Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
16-10-2024 06:26
Static task
static1
Behavioral task
behavioral1
Sample
New Order 240906-08SN-SLE.exe
Resource
win7-20240708-en
General
-
Target
New Order 240906-08SN-SLE.exe
-
Size
605KB
-
MD5
02f965a386a4d013fd3797e60b7bfb74
-
SHA1
2232f1b561c50a1c33ff1f282e198e3de978001f
-
SHA256
fc117f10fec938fc5983ad960142b3dafdc946dee592d13a37c6f21aee2618fc
-
SHA512
6e10046bd2c9c830b5534032e9b2205c313c8e5fd7939e039586286c97d63b1fd36565942d5811c0831a598e8e37738abc648db4b203bd85642fb70cd38408d2
-
SSDEEP
12288:wkRybL6s+wv7eIxTJk6KysPepbTI2iNqcQdAY+oIlf9loFiWKsQ:zRU6s+wyIpqbPexTI2vTV+df9WrK
Malware Config
Extracted
formbook
4.1
ms84
ecurity-ukgaxq.xyz
45ee.top
risiddivinayaka.net
tizip-skill.xyz
ostcanadantet.top
764.xyz
oco188rtp.xyz
lobalacessory.shop
qcq-serve.xyz
dameth.top
arge-eycert.xyz
yzwj-she.xyz
bgfrp-plant.xyz
emesiartwork.net
rcw-hotel.xyz
loor-dfqzpi.xyz
vidence-zvkkln.xyz
oisthuchoyarura.shop
959108ttltxfm842.top
apzcc-both.xyz
duxrib.xyz
ridging-solutions-llc.net
ower-gxkwaa.xyz
elicorebiopharma.net
hlut-government.xyz
outh-kejj.xyz
dslot88b.click
xfetchbesnowsblacher.shop
all888.xyz
erform-tgap.xyz
ixiaopu.top
eiqiqikj.top
antuljiwa.click
vqq-national.xyz
rilseguloseheating.shop
uney.xyz
ord-km241124sdaqrwqsssafqw.xyz
uiejosdarksumdauts.shop
aby-qwjqlg.xyz
xcoy-product.xyz
ressure-pkdpy.xyz
5syp.xyz
lue-kuukf.xyz
ccording-pqzu.xyz
elieve-nrrv.xyz
ltimatraceglow.pro
dgnmu-over.xyz
ittlepawprints.app
agieworld.xyz
vvfu-break.xyz
taff-ltpugj.xyz
kn510v1.top
oolhervelegerus.shop
mployee-jkmmz.xyz
4750.africa
weetlive.lat
achebrand.shop
uistnanciesnefast.cfd
isten-fwogs.xyz
cmk-billion.xyz
981gnk.top
ge-zgnfu.xyz
unwaleheathyhibbing.cfd
ikigorakos.net
uhy-key.xyz
Signatures
-
Formbook payload 4 IoCs
resource yara_rule behavioral1/memory/2820-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2820-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2820-20-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2996-26-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
pid Process 2544 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2668 set thread context of 2820 2668 New Order 240906-08SN-SLE.exe 31 PID 2820 set thread context of 1232 2820 New Order 240906-08SN-SLE.exe 21 PID 2820 set thread context of 1232 2820 New Order 240906-08SN-SLE.exe 21 PID 2996 set thread context of 1232 2996 chkdsk.exe 21 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language New Order 240906-08SN-SLE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chkdsk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 2820 New Order 240906-08SN-SLE.exe 2820 New Order 240906-08SN-SLE.exe 2820 New Order 240906-08SN-SLE.exe 2996 chkdsk.exe 2996 chkdsk.exe 2996 chkdsk.exe 2996 chkdsk.exe 2996 chkdsk.exe 2996 chkdsk.exe 2996 chkdsk.exe 2996 chkdsk.exe 2996 chkdsk.exe 2996 chkdsk.exe 2996 chkdsk.exe 2996 chkdsk.exe 2996 chkdsk.exe 2996 chkdsk.exe 2996 chkdsk.exe 2996 chkdsk.exe 2996 chkdsk.exe 2996 chkdsk.exe 2996 chkdsk.exe 2996 chkdsk.exe 2996 chkdsk.exe 2996 chkdsk.exe 2996 chkdsk.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2820 New Order 240906-08SN-SLE.exe 2820 New Order 240906-08SN-SLE.exe 2820 New Order 240906-08SN-SLE.exe 2820 New Order 240906-08SN-SLE.exe 2996 chkdsk.exe 2996 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2820 New Order 240906-08SN-SLE.exe Token: SeDebugPrivilege 2996 chkdsk.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2668 wrote to memory of 2820 2668 New Order 240906-08SN-SLE.exe 31 PID 2668 wrote to memory of 2820 2668 New Order 240906-08SN-SLE.exe 31 PID 2668 wrote to memory of 2820 2668 New Order 240906-08SN-SLE.exe 31 PID 2668 wrote to memory of 2820 2668 New Order 240906-08SN-SLE.exe 31 PID 2668 wrote to memory of 2820 2668 New Order 240906-08SN-SLE.exe 31 PID 2668 wrote to memory of 2820 2668 New Order 240906-08SN-SLE.exe 31 PID 2668 wrote to memory of 2820 2668 New Order 240906-08SN-SLE.exe 31 PID 1232 wrote to memory of 2996 1232 Explorer.EXE 32 PID 1232 wrote to memory of 2996 1232 Explorer.EXE 32 PID 1232 wrote to memory of 2996 1232 Explorer.EXE 32 PID 1232 wrote to memory of 2996 1232 Explorer.EXE 32 PID 2996 wrote to memory of 2544 2996 chkdsk.exe 33 PID 2996 wrote to memory of 2544 2996 chkdsk.exe 33 PID 2996 wrote to memory of 2544 2996 chkdsk.exe 33 PID 2996 wrote to memory of 2544 2996 chkdsk.exe 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\New Order 240906-08SN-SLE.exe"C:\Users\Admin\AppData\Local\Temp\New Order 240906-08SN-SLE.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\New Order 240906-08SN-SLE.exe"C:\Users\Admin\AppData\Local\Temp\New Order 240906-08SN-SLE.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2820
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\New Order 240906-08SN-SLE.exe"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2544
-
-