Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2023 09:26
Static task
static1
Behavioral task
behavioral1
Sample
New Order.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
New Order.exe
Resource
win10v2004-20231127-en
General
-
Target
New Order.exe
-
Size
640KB
-
MD5
bca932f9df0a984231fd9855747b4dfb
-
SHA1
fa0b4ce1a7e659e397566da2325229a5203953fd
-
SHA256
9cadda8241bb7393ed10e4e3e58b0cafddb31b01334afe38ebb3f94e73190c2c
-
SHA512
7b989799f329b5c779792cdd6197b8a64c379b1d6c79afc68d70666026b68ede9e91f374dde0c7e33c418072f5bb4035268768ad5c1b50e4c6157a7c4d6f68c5
-
SSDEEP
12288:3uPm4WVKFOVclXp0pd/EUC/fzbxha6MOnvVYQazzq4Cp158SA:im1VKX50X/EUa7apYdEzVSYS
Malware Config
Extracted
Protocol: smtp- Host:
zqamcx.com - Port:
587 - Username:
[email protected] - Password:
Anambraeast@2023
Extracted
agenttesla
Protocol: smtp- Host:
zqamcx.com - Port:
587 - Username:
[email protected] - Password:
Anambraeast@2023 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
New Order.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000\Control Panel\International\Geo\Nation New Order.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
New Order.exedescription pid process target process PID 3208 set thread context of 1496 3208 New Order.exe New Order.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
New Order.exepowershell.exepowershell.exeNew Order.exepid process 3208 New Order.exe 3208 New Order.exe 3208 New Order.exe 3208 New Order.exe 3208 New Order.exe 3208 New Order.exe 3208 New Order.exe 3208 New Order.exe 3208 New Order.exe 3208 New Order.exe 3208 New Order.exe 1520 powershell.exe 5024 powershell.exe 3208 New Order.exe 3208 New Order.exe 3208 New Order.exe 1496 New Order.exe 1496 New Order.exe 1520 powershell.exe 5024 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
New Order.exepowershell.exepowershell.exeNew Order.exedescription pid process Token: SeDebugPrivilege 3208 New Order.exe Token: SeDebugPrivilege 1520 powershell.exe Token: SeDebugPrivilege 5024 powershell.exe Token: SeDebugPrivilege 1496 New Order.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
New Order.exepid process 1496 New Order.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
New Order.exedescription pid process target process PID 3208 wrote to memory of 1520 3208 New Order.exe powershell.exe PID 3208 wrote to memory of 1520 3208 New Order.exe powershell.exe PID 3208 wrote to memory of 1520 3208 New Order.exe powershell.exe PID 3208 wrote to memory of 5024 3208 New Order.exe powershell.exe PID 3208 wrote to memory of 5024 3208 New Order.exe powershell.exe PID 3208 wrote to memory of 5024 3208 New Order.exe powershell.exe PID 3208 wrote to memory of 904 3208 New Order.exe schtasks.exe PID 3208 wrote to memory of 904 3208 New Order.exe schtasks.exe PID 3208 wrote to memory of 904 3208 New Order.exe schtasks.exe PID 3208 wrote to memory of 4920 3208 New Order.exe New Order.exe PID 3208 wrote to memory of 4920 3208 New Order.exe New Order.exe PID 3208 wrote to memory of 4920 3208 New Order.exe New Order.exe PID 3208 wrote to memory of 1496 3208 New Order.exe New Order.exe PID 3208 wrote to memory of 1496 3208 New Order.exe New Order.exe PID 3208 wrote to memory of 1496 3208 New Order.exe New Order.exe PID 3208 wrote to memory of 1496 3208 New Order.exe New Order.exe PID 3208 wrote to memory of 1496 3208 New Order.exe New Order.exe PID 3208 wrote to memory of 1496 3208 New Order.exe New Order.exe PID 3208 wrote to memory of 1496 3208 New Order.exe New Order.exe PID 3208 wrote to memory of 1496 3208 New Order.exe New Order.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Order.exe"C:\Users\Admin\AppData\Local\Temp\New Order.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\New Order.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1520 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jXjQOf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5024 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jXjQOf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp13E1.tmp"2⤵
- Creates scheduled task(s)
PID:904 -
C:\Users\Admin\AppData\Local\Temp\New Order.exe"C:\Users\Admin\AppData\Local\Temp\New Order.exe"2⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\New Order.exe"C:\Users\Admin\AppData\Local\Temp\New Order.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1496
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
Filesize
18KB
MD56c6d6045516dcb7ab6b2d8785d09b0af
SHA1b06f23e89bc9cd567599a49f1646c612990a0929
SHA2566389a5b18ead4bbf223f87c248ff443c69f0447330a1ea8e2b148bb9d5e6ee96
SHA512a7b8c62818368628a6ea3b9a7c3122326379ebaed013ef2ffcda8c65fa7ff68af4d54e3119e15a5bc5ed1a0b81230fbdd983e36a9b50485990fdc8aca7c630d0
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD571a57a992ea8e28e6c616eeb5906ce34
SHA19a451ba68095a1daa36288e50e52018b856395f9
SHA25646265aad9de4c690d4fcb147f4625d980f63db99b519a4a922fd1949c86accab
SHA512abbcc54fffa3662e21ccf418963065312a696e2d54e2fffb1a8447726809b2b71777bed0c7ee088c3254f5ae626d5af4e245b3ef4f6ccd10f047941b3ab5f1ba