ade04d8a75cdd78300fb20b8f7f1877700e800486c18398605e430238e771389

General

Target

New Order.exe
Size

889KB
MD5

9cf6063608f250626f2834856396092c
SHA1

98371d8f9c1002fb0f916c99649bea2ce6cae1b3
SHA256

c9e9c0c331d38ad123557f095bf0eb4ee4e11d00a6b39e923a33e18102f91d4f
SHA512

fc81ee5bcd34dc55ad161ac8dbf4afb1cdd54affab694b4c39f0a2d088ed1e529ba001fa4199278054c5efc349edb404bcd18eb79a1921defc7e4746c9d2b842
SSDEEP

12288:dHsLMTTxTdyFOILC3KrXwX8dZAg6jumsMT:dHQGdVIO3cXwMzAPi3

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4296 set thread context of 796	4296	New Order.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1324	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4296	New Order.exe
4296	New Order.exe
4296	New Order.exe
796	New Order.exe
796	New Order.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4296	New Order.exe
Token: SeDebugPrivilege	796	New Order.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 1324	4296	New Order.exe	89
PID 4296 wrote to memory of 1324	4296	New Order.exe	89
PID 4296 wrote to memory of 1324	4296	New Order.exe	89
PID 4296 wrote to memory of 4496	4296	New Order.exe	91
PID 4296 wrote to memory of 4496	4296	New Order.exe	91
PID 4296 wrote to memory of 4496	4296	New Order.exe	91
PID 4296 wrote to memory of 796	4296	New Order.exe	92
PID 4296 wrote to memory of 796	4296	New Order.exe	92
PID 4296 wrote to memory of 796	4296	New Order.exe	92
PID 4296 wrote to memory of 796	4296	New Order.exe	92
PID 4296 wrote to memory of 796	4296	New Order.exe	92
PID 4296 wrote to memory of 796	4296	New Order.exe	92
PID 4296 wrote to memory of 796	4296	New Order.exe	92
PID 4296 wrote to memory of 796	4296	New Order.exe	92

C:\Users\Admin\AppData\Local\Temp\New Order.exe
"C:\Users\Admin\AppData\Local\Temp\New Order.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cqOiTcuUlePuHp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5CDC.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1324
- C:\Users\Admin\AppData\Local\Temp\New Order.exe
  "{path}"
  2⤵
  PID:4496
- C:\Users\Admin\AppData\Local\Temp\New Order.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\New Order.exe.log

Filesize
1KB

MD5
84e77a587d94307c0ac1357eb4d3d46f

SHA1
83cc900f9401f43d181207d64c5adba7a85edc1e

SHA256
e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99

SHA512
aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5CDC.tmp

Filesize
1KB

MD5
1b96f78171f3440f286a326b6895639e

SHA1
2292b8d5fa60a3f4423f57968fef43c415335841

SHA256
74baa33b426e1eedaf58a1d3d5acb12d713efc453d6ae4c3d938adb21e79b19f

SHA512
40084ba908c0fdd57b85f1047b57f69cba508ff0bc0c97e881395652c707b67e543f2416dcddc34396a1750fca45726d10568c1285650a06c5601e6fe3f1e38d

Download Submit
memory/796-154-0x0000000004F50000-0x0000000004F60000-memory.dmp

Filesize
64KB

Download
memory/796-153-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/796-152-0x0000000005D30000-0x0000000005D80000-memory.dmp

Filesize
320KB

Download
memory/796-151-0x0000000004F60000-0x0000000004FC6000-memory.dmp

Filesize
408KB

Download
memory/796-150-0x0000000004F50000-0x0000000004F60000-memory.dmp

Filesize
64KB

Download
memory/796-149-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/796-145-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4296-141-0x0000000005570000-0x0000000005580000-memory.dmp

Filesize
64KB

Download
memory/4296-134-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/4296-140-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/4296-148-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/4296-139-0x0000000005360000-0x000000000536A000-memory.dmp

Filesize
40KB

Download
memory/4296-138-0x0000000005570000-0x0000000005580000-memory.dmp

Filesize
64KB

Download
memory/4296-137-0x00000000053E0000-0x000000000547C000-memory.dmp

Filesize
624KB

Download
memory/4296-136-0x00000000052A0000-0x0000000005332000-memory.dmp

Filesize
584KB

Download
memory/4296-135-0x0000000005850000-0x0000000005DF4000-memory.dmp

Filesize
5.6MB

Download
memory/4296-133-0x00000000007F0000-0x00000000008D4000-memory.dmp

Filesize
912KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads