Analysis
-
max time kernel
149s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24-09-2024 19:28
Static task
static1
Behavioral task
behavioral1
Sample
NEWORDER.exe
Resource
win7-20240903-en
General
-
Target
NEWORDER.exe
-
Size
590KB
-
MD5
5c45a9c7ed0522b874a6b277a970fcdd
-
SHA1
01a55397aacac6bbd33c4e0a415c99b04bbd4b7a
-
SHA256
4a29c020657514662d82cf92cf660922d45184e961473f08326817611afbbb94
-
SHA512
e0279dfec3ffdaaeeabc2c9ee1a09932b726f5dfb3a239470308715a9b6091f0fc4e7bfd76694aa34f589e0d796f21f8b131bdf1db2bf79dd8682078d49bfe01
-
SSDEEP
12288:4S+iIkirVw9iEoElSoERcSltDrabRu6XDyjPu1ulxk/ReneD8bQb:4h2ihlEoGSDlVrV8WaulCwe0I
Malware Config
Extracted
formbook
4.1
g29o
edplanethomes.homes
aimin.club
amacheerguide.online
bcddpza.bond
ediamarketplace.online
ynasty.wine
hengsui.top
ousy.fashion
en-mud.xyz
etcall.tech
harity-50528.bond
iski.world
ikelai6.pro
areemeh.info
eitert-suhre-lengerich.audi
959725vkjdngl559.top
73qp28bu.autos
lassiin.shop
audementalplus.online
3win9.cyou
elestialvespera.buzz
layman.app
appymonster.world
leaning-products-frame.sbs
nlygod.club
us-inbox-messages.online
nline-teaching-12677.bond
ell-being.fun
lquileres-de-viviendas.online
xxzaanm.top
hixiaobao.cloud
amazeu3.pro
roncrow.biz
eremiah-xaaab.buzz
obrut99.art
epression-test-28682.bond
ental-implants-usa1.today
olar-systems-panels-78668.bond
onyrobbinslifecoach.net
hespine.shop
autam.xyz
douvlag.xyz
lectrician-services-46095.bond
un.cyou
3win15.top
find-maps.info
entalcare-us3-borysfb.today
dnstdrynr03.cyou
mms1imzmzlwjhnwzm.online
48601724.top
uchu.shop
x-design-courses-pg-1-vv-br.xyz
alamfestival.online
remation-services-78911.bond
acob-saaae.buzz
athstarprodigy.homes
arter-saaae.buzz
lley24.top
eluartoto4.top
yber-insurance-21675.bond
24ns.shop
65online.social
ollarlengkap.online
yzq0n.top
inorss.shop
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/3788-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3788-19-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3272-68-0x0000000000F60000-0x0000000000F8F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1784 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation NEWORDER.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1684 set thread context of 3788 1684 NEWORDER.exe 89 PID 3788 set thread context of 3548 3788 NEWORDER.exe 56 PID 3272 set thread context of 3548 3272 raserver.exe 56 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEWORDER.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language raserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1684 NEWORDER.exe 1684 NEWORDER.exe 1684 NEWORDER.exe 1684 NEWORDER.exe 3788 NEWORDER.exe 3788 NEWORDER.exe 3788 NEWORDER.exe 3788 NEWORDER.exe 1784 powershell.exe 1784 powershell.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe 3272 raserver.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3788 NEWORDER.exe 3788 NEWORDER.exe 3788 NEWORDER.exe 3272 raserver.exe 3272 raserver.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1684 NEWORDER.exe Token: SeDebugPrivilege 3788 NEWORDER.exe Token: SeDebugPrivilege 1784 powershell.exe Token: SeShutdownPrivilege 3548 Explorer.EXE Token: SeCreatePagefilePrivilege 3548 Explorer.EXE Token: SeDebugPrivilege 3272 raserver.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1684 wrote to memory of 1784 1684 NEWORDER.exe 86 PID 1684 wrote to memory of 1784 1684 NEWORDER.exe 86 PID 1684 wrote to memory of 1784 1684 NEWORDER.exe 86 PID 1684 wrote to memory of 4216 1684 NEWORDER.exe 88 PID 1684 wrote to memory of 4216 1684 NEWORDER.exe 88 PID 1684 wrote to memory of 4216 1684 NEWORDER.exe 88 PID 1684 wrote to memory of 3788 1684 NEWORDER.exe 89 PID 1684 wrote to memory of 3788 1684 NEWORDER.exe 89 PID 1684 wrote to memory of 3788 1684 NEWORDER.exe 89 PID 1684 wrote to memory of 3788 1684 NEWORDER.exe 89 PID 1684 wrote to memory of 3788 1684 NEWORDER.exe 89 PID 1684 wrote to memory of 3788 1684 NEWORDER.exe 89 PID 3548 wrote to memory of 3272 3548 Explorer.EXE 90 PID 3548 wrote to memory of 3272 3548 Explorer.EXE 90 PID 3548 wrote to memory of 3272 3548 Explorer.EXE 90 PID 3272 wrote to memory of 3340 3272 raserver.exe 92 PID 3272 wrote to memory of 3340 3272 raserver.exe 92 PID 3272 wrote to memory of 3340 3272 raserver.exe 92
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\NEWORDER.exe"C:\Users\Admin\AppData\Local\Temp\NEWORDER.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\NEWORDER.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
-
C:\Users\Admin\AppData\Local\Temp\NEWORDER.exe"C:\Users\Admin\AppData\Local\Temp\NEWORDER.exe"3⤵PID:4216
-
-
C:\Users\Admin\AppData\Local\Temp\NEWORDER.exe"C:\Users\Admin\AppData\Local\Temp\NEWORDER.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3788
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\NEWORDER.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3340
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82