Analysis

  • max time kernel
    125s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-06-2024 17:14

General

  • Target

    NEW ORDER.exe

  • Size

    1.2MB

  • MD5

    8cd947a7a778cc3ddfcf24afe58e3472

  • SHA1

    a6f8d0b06fac90b33a9c4af8c4a32eec0b0fb713

  • SHA256

    81eb8aa9b2226312d76e1bf196178ffd3bf4fa20f02de820451d4f654179655c

  • SHA512

    59e1bc3225cd23e74b08a685ba8c7671182875fc52683a36d6b76b7a033ab3c484d0a5c83d5244b2874635696366cebc2560e13fe61ff4dc99c48d333e46205b

  • SSDEEP

    24576:9AHnh+eWsN3skA4RV1Hom2KXMmHabkY7tSO9jl9pgJa8q+In5:ch+ZkldoPK8YabktO9jka84

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe
    "C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1044
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"
      2⤵
        PID:4116
      • C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe
        "C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4948
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3792
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 744
          3⤵
          • Program crash
          PID:5036
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4948 -ip 4948
      1⤵
        PID:4500
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4176,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:8
        1⤵
          PID:5144

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\Graff

          Filesize

          28KB

          MD5

          6a3dfef400ee0b4d9aa9b37d210c15fb

          SHA1

          39e3f081a8ffc5e419e0561f99cf473c858dae3a

          SHA256

          01fe853871c2a572efbc0e4ca8376a9479cc1d7f431517549b3cbb1485102a6d

          SHA512

          c62dc1e831ed5e3ad9302fd423d068ea13e343dd45eb390dbb94a6bf24f31f501f7bf0ca53fb220043d61745ce07b881f05d8384cbbbc836dda23eb923578fbb

        • C:\Users\Admin\AppData\Local\Temp\autE484.tmp

          Filesize

          263KB

          MD5

          05a4846c30eb2e60c5967487b4b26924

          SHA1

          d4512e8c470c99bc17a4d2016175f712e723000e

          SHA256

          0c5911981123e3ae935b93612ffbe858c59ded97430337dd6ccfc9c790f44e1a

          SHA512

          db1cc559093ce3ba6b1ce2439b4b6c5145b8c2d29788ddff2015809573790fe32a25cc68fb33366e7dec98b3ec354055e41144563c46c6f534da10a79f038536

        • memory/1044-12-0x0000000003C20000-0x0000000003C24000-memory.dmp

          Filesize

          16KB

        • memory/3792-27-0x0000000000400000-0x0000000000446000-memory.dmp

          Filesize

          280KB

        • memory/3792-29-0x0000000000400000-0x0000000000446000-memory.dmp

          Filesize

          280KB

        • memory/3792-28-0x0000000000400000-0x0000000000446000-memory.dmp

          Filesize

          280KB

        • memory/3792-30-0x0000000000400000-0x0000000000446000-memory.dmp

          Filesize

          280KB

        • memory/3792-31-0x00000000736AE000-0x00000000736AF000-memory.dmp

          Filesize

          4KB

        • memory/3792-32-0x0000000002B90000-0x0000000002BE6000-memory.dmp

          Filesize

          344KB

        • memory/3792-35-0x0000000002D10000-0x0000000002D64000-memory.dmp

          Filesize

          336KB

        • memory/3792-34-0x00000000057A0000-0x0000000005D44000-memory.dmp

          Filesize

          5.6MB

        • memory/3792-33-0x00000000736A0000-0x0000000073E50000-memory.dmp

          Filesize

          7.7MB

        • memory/3792-64-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-95-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-93-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-198-0x00000000736A0000-0x0000000073E50000-memory.dmp

          Filesize

          7.7MB

        • memory/3792-91-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-89-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-83-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-81-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-79-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-77-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-75-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-73-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-71-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-67-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-65-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-61-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-58-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-55-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-54-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-51-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-49-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-47-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-45-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-43-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-41-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-39-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-37-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-36-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-87-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-85-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-69-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-59-0x0000000002D10000-0x0000000002D5E000-memory.dmp

          Filesize

          312KB

        • memory/3792-1081-0x00000000736A0000-0x0000000073E50000-memory.dmp

          Filesize

          7.7MB

        • memory/3792-1082-0x0000000005360000-0x00000000053C6000-memory.dmp

          Filesize

          408KB

        • memory/3792-1083-0x0000000006850000-0x00000000068A0000-memory.dmp

          Filesize

          320KB

        • memory/3792-1084-0x0000000006940000-0x00000000069D2000-memory.dmp

          Filesize

          584KB

        • memory/3792-1085-0x00000000068D0000-0x00000000068DA000-memory.dmp

          Filesize

          40KB

        • memory/3792-1086-0x0000000000400000-0x0000000000446000-memory.dmp

          Filesize

          280KB

        • memory/3792-1087-0x00000000736AE000-0x00000000736AF000-memory.dmp

          Filesize

          4KB

        • memory/3792-1088-0x00000000736A0000-0x0000000073E50000-memory.dmp

          Filesize

          7.7MB