Overview
overview
7Static
static
7OrderMonit...te.exe
windows7-x64
7OrderMonit...te.exe
windows10-2004-x64
7OrderMonit...me.exe
windows7-x64
1OrderMonit...me.exe
windows10-2004-x64
1OrderMonit...on.exe
windows7-x64
7OrderMonit...on.exe
windows10-2004-x64
7OrderMonit...68.pdf
windows7-x64
1OrderMonit...68.pdf
windows10-2004-x64
1Behavioral task
behavioral1
Sample
OrderMonitor_20220818/OrderMonitor/AutoUpdate.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
OrderMonitor_20220818/OrderMonitor/AutoUpdate.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
OrderMonitor_20220818/OrderMonitor/GetTdxCodeName.exe
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
OrderMonitor_20220818/OrderMonitor/GetTdxCodeName.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
OrderMonitor_20220818/OrderMonitor/OrderMon.exe
Resource
win7-20230824-en
Behavioral task
behavioral6
Sample
OrderMonitor_20220818/OrderMonitor/OrderMon.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
OrderMonitor_20220818/OrderMonitor/źżOrderMon_v1.68.pdf
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
OrderMonitor_20220818/OrderMonitor/źżOrderMon_v1.68.pdf
Resource
win10v2004-20230703-en
General
-
Target
9a4892d2ccca5140df3413b8c0ada0ab16dc02f997eeeef87d96d5084e8dc09e
-
Size
3.2MB
-
MD5
e4fd1ed87c0db88cdc4ae2702bac7f2d
-
SHA1
5895d6dbc5b9543f9381678b8a11181eb4e4fc05
-
SHA256
9a4892d2ccca5140df3413b8c0ada0ab16dc02f997eeeef87d96d5084e8dc09e
-
SHA512
6cf981954553510714bbdeb6b3399407513306a06f909050416f3a96360be1e0387e3ebdeaaa3de21322c53f54beaedc20d6347d310b2386f31795ed0cbb665d
-
SSDEEP
98304:RAkYTYAEJKaoMQ+4CtJpjkV/plGNgE3fHq7Kf:2kYfFT2pA/y/AKf
Malware Config
Signatures
-
resource yara_rule static1/unpack001/OrderMonitor_20220818/OrderMonitor/AutoUpdate.exe upx static1/unpack001/OrderMonitor_20220818/OrderMonitor/OrderMon.exe upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe -
Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/OrderMonitor_20220818/OrderMonitor/AutoUpdate.exe unpack002/out.upx unpack001/OrderMonitor_20220818/OrderMonitor/GetTdxCodeName.exe unpack001/OrderMonitor_20220818/OrderMonitor/OrderMon.exe
Files
-
9a4892d2ccca5140df3413b8c0ada0ab16dc02f997eeeef87d96d5084e8dc09e.zip
-
OrderMonitor_20220818/OrderMonitor/AutoUpdate.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 440KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 261KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 508KB - Virtual size: 508KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 26KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
OrderMonitor_20220818/OrderMonitor/CustomCodeNameTable.txt
-
OrderMonitor_20220818/OrderMonitor/DemoSignal.tn6
-
OrderMonitor_20220818/OrderMonitor/GetTdxCodeName.exe.exe windows x86
b4d1e7491d1c826e3549e2f513e343e2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Beep
WideCharToMultiByte
MultiByteToWideChar
RtlUnwind
RaiseException
IsBadWritePtr
IsBadReadPtr
HeapValidate
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
LCMapStringA
LCMapStringW
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
GetProcAddress
LoadLibraryA
InterlockedIncrement
GetModuleFileNameA
GetCPInfo
CompareStringA
CompareStringW
GetLastError
CloseHandle
SetFilePointer
FlushFileBuffers
HeapFree
SetUnhandledExceptionFilter
HeapAlloc
HeapReAlloc
VirtualFree
VirtualAlloc
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeA
GetStringTypeW
SetConsoleCtrlHandler
GetTimeZoneInformation
SetStdHandle
CreateFileA
IsBadCodePtr
ReadFile
GetACP
GetOEMCP
SetEndOfFile
GetLocaleInfoW
SetEnvironmentVariableA
GetFileAttributesA
Sections
.text Size: 476KB - Virtual size: 473KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
OrderMonitor_20220818/OrderMonitor/OrderMon.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 452KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 261KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
OrderMonitor_20220818/OrderMonitor/OrderMon.ini
-
OrderMonitor_20220818/OrderMonitor/StockCodeNameTable.txt
-
OrderMonitor_20220818/OrderMonitor/TdxSignal.ini
-
OrderMonitor_20220818/OrderMonitor/źżOrderMon_v1.68.pdf.pdf
-
OrderMonitor_20220818/OrderMonitor/ʾ.wav