Analysis
- max time kernel
148s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
29/01/2024, 14:05
General
- Target DHL-CI- Shipping Document -DOCX.exe
- Size 728KB
- Sample240129-rdvttsbdg5
- SHA256 cd1757d02e0105ab6ab8876f32671af2911d34f84fd437a68a3c5c6639e11725
Malware Config
Signatures
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 58 IoCs
- Suspicious behavior: MapViewOfSection 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL-CI- Shipping Document -DOCX.exe"C:\Users\Admin\AppData\Local\Temp\DHL-CI- Shipping Document -DOCX.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL-CI- Shipping Document -DOCX.exe"C:\Users\Admin\AppData\Local\Temp\DHL-CI- Shipping Document -DOCX.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DHL-CI- Shipping Document -DOCX.exe"C:\Users\Admin\AppData\Local\Temp\DHL-CI- Shipping Document -DOCX.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DHL-CI- Shipping Document -DOCX.exe"C:\Users\Admin\AppData\Local\Temp\DHL-CI- Shipping Document -DOCX.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2940-13-0x0000000075150000-0x0000000075900000-memory.dmp
memory/2940-1-0x0000000000590000-0x000000000064A000-memory.dmp
memory/2940-2-0x0000000005680000-0x0000000005C24000-memory.dmp
memory/2940-3-0x0000000005000000-0x0000000005092000-memory.dmp
memory/2940-4-0x0000000005210000-0x0000000005220000-memory.dmp
memory/2940-5-0x00000000050B0000-0x00000000050BA000-memory.dmp
memory/2940-6-0x0000000005640000-0x000000000565C000-memory.dmp
memory/2940-7-0x0000000005660000-0x0000000005674000-memory.dmp
memory/2940-8-0x0000000007D70000-0x0000000007DF6000-memory.dmp
memory/2940-9-0x000000000A500000-0x000000000A59C000-memory.dmp
memory/2940-0-0x0000000075150000-0x0000000075900000-memory.dmp
memory/2940-12-0x0000000075150000-0x0000000075900000-memory.dmp
memory/3164-15-0x0000000000400000-0x000000000043F000-memory.dmp
memory/3164-22-0x00000000011A0000-0x00000000011C6000-memory.dmp
memory/3164-10-0x0000000000400000-0x000000000043F000-memory.dmp
memory/3164-16-0x0000000000400000-0x000000000043F000-memory.dmp
memory/3164-18-0x00000000011A0000-0x00000000011C6000-memory.dmp
memory/3164-17-0x0000000000400000-0x000000000043F000-memory.dmp
memory/3164-14-0x00000000011D0000-0x000000000151A000-memory.dmp
memory/3164-21-0x0000000000400000-0x000000000043F000-memory.dmp
memory/3516-28-0x0000000008720000-0x0000000008837000-memory.dmp
memory/3516-29-0x0000000008720000-0x0000000008837000-memory.dmp
memory/3516-30-0x0000000008720000-0x0000000008837000-memory.dmp
memory/4568-20-0x0000000000E00000-0x0000000000E3C000-memory.dmp
memory/4568-19-0x0000000000E00000-0x0000000000E3C000-memory.dmp
memory/4568-23-0x0000000002D90000-0x00000000030DA000-memory.dmp
memory/4568-24-0x0000000000E00000-0x0000000000E3C000-memory.dmp
memory/4568-25-0x0000000002C70000-0x0000000002D15000-memory.dmp
memory/4568-26-0x0000000000E00000-0x0000000000E3C000-memory.dmp
memory/4568-27-0x0000000002C70000-0x0000000002D15000-memory.dmp