Analysis
-
max time kernel
156s -
max time network
159s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
29-01-2022 09:58
Static task
static1
Behavioral task
behavioral1
Sample
NEW ORDER.scr
Resource
win7-en-20211208
General
-
Target
NEW ORDER.scr
-
Size
818KB
-
MD5
7735f514bfc4111a49a0ed6078206788
-
SHA1
766933ccc287d5734ae351ca42fcb5ee6c1bd56f
-
SHA256
f2d58fc68302fb9cfc6ba93ca4f01f17c8baf7fef4cdfef59638e61fa4f54ad4
-
SHA512
a566f4372171517129aed5370937dfe6abb23aec230bb4ecefb63ec62c0df414d9708e7e8f97ece1c3ab6de5c64c9d6d7460d34b18e9199370e253e06cf18bae
Malware Config
Extracted
formbook
4.1
s16r
kellieroysellsnc.com
valleylowvoltage.com
mltuo900.xyz
visitingpuntacana.com
weiwushi.com
austintechjob.com
rxstarcbd.com
shopstudioesi.com
filetto-server.xyz
relianceltdbnk.com
unethical.world
yedd.store
esthershhs.com
magaddis.com
scenicdrivetours.com
123gest.com
2020mortagelifeinsurance.com
faceinle.com
integritymarking.com
alfatoto.xyz
nwebcam.com
wu8hx5cpgl3i.xyz
shiningbellsscrubs.com
visitorego.com
101-bg.com
blaccforestsociety.com
caremeinternational.com
devanharle.com
d2h7e3q.xyz
excaliburteacher.com
tatouagejaponais.com
gallematias.com
sobacoffee.com
thetravelbanana.com
artandmag.com
swoutfit.com
pecintaotomotif.com
realkezorup.xyz
shoplitumi.com
taylorhudak.net
prime-links.net
openvmsdatabasemigration.com
digitaltradingforex.com
vocenoazulnovamente.com
ertyuhjul.xyz
yunshangzhongwen.com
psalm686.com
breastfeedcare.com
matjaralmona.com
insurancesalesreps.com
octets.biz
reviewopenaccess.biz
parvatakrachka.com
vector-center.xyz
hatchvi.com
hmamah.com
a-home4you.com
lq-safe-keepingyuchand91.xyz
amplexus.xyz
h3ssel.xyz
aims-colorado.com
clickforrichesvision.com
belcantato.com
minidentalimplantsdaytonoh.com
mlniubi.xyz
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1556-126-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1556-129-0x0000000001440000-0x000000000158A000-memory.dmp formbook behavioral2/memory/1512-132-0x0000000002C10000-0x0000000002C3F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
NEW ORDER.scrNEW ORDER.scrraserver.exedescription pid process target process PID 3264 set thread context of 1556 3264 NEW ORDER.scr NEW ORDER.scr PID 1556 set thread context of 1928 1556 NEW ORDER.scr Explorer.EXE PID 1512 set thread context of 1928 1512 raserver.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
NEW ORDER.scrraserver.exepid process 1556 NEW ORDER.scr 1556 NEW ORDER.scr 1556 NEW ORDER.scr 1556 NEW ORDER.scr 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe 1512 raserver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1928 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
NEW ORDER.scrraserver.exepid process 1556 NEW ORDER.scr 1556 NEW ORDER.scr 1556 NEW ORDER.scr 1512 raserver.exe 1512 raserver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
NEW ORDER.scrraserver.exedescription pid process Token: SeDebugPrivilege 1556 NEW ORDER.scr Token: SeDebugPrivilege 1512 raserver.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
NEW ORDER.scrExplorer.EXEraserver.exedescription pid process target process PID 3264 wrote to memory of 1556 3264 NEW ORDER.scr NEW ORDER.scr PID 3264 wrote to memory of 1556 3264 NEW ORDER.scr NEW ORDER.scr PID 3264 wrote to memory of 1556 3264 NEW ORDER.scr NEW ORDER.scr PID 3264 wrote to memory of 1556 3264 NEW ORDER.scr NEW ORDER.scr PID 3264 wrote to memory of 1556 3264 NEW ORDER.scr NEW ORDER.scr PID 3264 wrote to memory of 1556 3264 NEW ORDER.scr NEW ORDER.scr PID 1928 wrote to memory of 1512 1928 Explorer.EXE raserver.exe PID 1928 wrote to memory of 1512 1928 Explorer.EXE raserver.exe PID 1928 wrote to memory of 1512 1928 Explorer.EXE raserver.exe PID 1512 wrote to memory of 1148 1512 raserver.exe cmd.exe PID 1512 wrote to memory of 1148 1512 raserver.exe cmd.exe PID 1512 wrote to memory of 1148 1512 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER.scr"C:\Users\Admin\AppData\Local\Temp\NEW ORDER.scr" /S2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER.scr"C:\Users\Admin\AppData\Local\Temp\NEW ORDER.scr"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\NEW ORDER.scr"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1512-132-0x0000000002C10000-0x0000000002C3F000-memory.dmpFilesize
188KB
-
memory/1512-134-0x0000000004940000-0x0000000004AD3000-memory.dmpFilesize
1.6MB
-
memory/1512-133-0x0000000004AE0000-0x0000000004E00000-memory.dmpFilesize
3.1MB
-
memory/1512-131-0x0000000000830000-0x000000000084F000-memory.dmpFilesize
124KB
-
memory/1556-126-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1556-128-0x00000000018B0000-0x0000000001BD0000-memory.dmpFilesize
3.1MB
-
memory/1556-129-0x0000000001440000-0x000000000158A000-memory.dmpFilesize
1.3MB
-
memory/1928-130-0x0000000002680000-0x000000000276F000-memory.dmpFilesize
956KB
-
memory/1928-135-0x0000000005DB0000-0x0000000005EA6000-memory.dmpFilesize
984KB
-
memory/3264-123-0x0000000005830000-0x000000000583C000-memory.dmpFilesize
48KB
-
memory/3264-124-0x0000000007EF0000-0x0000000007F8C000-memory.dmpFilesize
624KB
-
memory/3264-125-0x0000000008070000-0x00000000080D6000-memory.dmpFilesize
408KB
-
memory/3264-118-0x0000000000BB0000-0x0000000000C82000-memory.dmpFilesize
840KB
-
memory/3264-122-0x00000000055B0000-0x0000000005AAE000-memory.dmpFilesize
5.0MB
-
memory/3264-121-0x0000000005560000-0x000000000556A000-memory.dmpFilesize
40KB
-
memory/3264-120-0x00000000054C0000-0x0000000005552000-memory.dmpFilesize
584KB
-
memory/3264-119-0x0000000005AB0000-0x0000000005FAE000-memory.dmpFilesize
5.0MB