aba591be8db32ef7723900ffb4541610cf3c3f6f4b32c5792566d61815403aa4

Analysis

max time kernel
183s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 13:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DHL_AWB#6078538091.exe
Size 624KB
Sample240214-qcntfsbd4x
SHA256 aba591be8db32ef7723900ffb4541610cf3c3f6f4b32c5792566d61815403aa4
MD5 6935cd887df428f18566b0fbb125bb37
SHA1 95ceb5998aee85440a5bb70922c60bf71080ad3f
SHA512 2979dd229c8b8c36c7f75b60c2afb54fc8a42b19828b675cab21d3f550693fe6b4e5440e4cea49ebd2edbc3e514f0df8896a74af2a13b36c48a4a9ea8285ede8
SSDEEP 12288:DzNBv+SH8ko5kS0YKWJ6DF7HhjBNro1rdluJo73CtTkPhP3glAQNJd7:D3v3RnzZ007B9NroBxjZP3glA+7
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2824 set thread context of 2828	2824	DHL_AWB#6078538091.exe	30
PID 2828 set thread context of 1208	2828	DHL_AWB#6078538091.exe	8
PID 2828 set thread context of 2032	2828	DHL_AWB#6078538091.exe	31
PID 2032 set thread context of 1208	2032	dvdplay.exe	8

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2824	DHL_AWB#6078538091.exe
2824	DHL_AWB#6078538091.exe
2824	DHL_AWB#6078538091.exe
2824	DHL_AWB#6078538091.exe
2824	DHL_AWB#6078538091.exe
2824	DHL_AWB#6078538091.exe
2824	DHL_AWB#6078538091.exe
2824	DHL_AWB#6078538091.exe
2824	DHL_AWB#6078538091.exe
2824	DHL_AWB#6078538091.exe
2824	DHL_AWB#6078538091.exe
2824	DHL_AWB#6078538091.exe
2824	DHL_AWB#6078538091.exe
2828	DHL_AWB#6078538091.exe
2828	DHL_AWB#6078538091.exe
2828	DHL_AWB#6078538091.exe
2828	DHL_AWB#6078538091.exe
2828	DHL_AWB#6078538091.exe
2828	DHL_AWB#6078538091.exe
2828	DHL_AWB#6078538091.exe
2828	DHL_AWB#6078538091.exe
2032	dvdplay.exe
2032	dvdplay.exe
2032	dvdplay.exe
2032	dvdplay.exe
2032	dvdplay.exe
2032	dvdplay.exe
2032	dvdplay.exe
2032	dvdplay.exe
2032	dvdplay.exe
2032	dvdplay.exe
2032	dvdplay.exe
2032	dvdplay.exe
2032	dvdplay.exe
2032	dvdplay.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2828	DHL_AWB#6078538091.exe
1208	Explorer.EXE
1208	Explorer.EXE
2032	dvdplay.exe
2032	dvdplay.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2824	DHL_AWB#6078538091.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 1924	2824	DHL_AWB#6078538091.exe	29
PID 2824 wrote to memory of 1924	2824	DHL_AWB#6078538091.exe	29
PID 2824 wrote to memory of 1924	2824	DHL_AWB#6078538091.exe	29
PID 2824 wrote to memory of 1924	2824	DHL_AWB#6078538091.exe	29
PID 2824 wrote to memory of 2828	2824	DHL_AWB#6078538091.exe	30
PID 2824 wrote to memory of 2828	2824	DHL_AWB#6078538091.exe	30
PID 2824 wrote to memory of 2828	2824	DHL_AWB#6078538091.exe	30
PID 2824 wrote to memory of 2828	2824	DHL_AWB#6078538091.exe	30
PID 2824 wrote to memory of 2828	2824	DHL_AWB#6078538091.exe	30
PID 2824 wrote to memory of 2828	2824	DHL_AWB#6078538091.exe	30
PID 2824 wrote to memory of 2828	2824	DHL_AWB#6078538091.exe	30
PID 1208 wrote to memory of 2032	1208	Explorer.EXE	31
PID 1208 wrote to memory of 2032	1208	Explorer.EXE	31
PID 1208 wrote to memory of 2032	1208	Explorer.EXE	31
PID 1208 wrote to memory of 2032	1208	Explorer.EXE	31

C:\Users\Admin\AppData\Local\Temp\DHL_AWB#6078538091.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_AWB#6078538091.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Users\Admin\AppData\Local\Temp\DHL_AWB#6078538091.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL_AWB#6078538091.exe"
  2⤵
  PID:1924
- C:\Users\Admin\AppData\Local\Temp\DHL_AWB#6078538091.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL_AWB#6078538091.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2828

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\dvdplay.exe
  "C:\Windows\SysWOW64\dvdplay.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1208-18-0x0000000004BC0000-0x0000000004CC0000-memory.dmp

Download

memory/2032-28-0x00000000004A0000-0x0000000000542000-memory.dmp

Download

memory/2032-20-0x00000000000C0000-0x00000000000FC000-memory.dmp

Download

memory/2032-21-0x00000000000C0000-0x00000000000FC000-memory.dmp

Download

memory/2032-24-0x0000000000800000-0x0000000000B03000-memory.dmp

Download

memory/2032-25-0x00000000000C0000-0x00000000000FC000-memory.dmp

Download

memory/2032-26-0x00000000004A0000-0x0000000000542000-memory.dmp

Download

memory/2032-27-0x00000000000C0000-0x00000000000FC000-memory.dmp

Download

memory/2824-4-0x0000000074A90000-0x000000007517E000-memory.dmp

Download

memory/2824-7-0x0000000006010000-0x0000000006098000-memory.dmp

Download

memory/2824-6-0x0000000000430000-0x0000000000442000-memory.dmp

Download

memory/2824-5-0x0000000004CD0000-0x0000000004D10000-memory.dmp

Download

memory/2824-13-0x0000000074A90000-0x000000007517E000-memory.dmp

Download

memory/2824-3-0x0000000000320000-0x0000000000332000-memory.dmp

Download

memory/2824-0-0x0000000000200000-0x00000000002A2000-memory.dmp

Download

memory/2824-2-0x0000000004CD0000-0x0000000004D10000-memory.dmp

Download

memory/2824-1-0x0000000074A90000-0x000000007517E000-memory.dmp

Download

memory/2828-15-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2828-19-0x00000000001B0000-0x00000000001D3000-memory.dmp

Download

memory/2828-17-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2828-16-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2828-22-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2828-23-0x00000000001B0000-0x00000000001D3000-memory.dmp

Download

memory/2828-14-0x0000000000960000-0x0000000000C63000-memory.dmp

Download

memory/2828-12-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2828-9-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2828-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2828-8-0x0000000000400000-0x000000000043F000-memory.dmp

Download