4917724a9a203983bc44a1d605d3ef09b074a9ef65adb01b2b28e49822fe7cf1

General

Target

NEW ORDER.exe
Size

679KB
MD5

f060b9400a263bea044a7789ec1d85d9
SHA1

3e939ea522e4356fbdc15c7e0119366a6369e0c9
SHA256

921ace6c0f27813fa370b65bcaee79824a4e31920dbdfec7652103c60e84cd23
SHA512

ceda146640e354440ffbdbe3b8de48e4c1b7b03654687115b1e320f6c38513bfe00cc5ba5afb5858126bc6a257630980d34fd81f26ae992077330ed30d3a39da
SSDEEP

12288:fH7A3U2WtXkF/gAiCTLY10rcTu0Gm6NHeMdwG+q7Ln2oMIzw4CGDw92kR:UE2OSIUTE14cZ6dp3n2opw/

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\BjTxJte = "C:\\Users\\Admin\\AppData\\Roaming\\BjTxJte\\BjTxJte.exe"	NEW ORDER.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2612 set thread context of 2376	2612	NEW ORDER.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2408	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2612	NEW ORDER.exe
2612	NEW ORDER.exe
2376	NEW ORDER.exe
2376	NEW ORDER.exe
2764	powershell.exe
2892	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2612	NEW ORDER.exe
Token: SeDebugPrivilege	2376	NEW ORDER.exe
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeDebugPrivilege	2892	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2376	NEW ORDER.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2764	2612	NEW ORDER.exe	28
PID 2612 wrote to memory of 2764	2612	NEW ORDER.exe	28
PID 2612 wrote to memory of 2764	2612	NEW ORDER.exe	28
PID 2612 wrote to memory of 2764	2612	NEW ORDER.exe	28
PID 2612 wrote to memory of 2892	2612	NEW ORDER.exe	30
PID 2612 wrote to memory of 2892	2612	NEW ORDER.exe	30
PID 2612 wrote to memory of 2892	2612	NEW ORDER.exe	30
PID 2612 wrote to memory of 2892	2612	NEW ORDER.exe	30
PID 2612 wrote to memory of 2408	2612	NEW ORDER.exe	32
PID 2612 wrote to memory of 2408	2612	NEW ORDER.exe	32
PID 2612 wrote to memory of 2408	2612	NEW ORDER.exe	32
PID 2612 wrote to memory of 2408	2612	NEW ORDER.exe	32
PID 2612 wrote to memory of 2376	2612	NEW ORDER.exe	34
PID 2612 wrote to memory of 2376	2612	NEW ORDER.exe	34
PID 2612 wrote to memory of 2376	2612	NEW ORDER.exe	34
PID 2612 wrote to memory of 2376	2612	NEW ORDER.exe	34
PID 2612 wrote to memory of 2376	2612	NEW ORDER.exe	34
PID 2612 wrote to memory of 2376	2612	NEW ORDER.exe	34
PID 2612 wrote to memory of 2376	2612	NEW ORDER.exe	34
PID 2612 wrote to memory of 2376	2612	NEW ORDER.exe	34
PID 2612 wrote to memory of 2376	2612	NEW ORDER.exe	34

C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe
"C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2764
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sFPEKzHsLkYZIz.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2892
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sFPEKzHsLkYZIz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBE50.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2408
- C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe
  "C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

4

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpBE50.tmp

Filesize
1KB

MD5
3a6dab012a36bcfb72087a816874f4f4

SHA1
75bf68a89db9fa895aa0425c3d2ab896da4116fa

SHA256
e1b6d91e02a6f9ae5e084eba3ffcd35dca4a452eb0926b3e4e512861de57c566

SHA512
0bd27e0dd107f2a18083901877fa7f7d51f4b892a2fe532ffffbcecff2d1202738b2c04724c6787f0cd50fbfa730f5de229a18a9bfa236919ea8fcbad04ee863

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\X12J64IDVXY130SD29S3.temp

Filesize
7KB

MD5
dffb010cfd9e2ac73d2e14a411f2d733

SHA1
65fb66e3b9fb017fa717d124875fa2f452e7e58c

SHA256
215f831aedaf0bbcc05c0fa0ada9e884bc5721fdfdc8a3eb7565925bd4aa9b5e

SHA512
1efa80407fca5338f117a4a149acd2ef4839f4c74e56561a0e253568a7dc23daae8726475dc6a319378aeddbad18a2ebd064a3daf8ddb8741d6c694953ccd5b8

Download Submit
memory/2376-33-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2376-47-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2376-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2376-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2376-25-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2376-43-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2376-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2376-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2376-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2376-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2612-7-0x00000000051C0000-0x0000000005244000-memory.dmp

Filesize
528KB

Download
memory/2612-34-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2612-0-0x0000000000B30000-0x0000000000BDC000-memory.dmp

Filesize
688KB

Download
memory/2612-1-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2612-5-0x0000000000700000-0x000000000070E000-memory.dmp

Filesize
56KB

Download
memory/2612-2-0x0000000004BA0000-0x0000000004BE0000-memory.dmp

Filesize
256KB

Download
memory/2612-3-0x0000000004240000-0x00000000042E2000-memory.dmp

Filesize
648KB

Download
memory/2612-4-0x00000000006E0000-0x00000000006F8000-memory.dmp

Filesize
96KB

Download
memory/2612-6-0x0000000000710000-0x0000000000724000-memory.dmp

Filesize
80KB

Download
memory/2764-42-0x00000000023B0000-0x00000000023F0000-memory.dmp

Filesize
256KB

Download
memory/2764-41-0x00000000023B0000-0x00000000023F0000-memory.dmp

Filesize
256KB

Download
memory/2764-40-0x000000006BDA0000-0x000000006C34B000-memory.dmp

Filesize
5.7MB

Download
memory/2764-38-0x00000000023B0000-0x00000000023F0000-memory.dmp

Filesize
256KB

Download
memory/2764-44-0x000000006BDA0000-0x000000006C34B000-memory.dmp

Filesize
5.7MB

Download
memory/2764-35-0x000000006BDA0000-0x000000006C34B000-memory.dmp

Filesize
5.7MB

Download
memory/2892-39-0x000000006BDA0000-0x000000006C34B000-memory.dmp

Filesize
5.7MB

Download
memory/2892-37-0x0000000002260000-0x00000000022A0000-memory.dmp

Filesize
256KB

Download
memory/2892-36-0x000000006BDA0000-0x000000006C34B000-memory.dmp

Filesize
5.7MB

Download
memory/2892-45-0x000000006BDA0000-0x000000006C34B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads