Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 13:46
Static task
static1
Behavioral task
behavioral1
Sample
NEW ORDER LIST .xls.exe
Resource
win7-20230220-en
General
-
Target
NEW ORDER LIST .xls.exe
-
Size
668KB
-
MD5
7033ae8b4afbadb27abbd7b3b5bdb085
-
SHA1
5e15fd3f589d52c0b2c6e0e20e66c6b299646a59
-
SHA256
e92efa61a4ae7376c52f323abae88f5303a217b58966e4a71042fbebd0cba60a
-
SHA512
988da34cfd2cb7c8118d8dbf057bb65c1c895f24872443dca4b985c17dbbcae6efb974d7c76cb6db233cba393ee6e1eea35f0f056a54e6c1bfbf64832edbab97
-
SSDEEP
12288:6BX65Pf63JHFbaDoiJqLyl173SMn0XuEaWvvcCmyL/pheNQq8:6M563Lvyl17iM0Naqc4L7eNe
Malware Config
Extracted
nanocore
1.2.2.0
moonandbebe.ddns.net:6324
127.0.0.1:6324
9df60050-0f19-40b4-870c-3f0f73f35b3b
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
37.235.1.177
-
buffer_size
65535
-
build_time
2023-01-18T15:29:22.483592836Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
6324
-
default_group
moonandbebe
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
9df60050-0f19-40b4-870c-3f0f73f35b3b
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
moonandbebe.ddns.net
-
primary_dns_server
37.235.1.174
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
NEW ORDER LIST .xls.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation NEW ORDER LIST .xls.exe -
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 37.235.1.174 Destination IP 37.235.1.174 Destination IP 37.235.1.177 Destination IP 37.235.1.174 Destination IP 37.235.1.177 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEW ORDER LIST .xls.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SAAS Monitor = "C:\\Program Files (x86)\\SAAS Monitor\\saasmon.exe" NEW ORDER LIST .xls.exe -
Processes:
NEW ORDER LIST .xls.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA NEW ORDER LIST .xls.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
NEW ORDER LIST .xls.exedescription pid process target process PID 4752 set thread context of 1476 4752 NEW ORDER LIST .xls.exe NEW ORDER LIST .xls.exe -
Drops file in Program Files directory 2 IoCs
Processes:
NEW ORDER LIST .xls.exedescription ioc process File created C:\Program Files (x86)\SAAS Monitor\saasmon.exe NEW ORDER LIST .xls.exe File opened for modification C:\Program Files (x86)\SAAS Monitor\saasmon.exe NEW ORDER LIST .xls.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
NEW ORDER LIST .xls.exepowershell.exeNEW ORDER LIST .xls.exepid process 4752 NEW ORDER LIST .xls.exe 4752 NEW ORDER LIST .xls.exe 4752 NEW ORDER LIST .xls.exe 4752 NEW ORDER LIST .xls.exe 4752 NEW ORDER LIST .xls.exe 4752 NEW ORDER LIST .xls.exe 4752 NEW ORDER LIST .xls.exe 800 powershell.exe 800 powershell.exe 1476 NEW ORDER LIST .xls.exe 1476 NEW ORDER LIST .xls.exe 1476 NEW ORDER LIST .xls.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
NEW ORDER LIST .xls.exepid process 1476 NEW ORDER LIST .xls.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
NEW ORDER LIST .xls.exepowershell.exeNEW ORDER LIST .xls.exedescription pid process Token: SeDebugPrivilege 4752 NEW ORDER LIST .xls.exe Token: SeDebugPrivilege 800 powershell.exe Token: SeDebugPrivilege 1476 NEW ORDER LIST .xls.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
NEW ORDER LIST .xls.exedescription pid process target process PID 4752 wrote to memory of 800 4752 NEW ORDER LIST .xls.exe powershell.exe PID 4752 wrote to memory of 800 4752 NEW ORDER LIST .xls.exe powershell.exe PID 4752 wrote to memory of 800 4752 NEW ORDER LIST .xls.exe powershell.exe PID 4752 wrote to memory of 4176 4752 NEW ORDER LIST .xls.exe schtasks.exe PID 4752 wrote to memory of 4176 4752 NEW ORDER LIST .xls.exe schtasks.exe PID 4752 wrote to memory of 4176 4752 NEW ORDER LIST .xls.exe schtasks.exe PID 4752 wrote to memory of 1476 4752 NEW ORDER LIST .xls.exe NEW ORDER LIST .xls.exe PID 4752 wrote to memory of 1476 4752 NEW ORDER LIST .xls.exe NEW ORDER LIST .xls.exe PID 4752 wrote to memory of 1476 4752 NEW ORDER LIST .xls.exe NEW ORDER LIST .xls.exe PID 4752 wrote to memory of 1476 4752 NEW ORDER LIST .xls.exe NEW ORDER LIST .xls.exe PID 4752 wrote to memory of 1476 4752 NEW ORDER LIST .xls.exe NEW ORDER LIST .xls.exe PID 4752 wrote to memory of 1476 4752 NEW ORDER LIST .xls.exe NEW ORDER LIST .xls.exe PID 4752 wrote to memory of 1476 4752 NEW ORDER LIST .xls.exe NEW ORDER LIST .xls.exe PID 4752 wrote to memory of 1476 4752 NEW ORDER LIST .xls.exe NEW ORDER LIST .xls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER LIST .xls.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER LIST .xls.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XhqvcLIDz.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XhqvcLIDz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA681.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER LIST .xls.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER LIST .xls.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NEW ORDER LIST .xls.exe.logFilesize
1KB
MD533d62ef2c354f839a8b2b987e6ee41e7
SHA1d76f64ac411a61f3f232f7f9f7b179bd34042226
SHA256f6a84062cb11ccf802324692c2c4c48543377cf717d98efd5de695ed6d0a97d9
SHA512d68a426b2f4646bb45e2267d60680166a8effb9a461e5a07756ba13a3bdf36b27e6e9777d945d03a62362e6976e92214c53ffc7c4f03ec28d3fcfc9a442c5e3c
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2i2uwpgf.qzp.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmpA681.tmpFilesize
1KB
MD5c5ae15d8d72e143b1aae0a4409776e7c
SHA12f6aa2cdffc3c00bd8bb447ab7af757b0110bb3c
SHA2569b8e82345245c68d0db4e73f6d423e9f3bbd30066c7e189564c0ff10cbaca6ef
SHA5121fef2556e685c25c7336e6e9ee64182dec70f550a28d3b4225cbe4f5e3955043088b36d237f2edbccd2eda6c1ff175a064d0f67ef0fcf7e53b2d56348ebd9cc4
-
memory/800-151-0x00000000057E0000-0x0000000005846000-memory.dmpFilesize
408KB
-
memory/800-168-0x00000000078D0000-0x0000000007902000-memory.dmpFilesize
200KB
-
memory/800-188-0x0000000007D40000-0x0000000007D48000-memory.dmpFilesize
32KB
-
memory/800-187-0x0000000007D60000-0x0000000007D7A000-memory.dmpFilesize
104KB
-
memory/800-144-0x0000000002E20000-0x0000000002E56000-memory.dmpFilesize
216KB
-
memory/800-186-0x0000000007C50000-0x0000000007C5E000-memory.dmpFilesize
56KB
-
memory/800-146-0x0000000005930000-0x0000000005F58000-memory.dmpFilesize
6.2MB
-
memory/800-180-0x0000000002EA0000-0x0000000002EB0000-memory.dmpFilesize
64KB
-
memory/800-179-0x0000000006CC0000-0x0000000006CDE000-memory.dmpFilesize
120KB
-
memory/800-159-0x0000000002EA0000-0x0000000002EB0000-memory.dmpFilesize
64KB
-
memory/800-161-0x0000000002EA0000-0x0000000002EB0000-memory.dmpFilesize
64KB
-
memory/800-152-0x00000000060D0000-0x0000000006136000-memory.dmpFilesize
408KB
-
memory/800-184-0x0000000007A90000-0x0000000007A9A000-memory.dmpFilesize
40KB
-
memory/800-183-0x0000000007A20000-0x0000000007A3A000-memory.dmpFilesize
104KB
-
memory/800-182-0x0000000008070000-0x00000000086EA000-memory.dmpFilesize
6.5MB
-
memory/800-181-0x000000007EF90000-0x000000007EFA0000-memory.dmpFilesize
64KB
-
memory/800-167-0x0000000006720000-0x000000000673E000-memory.dmpFilesize
120KB
-
memory/800-150-0x0000000005740000-0x0000000005762000-memory.dmpFilesize
136KB
-
memory/800-169-0x0000000070E00000-0x0000000070E4C000-memory.dmpFilesize
304KB
-
memory/800-185-0x0000000007CA0000-0x0000000007D36000-memory.dmpFilesize
600KB
-
memory/1476-147-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1476-191-0x0000000005970000-0x0000000005980000-memory.dmpFilesize
64KB
-
memory/1476-158-0x0000000005970000-0x0000000005980000-memory.dmpFilesize
64KB
-
memory/4752-136-0x00000000057D0000-0x00000000057DA000-memory.dmpFilesize
40KB
-
memory/4752-137-0x0000000005A10000-0x0000000005A20000-memory.dmpFilesize
64KB
-
memory/4752-135-0x0000000005800000-0x0000000005892000-memory.dmpFilesize
584KB
-
memory/4752-133-0x0000000000D90000-0x0000000000E3E000-memory.dmpFilesize
696KB
-
memory/4752-139-0x0000000007680000-0x000000000771C000-memory.dmpFilesize
624KB
-
memory/4752-138-0x0000000005A10000-0x0000000005A20000-memory.dmpFilesize
64KB
-
memory/4752-134-0x0000000005D10000-0x00000000062B4000-memory.dmpFilesize
5.6MB