522395519fc98a15a72728c30e9afe1c64d7f8d9c96515c239c8a401c2fc4886

General

Target

Nuevo orden.XLXs_____________________________________________.exe
Size

50.0MB
MD5

77b08ae81c630cc347b54ef8c1f4e804
SHA1

a81aeed17456ed0fcd923a4e99b41e9d42a79cc4
SHA256

a36a5b94a8923ae135a43b21ec38a37924fd59ef902f496f7b499cd4e4083143
SHA512

7acff535d8b8d4ef1255ce25c6e8171739462ca9976d271781e1d97a58f5e354d74348ec2b3829084935f98a2003374108ab2bd639ada296edbddb7b748544d3
SSDEEP

12288:CpvBtyYx4xp7nhIuyRFN9q8/YnoWcl4OSBuYxQpFH5GgNYP:Cp264H7nhIbTmhcl4TBxw5f

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

Nuevo orden.XLXs_____________________________________________.exe

pid	process
2276	Nuevo orden.XLXs_____________________________________________.exe
2276	Nuevo orden.XLXs_____________________________________________.exe
2276	Nuevo orden.XLXs_____________________________________________.exe
2276	Nuevo orden.XLXs_____________________________________________.exe
2276	Nuevo orden.XLXs_____________________________________________.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Nuevo orden.XLXs_____________________________________________.exe

description pid process

Token: SeDebugPrivilege 2276 Nuevo orden.XLXs_____________________________________________.exe

description	pid	process
Token: SeDebugPrivilege	2276	Nuevo orden.XLXs_____________________________________________.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

Nuevo orden.XLXs_____________________________________________.exe

C:\Users\Admin\AppData\Local\Temp\Nuevo orden.XLXs_____________________________________________.exe
"C:\Users\Admin\AppData\Local\Temp\Nuevo orden.XLXs_____________________________________________.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276

C:\Users\Admin\AppData\Local\Temp\Nuevo orden.XLXs_____________________________________________.exe
"C:\Users\Admin\AppData\Local\Temp\Nuevo orden.XLXs_____________________________________________.exe"
2⤵
PID:2692

C:\Users\Admin\AppData\Local\Temp\Nuevo orden.XLXs_____________________________________________.exe
"C:\Users\Admin\AppData\Local\Temp\Nuevo orden.XLXs_____________________________________________.exe"
2⤵
PID:2660

C:\Users\Admin\AppData\Local\Temp\Nuevo orden.XLXs_____________________________________________.exe
"C:\Users\Admin\AppData\Local\Temp\Nuevo orden.XLXs_____________________________________________.exe"
2⤵
PID:2616

C:\Users\Admin\AppData\Local\Temp\Nuevo orden.XLXs_____________________________________________.exe
"C:\Users\Admin\AppData\Local\Temp\Nuevo orden.XLXs_____________________________________________.exe"
2⤵
PID:2584

C:\Users\Admin\AppData\Local\Temp\Nuevo orden.XLXs_____________________________________________.exe
"C:\Users\Admin\AppData\Local\Temp\Nuevo orden.XLXs_____________________________________________.exe"
2⤵
PID:2880

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2276-0-0x0000000000390000-0x0000000000430000-memory.dmp

Filesize
640KB

Download
memory/2276-1-0x0000000073FB0000-0x000000007469E000-memory.dmp

Filesize
6.9MB

Download
memory/2276-2-0x00000000048D0000-0x0000000004910000-memory.dmp

Filesize
256KB

Download
memory/2276-3-0x00000000005E0000-0x00000000005EA000-memory.dmp

Filesize
40KB

Download
memory/2276-4-0x0000000073FB0000-0x000000007469E000-memory.dmp

Filesize
6.9MB

Download
memory/2276-5-0x00000000048D0000-0x0000000004910000-memory.dmp

Filesize
256KB

Download
memory/2276-6-0x0000000004390000-0x00000000043EE000-memory.dmp

Filesize
376KB

Download
memory/2276-7-0x0000000073FB0000-0x000000007469E000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 2276 wrote to memory of 2692	2276	Nuevo orden.XLXs_____________________________________________.exe	Nuevo orden.XLXs_____________________________________________.exe
PID 2276 wrote to memory of 2692	2276	Nuevo orden.XLXs_____________________________________________.exe	Nuevo orden.XLXs_____________________________________________.exe
PID 2276 wrote to memory of 2692	2276	Nuevo orden.XLXs_____________________________________________.exe	Nuevo orden.XLXs_____________________________________________.exe
PID 2276 wrote to memory of 2692	2276	Nuevo orden.XLXs_____________________________________________.exe	Nuevo orden.XLXs_____________________________________________.exe
PID 2276 wrote to memory of 2660	2276	Nuevo orden.XLXs_____________________________________________.exe	Nuevo orden.XLXs_____________________________________________.exe
PID 2276 wrote to memory of 2660	2276	Nuevo orden.XLXs_____________________________________________.exe	Nuevo orden.XLXs_____________________________________________.exe
PID 2276 wrote to memory of 2660	2276	Nuevo orden.XLXs_____________________________________________.exe	Nuevo orden.XLXs_____________________________________________.exe
PID 2276 wrote to memory of 2660	2276	Nuevo orden.XLXs_____________________________________________.exe	Nuevo orden.XLXs_____________________________________________.exe
PID 2276 wrote to memory of 2616	2276	Nuevo orden.XLXs_____________________________________________.exe	Nuevo orden.XLXs_____________________________________________.exe
PID 2276 wrote to memory of 2616	2276	Nuevo orden.XLXs_____________________________________________.exe	Nuevo orden.XLXs_____________________________________________.exe
PID 2276 wrote to memory of 2616	2276	Nuevo orden.XLXs_____________________________________________.exe	Nuevo orden.XLXs_____________________________________________.exe
PID 2276 wrote to memory of 2616	2276	Nuevo orden.XLXs_____________________________________________.exe	Nuevo orden.XLXs_____________________________________________.exe
PID 2276 wrote to memory of 2584	2276	Nuevo orden.XLXs_____________________________________________.exe	Nuevo orden.XLXs_____________________________________________.exe
PID 2276 wrote to memory of 2584	2276	Nuevo orden.XLXs_____________________________________________.exe	Nuevo orden.XLXs_____________________________________________.exe
PID 2276 wrote to memory of 2584	2276	Nuevo orden.XLXs_____________________________________________.exe	Nuevo orden.XLXs_____________________________________________.exe
PID 2276 wrote to memory of 2584	2276	Nuevo orden.XLXs_____________________________________________.exe	Nuevo orden.XLXs_____________________________________________.exe
PID 2276 wrote to memory of 2880	2276	Nuevo orden.XLXs_____________________________________________.exe	Nuevo orden.XLXs_____________________________________________.exe
PID 2276 wrote to memory of 2880	2276	Nuevo orden.XLXs_____________________________________________.exe	Nuevo orden.XLXs_____________________________________________.exe
PID 2276 wrote to memory of 2880	2276	Nuevo orden.XLXs_____________________________________________.exe	Nuevo orden.XLXs_____________________________________________.exe
PID 2276 wrote to memory of 2880	2276	Nuevo orden.XLXs_____________________________________________.exe	Nuevo orden.XLXs_____________________________________________.exe

Analysis

Sharing