Analysis
- max time kernel
143s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
31/07/2023, 06:54
General
- Target New Order 6911420410.exe
- Size 333KB
- Sample230731-hn7rpsea2x
- SHA256 eb8e351b8fdaadf5429c19d052428ab81b91170406b937d0f3753e334a757fe3
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Order 6911420410.exe"C:\Users\Admin\AppData\Local\Temp\New Order 6911420410.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\New Order 6911420410.exe"C:\Users\Admin\AppData\Local\Temp\New Order 6911420410.exe"2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
poord.dll
memory/1984-144-0x0000000073C00000-0x00000000743B0000-memory.dmp
memory/1984-140-0x0000000000400000-0x0000000000453000-memory.dmp
memory/1984-141-0x0000000000400000-0x0000000000453000-memory.dmp
memory/1984-142-0x0000000000400000-0x0000000000453000-memory.dmp
memory/1984-143-0x0000000000400000-0x0000000000453000-memory.dmp
memory/1984-154-0x0000000002660000-0x0000000002670000-memory.dmp
memory/1984-145-0x0000000002660000-0x0000000002670000-memory.dmp
memory/1984-146-0x0000000002660000-0x0000000002670000-memory.dmp
memory/1984-147-0x00000000049F0000-0x0000000004F94000-memory.dmp
memory/1984-148-0x0000000002590000-0x00000000025F6000-memory.dmp
memory/1984-149-0x0000000005BF0000-0x0000000005C40000-memory.dmp
memory/1984-150-0x0000000005C40000-0x0000000005CD2000-memory.dmp
memory/1984-151-0x0000000005D20000-0x0000000005D2A000-memory.dmp
memory/1984-152-0x0000000073C00000-0x00000000743B0000-memory.dmp
memory/3960-194-0x000001F0DC940000-0x000001F0DC941000-memory.dmp
memory/3960-202-0x000001F0DC940000-0x000001F0DC941000-memory.dmp
memory/3960-193-0x000001F0DC920000-0x000001F0DC921000-memory.dmp
memory/3960-229-0x000001F0DC7C0000-0x000001F0DC7C1000-memory.dmp
memory/3960-195-0x000001F0DC940000-0x000001F0DC941000-memory.dmp
memory/3960-196-0x000001F0DC940000-0x000001F0DC941000-memory.dmp
memory/3960-197-0x000001F0DC940000-0x000001F0DC941000-memory.dmp
memory/3960-198-0x000001F0DC940000-0x000001F0DC941000-memory.dmp
memory/3960-199-0x000001F0DC940000-0x000001F0DC941000-memory.dmp
memory/3960-200-0x000001F0DC940000-0x000001F0DC941000-memory.dmp
memory/3960-201-0x000001F0DC940000-0x000001F0DC941000-memory.dmp
memory/3960-177-0x000001F0D4340000-0x000001F0D4350000-memory.dmp
memory/3960-203-0x000001F0DC940000-0x000001F0DC941000-memory.dmp
memory/3960-205-0x000001F0DC560000-0x000001F0DC561000-memory.dmp
memory/3960-204-0x000001F0DC570000-0x000001F0DC571000-memory.dmp
memory/3960-207-0x000001F0DC570000-0x000001F0DC571000-memory.dmp
memory/3960-210-0x000001F0DC560000-0x000001F0DC561000-memory.dmp
memory/3960-213-0x000001F0DC4A0000-0x000001F0DC4A1000-memory.dmp
memory/3960-225-0x000001F0DC6A0000-0x000001F0DC6A1000-memory.dmp
memory/3960-227-0x000001F0DC6B0000-0x000001F0DC6B1000-memory.dmp
memory/3960-228-0x000001F0DC6B0000-0x000001F0DC6B1000-memory.dmp
memory/4892-139-0x00000000023E0000-0x00000000023E2000-memory.dmp