7dae38ff17d7ade4bdc83b652121a1b90281e5c915f1d91f04ffae1e64e1e948

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-03-2024 04:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEW ORDER -RA2000000056.exe
Size

740KB
MD5

8c858aa84563521e1f1b36a4837eac48
SHA1

c6116fa6f72fd6abfbfcd2e3cbde61f1a8fedda8
SHA256

bd97d642866f3aaa69be60fe0ca7f96bc495e5d060a4c0827a9929b02df7b449
SHA512

f24dab450b2aad62eb5b6bbfd9b10f6d4178daf2fcb3eb32f766adac8a94c903e36995f08e49cd6537607081b40a5a932272abfa4990a325b850986cc1b6f18d
SSDEEP

12288:9d1JsJ6SPn1Sh2iNwKiQuvjvxGzuCMFqJi7vwlnvCpXJYKAFkIQXjx8hbHu2Z51S:9dcw1GzQScpMgJiU1a3AFkj9au2h

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

NEW ORDER -RA2000000056.exe

pid	process
1944	NEW ORDER -RA2000000056.exe
1944	NEW ORDER -RA2000000056.exe
1944	NEW ORDER -RA2000000056.exe
1944	NEW ORDER -RA2000000056.exe
1944	NEW ORDER -RA2000000056.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

NEW ORDER -RA2000000056.exe

description pid process

Token: SeDebugPrivilege 1944 NEW ORDER -RA2000000056.exe

description	pid	process
Token: SeDebugPrivilege	1944	NEW ORDER -RA2000000056.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

NEW ORDER -RA2000000056.exe

description	pid	process	target process
PID 1944 wrote to memory of 2560	1944	NEW ORDER -RA2000000056.exe	NEW ORDER -RA2000000056.exe
PID 1944 wrote to memory of 2560	1944	NEW ORDER -RA2000000056.exe	NEW ORDER -RA2000000056.exe
PID 1944 wrote to memory of 2560	1944	NEW ORDER -RA2000000056.exe	NEW ORDER -RA2000000056.exe
PID 1944 wrote to memory of 2560	1944	NEW ORDER -RA2000000056.exe	NEW ORDER -RA2000000056.exe
PID 1944 wrote to memory of 2548	1944	NEW ORDER -RA2000000056.exe	NEW ORDER -RA2000000056.exe
PID 1944 wrote to memory of 2548	1944	NEW ORDER -RA2000000056.exe	NEW ORDER -RA2000000056.exe
PID 1944 wrote to memory of 2548	1944	NEW ORDER -RA2000000056.exe	NEW ORDER -RA2000000056.exe
PID 1944 wrote to memory of 2548	1944	NEW ORDER -RA2000000056.exe	NEW ORDER -RA2000000056.exe
PID 1944 wrote to memory of 2568	1944	NEW ORDER -RA2000000056.exe	NEW ORDER -RA2000000056.exe
PID 1944 wrote to memory of 2568	1944	NEW ORDER -RA2000000056.exe	NEW ORDER -RA2000000056.exe
PID 1944 wrote to memory of 2568	1944	NEW ORDER -RA2000000056.exe	NEW ORDER -RA2000000056.exe
PID 1944 wrote to memory of 2568	1944	NEW ORDER -RA2000000056.exe	NEW ORDER -RA2000000056.exe
PID 1944 wrote to memory of 2648	1944	NEW ORDER -RA2000000056.exe	NEW ORDER -RA2000000056.exe
PID 1944 wrote to memory of 2648	1944	NEW ORDER -RA2000000056.exe	NEW ORDER -RA2000000056.exe
PID 1944 wrote to memory of 2648	1944	NEW ORDER -RA2000000056.exe	NEW ORDER -RA2000000056.exe
PID 1944 wrote to memory of 2648	1944	NEW ORDER -RA2000000056.exe	NEW ORDER -RA2000000056.exe
PID 1944 wrote to memory of 2652	1944	NEW ORDER -RA2000000056.exe	NEW ORDER -RA2000000056.exe
PID 1944 wrote to memory of 2652	1944	NEW ORDER -RA2000000056.exe	NEW ORDER -RA2000000056.exe
PID 1944 wrote to memory of 2652	1944	NEW ORDER -RA2000000056.exe	NEW ORDER -RA2000000056.exe
PID 1944 wrote to memory of 2652	1944	NEW ORDER -RA2000000056.exe	NEW ORDER -RA2000000056.exe

C:\Users\Admin\AppData\Local\Temp\NEW ORDER -RA2000000056.exe
"C:\Users\Admin\AppData\Local\Temp\NEW ORDER -RA2000000056.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944

C:\Users\Admin\AppData\Local\Temp\NEW ORDER -RA2000000056.exe
"C:\Users\Admin\AppData\Local\Temp\NEW ORDER -RA2000000056.exe"
2⤵
PID:2560

C:\Users\Admin\AppData\Local\Temp\NEW ORDER -RA2000000056.exe
"C:\Users\Admin\AppData\Local\Temp\NEW ORDER -RA2000000056.exe"
2⤵
PID:2548

C:\Users\Admin\AppData\Local\Temp\NEW ORDER -RA2000000056.exe
"C:\Users\Admin\AppData\Local\Temp\NEW ORDER -RA2000000056.exe"
2⤵
PID:2568

C:\Users\Admin\AppData\Local\Temp\NEW ORDER -RA2000000056.exe
"C:\Users\Admin\AppData\Local\Temp\NEW ORDER -RA2000000056.exe"
2⤵
PID:2648

C:\Users\Admin\AppData\Local\Temp\NEW ORDER -RA2000000056.exe
"C:\Users\Admin\AppData\Local\Temp\NEW ORDER -RA2000000056.exe"
2⤵
PID:2652

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-0-0x0000000000370000-0x000000000042C000-memory.dmp

Filesize
752KB

Download
memory/1944-1-0x0000000074200000-0x00000000748EE000-memory.dmp

Filesize
6.9MB

Download
memory/1944-2-0x0000000004B60000-0x0000000004BA0000-memory.dmp

Filesize
256KB

Download
memory/1944-3-0x0000000000270000-0x0000000000282000-memory.dmp

Filesize
72KB

Download
memory/1944-4-0x0000000000290000-0x000000000029C000-memory.dmp

Filesize
48KB

Download
memory/1944-5-0x00000000051E0000-0x0000000005262000-memory.dmp

Filesize
520KB

Download
memory/1944-6-0x0000000074200000-0x00000000748EE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads