Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
17-06-2024 13:25
Static task
static1
Behavioral task
behavioral1
Sample
New Order.exe
Resource
win10v2004-20240508-en
General
-
Target
New Order.exe
-
Size
815KB
-
MD5
8282de81f994c057525b0c1213e2ff43
-
SHA1
1ee376ff06d56b5d51f349e29bcc173ccfc9a4a1
-
SHA256
e85c7115b0b9003f5b856a28c7d18262eec92e87c8c639a43ae4233962da5d24
-
SHA512
60edf7ce44afc42e72aedad3c778af7fc742c38d4119aceef690c3b8ce7d562a1db8820c6a2b57c664c849388f3a281b7566900b71dac98c261227659b665f6f
-
SSDEEP
12288:h5wSaeorXQpJE1oDOghGMxVFGgxRavD7R5GhYG2ucIcL:hj5EXq9D1hGjeGHGVK
Malware Config
Extracted
formbook
4.1
na10
tetheus.com
ventlikeyoumeanit.com
tintbliss.com
rinabet357.com
sapphireboutiqueusa.com
abc8bet6.com
xzcn3i7jb13cqei.buzz
pinktravelsnagpur.com
bt365038.com
rtpbossujang303.shop
osthirmaker.com
thelonelyteacup.com
rlc2019.com
couverture-charpente.com
productivagc.com
defendercarcare.com
abcentixdigital.com
petco.ltd
oypivh.top
micro.guru
hokivegasslots.club
5663876.com
symboleffekt.info
tworiverlabsintake.com
pegaso.store
sasoera.com
material.chat
taniamckirdy.com
dansistosproductions.com
moromorojp.com
z27e1thx976ez3u.buzz
skinrenue.com
nbvci.xyz
jakobniinja.xyz
snykee.com
sl24.top
wawturkiye.xyz
virtualeventsbyelaine.com
giorgiaclerico.com
d9psk8.xyz
hard-to-miss.space
awclog.com
topcomparativos.com
somoyboutique.com
findlove.pro
zbo170.app
dexcoenergy.com
nona23.lat
ingelset.com
hexatelier.com
nftees.tech
visionarymaterialsinstitute.com
khanyos.com
bz59.top
migraine-treatment-28778.bond
catboxbot.online
kkugames.com
llmsearchoptimization.com
fipbhvvb.xyz
vmytzptc.xyz
intermediafx.shop
lhrrs.com
grimreapervalley.com
discount-fess.space
liamcollinai.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/700-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/700-19-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4488-24-0x0000000000580000-0x00000000005AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
New Order.exeNew Order.exewscript.exedescription pid process target process PID 4500 set thread context of 700 4500 New Order.exe New Order.exe PID 700 set thread context of 3312 700 New Order.exe Explorer.EXE PID 4488 set thread context of 3312 4488 wscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
New Order.exeNew Order.exewscript.exepid process 4500 New Order.exe 4500 New Order.exe 700 New Order.exe 700 New Order.exe 700 New Order.exe 700 New Order.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe 4488 wscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
New Order.exewscript.exepid process 700 New Order.exe 700 New Order.exe 700 New Order.exe 4488 wscript.exe 4488 wscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
New Order.exeNew Order.exewscript.exedescription pid process Token: SeDebugPrivilege 4500 New Order.exe Token: SeDebugPrivilege 700 New Order.exe Token: SeDebugPrivilege 4488 wscript.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3312 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
New Order.exeExplorer.EXEwscript.exedescription pid process target process PID 4500 wrote to memory of 700 4500 New Order.exe New Order.exe PID 4500 wrote to memory of 700 4500 New Order.exe New Order.exe PID 4500 wrote to memory of 700 4500 New Order.exe New Order.exe PID 4500 wrote to memory of 700 4500 New Order.exe New Order.exe PID 4500 wrote to memory of 700 4500 New Order.exe New Order.exe PID 4500 wrote to memory of 700 4500 New Order.exe New Order.exe PID 3312 wrote to memory of 4488 3312 Explorer.EXE wscript.exe PID 3312 wrote to memory of 4488 3312 Explorer.EXE wscript.exe PID 3312 wrote to memory of 4488 3312 Explorer.EXE wscript.exe PID 4488 wrote to memory of 2168 4488 wscript.exe cmd.exe PID 4488 wrote to memory of 2168 4488 wscript.exe cmd.exe PID 4488 wrote to memory of 2168 4488 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\New Order.exe"C:\Users\Admin\AppData\Local\Temp\New Order.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\New Order.exe"C:\Users\Admin\AppData\Local\Temp\New Order.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\New Order.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/700-14-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/700-19-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/700-20-0x0000000001960000-0x0000000001974000-memory.dmpFilesize
80KB
-
memory/700-17-0x00000000015E0000-0x0000000001936000-memory.dmpFilesize
3.3MB
-
memory/3312-33-0x0000000006380000-0x0000000006498000-memory.dmpFilesize
1.1MB
-
memory/3312-30-0x0000000006380000-0x0000000006498000-memory.dmpFilesize
1.1MB
-
memory/3312-29-0x0000000006380000-0x0000000006498000-memory.dmpFilesize
1.1MB
-
memory/3312-26-0x0000000006110000-0x0000000006275000-memory.dmpFilesize
1.4MB
-
memory/3312-21-0x0000000006110000-0x0000000006275000-memory.dmpFilesize
1.4MB
-
memory/4488-24-0x0000000000580000-0x00000000005AF000-memory.dmpFilesize
188KB
-
memory/4488-23-0x00000000000A0000-0x00000000000C5000-memory.dmpFilesize
148KB
-
memory/4488-22-0x00000000000A0000-0x00000000000C5000-memory.dmpFilesize
148KB
-
memory/4500-6-0x0000000005180000-0x0000000005212000-memory.dmpFilesize
584KB
-
memory/4500-8-0x0000000074CC0000-0x0000000075471000-memory.dmpFilesize
7.7MB
-
memory/4500-12-0x0000000074CC0000-0x0000000075471000-memory.dmpFilesize
7.7MB
-
memory/4500-16-0x0000000074CC0000-0x0000000075471000-memory.dmpFilesize
7.7MB
-
memory/4500-11-0x0000000074CCE000-0x0000000074CCF000-memory.dmpFilesize
4KB
-
memory/4500-10-0x0000000006840000-0x0000000006846000-memory.dmpFilesize
24KB
-
memory/4500-9-0x0000000005D90000-0x0000000005DAA000-memory.dmpFilesize
104KB
-
memory/4500-13-0x0000000074CC0000-0x0000000075471000-memory.dmpFilesize
7.7MB
-
memory/4500-7-0x0000000005160000-0x000000000516A000-memory.dmpFilesize
40KB
-
memory/4500-0-0x0000000074CCE000-0x0000000074CCF000-memory.dmpFilesize
4KB
-
memory/4500-5-0x0000000005650000-0x0000000005BF6000-memory.dmpFilesize
5.6MB
-
memory/4500-4-0x0000000074CC0000-0x0000000075471000-memory.dmpFilesize
7.7MB
-
memory/4500-3-0x0000000005030000-0x0000000005074000-memory.dmpFilesize
272KB
-
memory/4500-2-0x0000000004F90000-0x000000000502C000-memory.dmpFilesize
624KB
-
memory/4500-1-0x0000000000440000-0x0000000000512000-memory.dmpFilesize
840KB