Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
14/02/2024, 13:48
General
- Target rDHL_AWB6078538091.exe
- Size 637KB
- Sample240214-q34mlacb8x
- SHA256 b1f1237f3bf5667bf62719cf9fd741263e1cf7a61ff92741dc6dcb801cd35378
Malware Config
Signatures
- Suspicious use of SetThreadContext 4 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 62 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rDHL_AWB6078538091.exe"C:\Users\Admin\AppData\Local\Temp\rDHL_AWB6078538091.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rDHL_AWB6078538091.exe"C:\Users\Admin\AppData\Local\Temp\rDHL_AWB6078538091.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\dvdplay.exe"C:\Windows\SysWOW64\dvdplay.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1396-22-0x0000000000400000-0x000000000043F000-memory.dmp
memory/1396-10-0x0000000000400000-0x000000000043F000-memory.dmp
memory/1396-17-0x0000000000400000-0x000000000043F000-memory.dmp
memory/1396-16-0x0000000000400000-0x000000000043F000-memory.dmp
memory/1396-19-0x0000000001990000-0x00000000019B3000-memory.dmp
memory/1396-18-0x0000000000400000-0x000000000043F000-memory.dmp
memory/1396-23-0x0000000001990000-0x00000000019B3000-memory.dmp
memory/1396-15-0x00000000019E0000-0x0000000001D2A000-memory.dmp
memory/1396-13-0x0000000000400000-0x000000000043F000-memory.dmp
memory/3416-21-0x0000000000EA0000-0x0000000000EDC000-memory.dmp
memory/3416-20-0x0000000000EA0000-0x0000000000EDC000-memory.dmp
memory/3416-27-0x0000000000EA0000-0x0000000000EDC000-memory.dmp
memory/3416-26-0x00000000018C0000-0x0000000001962000-memory.dmp
memory/3416-25-0x0000000000EA0000-0x0000000000EDC000-memory.dmp
memory/3416-24-0x0000000001570000-0x00000000018BA000-memory.dmp
memory/3460-36-0x00000000024B0000-0x000000000259F000-memory.dmp
memory/3460-29-0x00000000024B0000-0x000000000259F000-memory.dmp
memory/3460-28-0x00000000024B0000-0x000000000259F000-memory.dmp
memory/5680-7-0x0000000004E10000-0x0000000004E22000-memory.dmp
memory/5680-4-0x0000000004D80000-0x0000000004D90000-memory.dmp
memory/5680-3-0x0000000004BC0000-0x0000000004C52000-memory.dmp
memory/5680-1-0x0000000075180000-0x0000000075930000-memory.dmp
memory/5680-2-0x00000000050D0000-0x0000000005674000-memory.dmp
memory/5680-5-0x0000000004B80000-0x0000000004B8A000-memory.dmp
memory/5680-6-0x0000000004E30000-0x0000000004ECC000-memory.dmp
memory/5680-9-0x0000000006630000-0x00000000066B8000-memory.dmp
memory/5680-0-0x0000000000110000-0x00000000001B6000-memory.dmp
memory/5680-8-0x0000000006260000-0x0000000006272000-memory.dmp
memory/5680-14-0x0000000075180000-0x0000000075930000-memory.dmp
memory/5680-12-0x0000000075180000-0x0000000075930000-memory.dmp