 raserver.exe 616 raserver.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
NEW ORDER.scrraserver.exepid process 1132 NEW ORDER.scr 1132 NEW ORDER.scr 1132 NEW ORDER.scr 616 raserver.exe 616 raserver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
NEW ORDER.scrraserver.exedescription pid process Token: SeDebugPrivilege 1132 NEW ORDER.scr Token: SeDebugPrivilege 616 raserver.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1316 Explorer.EXE 1316 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1316 Explorer.EXE 1316 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEW ORDER.scrExplorer.EXEraserver.exedescription pid process target process PID 1508 wrote to memory of 1132 1508 NEW ORDER.scr NEW ORDER.scr PID 1508 wrote to memory of 1132 1508 NEW ORDER.scr NEW ORDER.scr PID 1508 wrote to memory of 1132 1508 NEW ORDER.scr NEW ORDER.scr PID 1508 wrote to memory of 1132 1508 NEW ORDER.scr NEW ORDER.scr PID 1508 wrote to memory of 1132 1508 NEW ORDER.scr NEW ORDER.scr PID 1508 wrote to memory of 1132 1508 NEW ORDER.scr NEW ORDER.scr PID 1508 wrote to memory of 1132 1508 NEW ORDER.scr NEW ORDER.scr PID 1316 wrote to memory of 616 1316 Explorer.EXE raserver.exe PID 1316 wrote to memory of 616 1316 Explorer.EXE raserver.exe PID 1316 wrote to memory of 616 1316 Explorer.EXE raserver.exe PID 1316 wrote to memory of 616 1316 Explorer.EXE raserver.exe PID 616 wrote to memory of 1896 616 raserver.exe cmd.exe PID 616 wrote to memory of 1896 616 raserver.exe cmd.exe PID 616 wrote to memory of 1896 616 raserver.exe cmd.exe PID 616 wrote to memory of 1896 616 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER.scr"C:\Users\Admin\AppData\Local\Temp\NEW ORDER.scr" /S2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER.scr"C:\Users\Admin\AppData\Local\Temp\NEW ORDER.scr"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\NEW ORDER.scr"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/616-66-0x0000000000120000-0x000000000013C000-memory.dmpFilesize
112KB
-
memory/616-69-0x0000000001D80000-0x0000000001E13000-memory.dmpFilesize
588KB
-
memory/616-68-0x0000000001E90000-0x0000000002193000-memory.dmpFilesize
3.0MB
-
memory/616-67-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1132-62-0x0000000000890000-0x0000000000B93000-memory.dmpFilesize
3.0MB
-
memory/1132-58-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1132-59-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1132-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1132-63-0x0000000000320000-0x0000000000334000-memory.dmpFilesize
80KB
-
memory/1316-64-0x0000000005F10000-0x000000000601B000-memory.dmpFilesize
1.0MB
-
memory/1316-70-0x0000000006810000-0x0000000006945000-memory.dmpFilesize
1.2MB
-
memory/1508-53-0x0000000001070000-0x0000000001142000-memory.dmpFilesize
840KB
-
memory/1508-57-0x00000000055F0000-0x0000000005656000-memory.dmpFilesize
408KB
-
memory/1508-56-0x0000000000630000-0x000000000063C000-memory.dmpFilesize
48KB
-
memory/1508-55-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/1508-54-0x0000000076911000-0x0000000076913000-memory.dmpFilesize
8KB