e42065b2d3de06cb244055718fe5fe7536fb74c40282d596814d88406ef709c1

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2024 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New Order #86-55113,pdf.exe
Size

390KB
MD5

acbee350b83dd21753787b9b1588e0e0
SHA1

7f3c2ddc8ee02369273d0e4cce57ee8608d761a5
SHA256

b01e1958972ec443b2761f85f6aec66acfb99d239d4b402d5a345272c72738e7
SHA512

b7e6cd8e79306af8fdc2bf759be58525ec82ec1fa96b6dca66a6c563ba56ca6a28199b3cbc643abb63d4cfd2416633d4ffb4eb7ea924fe42bd366a90a1ce631a
SSDEEP

6144:A8LxB60+uhQMjtesLf0s7BFy/eP5Qky1NtbS/R9asZa2YL9dpl:t+uhQMjtebozOXHSDasZar1l

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4004	New Order #86-55113,pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Order #86-55113,pdf.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 1692	4004	New Order #86-55113,pdf.exe	83
PID 4004 wrote to memory of 1692	4004	New Order #86-55113,pdf.exe	83
PID 4004 wrote to memory of 1692	4004	New Order #86-55113,pdf.exe	83

C:\Users\Admin\AppData\Local\Temp\New Order #86-55113,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\New Order #86-55113,pdf.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Users\Admin\AppData\Local\Temp\New Order #86-55113,pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\New Order #86-55113,pdf.exe"
  2⤵
  PID:1692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsaB93F.tmp\ydejjbwlzb.dll

Filesize
11KB

MD5
4aaa0bb30fa44bab0f47a1e9716885ae

SHA1
1417c687522222a7229c38fd7a9ce3aab3fb56f4

SHA256
83f56b8aacf3b7c6f319457eff4dffdff68256abb3e6d1f0e50263800deea83b

SHA512
711679b85b2d3fa4648ed50ab8feed372a1fbca278f12fb1f42d7d2c9cc1e3a6d7106e6d81aaa040cf277775290cc0ef8f540f2e8ec5d1b6d0898651cbf7d9b8

Download Submit
memory/4004-8-0x00000000745D3000-0x00000000745D5000-memory.dmp

Filesize
8KB

Download