Analysis
-
max time kernel
225s -
max time network
296s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 14:27
Static task
static1
Behavioral task
behavioral1
Sample
Order#6122-001.exe
Resource
win7-20221111-en
General
-
Target
Order#6122-001.exe
-
Size
1.1MB
-
MD5
dee22604ff5c70b766d186f787dc6bfb
-
SHA1
77c102d3dad8675d05666f0738e9afe251ef23a3
-
SHA256
3e3615ec6c5ef753c75fc1448d7e5a49136e3c7b5d2016e107107f17c4816aa6
-
SHA512
e5447732ac879ddd70d747c4c395dc5d1f91f302c198046f2b1ad4a8ddd70469b15f56aaa2eeda777a54e2f699a70d7f1ea5ff2afa003b263483569462fe6299
-
SSDEEP
24576:t33GJYDtv4SSrA/40YyxTLLd7qK/PGm24EYPF8h0B1bqdOp:tGupvv2AhYC/B2Wr24VF8h0vbqdO
Malware Config
Extracted
formbook
n2hm
XCeG4IxNKbAl
YzJWbnC+El84nA==
KAJcdmP8yEcO5LXPCFF42Wfb
I+J+xYO95GJQWVU=
GtgxPPv3FmQmhw==
Og9NYF4xEl+j7vGTR93xvg==
506Cg07bsT0G6yK+A96H0h35V+JLkwI=
wAYXFN+pSFIXgQ==
ijzLI/f+FmQmhw==
UfT2PweNm+w8
GQWVw5aZnfF/kS5e
30BKYjua9zcA7gAwsPUngLnjyrBNEgo=
AM65OrmyFmQmhw==
VSlTVxISZ4J/kS5e
GGKj6K33SRh6e0/YzT5nQGlK5CXRqw==
B9H98cUUfX+AWOqiTA==
MxVffWOIoVnM37zrd2sTaOY=
z6bxCgG/mGhR7oDzQA==
pQgSLSRi6AK3M/PdArpX
6rRRsYuSnXx/kS5e
tJRNn0ias3Yw
7c4NEQLSp/R/kS5e
TJmwu5Aa/IuRHtoXXQ==
TLoRUygkiJQE5GoRji0aff0=
Y83qB/DsQFYeZzahj6pYqw==
Bup2q3PHFmQmhw==
cDTa78WEWaYMdoDdArpX
28Rw4MRMnjT52raaTR5KhtMJYa8=
WydpZS7v/4XubCZuhkdxP2OAKdyK68u6
B+osKudaL8yAV/K/VAH3T+Q=
qVz9Y0QD3TGeM/PdArpX
+r49VzlFXLpFegdyc4q5ow==
gsXk990afa1hl6ATTA==
XkblOQWRaet/kS5e
4TNPSf2OcfNk9cfPCFF42Wfb
NaIIUEoRdKYr
ITSqBfn5FmQmhw==
KPRUmWnqxVE0hERFtyo=
VLzd1qk6E5wNcQ49KnmhAoT3Ok5roMK4kQ==
65jM2pKJ8EIST04=
I3+JoYVgYgDiv3O15Ntvw0On/sJroMK4kQ==
C+YhNzH20aCpy8MqVw==
yBZRl4HdPn+RHtoXXQ==
pGQATg0mMfntSBR9c4q5ow==
YUKFixIRdKYr
Hv+C4cZTOMAKV+/dArpX
MVW+PJpyCVA=
FX2AJYBFYbgk
/cX1CsjSpvU+
fWoThWagDVhBHt4yMjWQifM=
/vCd69xrS8QwuCt/yD8=
GvAsSzbCRxplG582TKzVug==
S6zlGfJ6DFc4TBNUvig=
k0z/QwnTpfR/kS5e
KPofKfkPcoRqxowFuWWNhvM=
Xrj+JvENc3yBln4OUw==
ScTatpYj/IKRHtoXXQ==
vLRdwbLyTpzFn+dAR93xvg==
mLTJe/eFp2kxl69W
Cbr5/dRQbio2P/e8ay0aff0=
xooviWn51V7DI7mMOwWT4lCIJUlf
l0t7fTmLqSCAuIYIVA==
06xFejwYMSkbfETTiNT21O0=
bWzTF+1nS4kxlydW
madamkikkiey.net
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Order#6122-001.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Control Panel\International\Geo\Nation Order#6122-001.exe -
Loads dropped DLL 1 IoCs
Processes:
NAPSTAT.EXEpid process 1372 NAPSTAT.EXE -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Order#6122-001.exeOrder#6122-001.exeNAPSTAT.EXEdescription pid process target process PID 948 set thread context of 688 948 Order#6122-001.exe Order#6122-001.exe PID 688 set thread context of 1212 688 Order#6122-001.exe Explorer.EXE PID 1372 set thread context of 1212 1372 NAPSTAT.EXE Explorer.EXE -
Processes:
NAPSTAT.EXEdescription ioc process Key created \Registry\User\S-1-5-21-1214520366-621468234-4062160515-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 NAPSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
Order#6122-001.exeNAPSTAT.EXEpid process 688 Order#6122-001.exe 688 Order#6122-001.exe 688 Order#6122-001.exe 688 Order#6122-001.exe 1372 NAPSTAT.EXE 1372 NAPSTAT.EXE 1372 NAPSTAT.EXE 1372 NAPSTAT.EXE 1372 NAPSTAT.EXE 1372 NAPSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Order#6122-001.exeNAPSTAT.EXEpid process 688 Order#6122-001.exe 688 Order#6122-001.exe 688 Order#6122-001.exe 1372 NAPSTAT.EXE 1372 NAPSTAT.EXE 1372 NAPSTAT.EXE 1372 NAPSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Order#6122-001.exeNAPSTAT.EXEdescription pid process Token: SeDebugPrivilege 688 Order#6122-001.exe Token: SeDebugPrivilege 1372 NAPSTAT.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Order#6122-001.exeExplorer.EXENAPSTAT.EXEdescription pid process target process PID 948 wrote to memory of 688 948 Order#6122-001.exe Order#6122-001.exe PID 948 wrote to memory of 688 948 Order#6122-001.exe Order#6122-001.exe PID 948 wrote to memory of 688 948 Order#6122-001.exe Order#6122-001.exe PID 948 wrote to memory of 688 948 Order#6122-001.exe Order#6122-001.exe PID 948 wrote to memory of 688 948 Order#6122-001.exe Order#6122-001.exe PID 948 wrote to memory of 688 948 Order#6122-001.exe Order#6122-001.exe PID 948 wrote to memory of 688 948 Order#6122-001.exe Order#6122-001.exe PID 1212 wrote to memory of 1372 1212 Explorer.EXE NAPSTAT.EXE PID 1212 wrote to memory of 1372 1212 Explorer.EXE NAPSTAT.EXE PID 1212 wrote to memory of 1372 1212 Explorer.EXE NAPSTAT.EXE PID 1212 wrote to memory of 1372 1212 Explorer.EXE NAPSTAT.EXE PID 1372 wrote to memory of 1868 1372 NAPSTAT.EXE Firefox.exe PID 1372 wrote to memory of 1868 1372 NAPSTAT.EXE Firefox.exe PID 1372 wrote to memory of 1868 1372 NAPSTAT.EXE Firefox.exe PID 1372 wrote to memory of 1868 1372 NAPSTAT.EXE Firefox.exe PID 1372 wrote to memory of 1868 1372 NAPSTAT.EXE Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order#6122-001.exe"C:\Users\Admin\AppData\Local\Temp\Order#6122-001.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order#6122-001.exe"C:\Users\Admin\AppData\Local\Temp\Order#6122-001.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
904KB
MD55e5ba61531d74e45b11cadb79e7394a1
SHA1677224e14aac9dd35f367d5eb1704b36e69356b8
SHA25699e91ae250c955bd403ec1a2321d6b11fcb715bdcc7cb3f63ffb46b349afde5c
SHA512712bfe419ba97ecf0ec8323a68743013e8c767da9d986f74ab94d2a395c3086cac2a5823048e0022d3bbcebb55281b9e1f8c87fdc9295c70cc5521b57850bf46
-
memory/688-68-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/688-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/688-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/688-69-0x0000000000830000-0x0000000000B33000-memory.dmpFilesize
3.0MB
-
memory/688-70-0x00000000000B0000-0x00000000000C0000-memory.dmpFilesize
64KB
-
memory/688-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/688-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/688-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/688-64-0x00000000004012B0-mapping.dmp
-
memory/948-55-0x0000000075551000-0x0000000075553000-memory.dmpFilesize
8KB
-
memory/948-56-0x00000000003F0000-0x0000000000408000-memory.dmpFilesize
96KB
-
memory/948-59-0x0000000005060000-0x00000000050D2000-memory.dmpFilesize
456KB
-
memory/948-58-0x00000000080E0000-0x000000000818C000-memory.dmpFilesize
688KB
-
memory/948-57-0x00000000005D0000-0x00000000005DC000-memory.dmpFilesize
48KB
-
memory/948-54-0x0000000000B80000-0x0000000000CA8000-memory.dmpFilesize
1.2MB
-
memory/1212-78-0x0000000004E20000-0x0000000004EB3000-memory.dmpFilesize
588KB
-
memory/1212-71-0x00000000049A0000-0x0000000004A92000-memory.dmpFilesize
968KB
-
memory/1212-80-0x0000000004E20000-0x0000000004EB3000-memory.dmpFilesize
588KB
-
memory/1372-79-0x00000000000D0000-0x00000000000FD000-memory.dmpFilesize
180KB
-
memory/1372-75-0x0000000001E30000-0x0000000002133000-memory.dmpFilesize
3.0MB
-
memory/1372-77-0x0000000002140000-0x00000000021CF000-memory.dmpFilesize
572KB
-
memory/1372-74-0x00000000000D0000-0x00000000000FD000-memory.dmpFilesize
180KB
-
memory/1372-73-0x0000000000070000-0x00000000000B6000-memory.dmpFilesize
280KB
-
memory/1372-72-0x0000000000000000-mapping.dmp