584f89a151ee7d12e1f1c17384147f5b242c7aa9c5ae082fcdde789732ad980d

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2025, 17:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEW ORDER REQUEST.exe
Size 1.1MB
Sample250129-vlt42stmfv
SHA256 584f89a151ee7d12e1f1c17384147f5b242c7aa9c5ae082fcdde789732ad980d
MD5 bb2b5a64f088cabf501ae94a8c0eacc2
SHA1 81b4eb5edb7a3336f1af474df4a7466a2c7e903f
SHA512 502ba13b330d898ecf8d6461e2c788ba30ff63a4443d6b8806c4e3506c22c640b7071117ab4f3fae10eb7a363168f57764dc3ddd0dad5fff1f5bccf39b965b4e
SSDEEP 24576:3AHnh+eWsN3skA4RV1Hom2KXFmIaYP+YQhXitFR6JYPUDpT0ixx5:qh+ZkldoPK1XaYTQhXG/U+u
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4144 set thread context of 3452	4144	NEW ORDER REQUEST.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NEW ORDER REQUEST.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3452	svchost.exe
3452	svchost.exe
3452	svchost.exe
3452	svchost.exe
3452	svchost.exe
3452	svchost.exe
3452	svchost.exe
3452	svchost.exe
3452	svchost.exe
3452	svchost.exe
3452	svchost.exe
3452	svchost.exe
3452	svchost.exe
3452	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4144	NEW ORDER REQUEST.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4144	NEW ORDER REQUEST.exe
4144	NEW ORDER REQUEST.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4144	NEW ORDER REQUEST.exe
4144	NEW ORDER REQUEST.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 3452	4144	NEW ORDER REQUEST.exe	82
PID 4144 wrote to memory of 3452	4144	NEW ORDER REQUEST.exe	82
PID 4144 wrote to memory of 3452	4144	NEW ORDER REQUEST.exe	82
PID 4144 wrote to memory of 3452	4144	NEW ORDER REQUEST.exe	82

C:\Users\Admin\AppData\Local\Temp\NEW ORDER REQUEST.exe
"C:\Users\Admin\AppData\Local\Temp\NEW ORDER REQUEST.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\NEW ORDER REQUEST.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aut9AAB.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut9AAB.tmp
Size 282KB
SHA256 7d67c50143686e0ae22ca4be49131d5816875869c84015c5269971d01b4623ca
MD5 b4f88089b42d020a42aaf7d9f2a35371
SHA1 9f10ee952667cd6d9be1d13548eaa047047e85da
SHA512 bae2c3ea9cb0ff614cc6d48f250c585c3c1659f77e9e7c5ff88454972b1483ccac6322a80fd00f8333b47a42da312be3977817c8e4fb525d5d27172b56d9d56d
SSDEEP 6144:Lx162WG0jSOLmyhcdBPStYtjxgAm8N+JYSgk:FkNjLJhcHPltlptN+K0
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3452-14-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/3452-15-0x0000000001100000-0x000000000144A000-memory.dmp

Download

memory/3452-16-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/3452-17-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4144-13-0x0000000001120000-0x0000000001520000-memory.dmp

Download