Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
27/03/2024, 05:15
General
- Target CARGO0XR3SW-0XR4FE-DOCX.exe
- Size 675KB
- Sample240327-fxkbnadd84
- SHA256 2222a80b782ef6c2fc2c6a78e63f812b21c7767a81f3afc7f2eb81aee9f433fb
Malware Config
Signatures
- Suspicious use of SetThreadContext 4 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\CARGO0XR3SW-0XR4FE-DOCX.exe"C:\Users\Admin\AppData\Local\Temp\CARGO0XR3SW-0XR4FE-DOCX.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CARGO0XR3SW-0XR4FE-DOCX.exe"C:\Users\Admin\AppData\Local\Temp\CARGO0XR3SW-0XR4FE-DOCX.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"4⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/768-12-0x0000000074FE0000-0x0000000075790000-memory.dmp
memory/768-1-0x0000000074FE0000-0x0000000075790000-memory.dmp
memory/768-2-0x00000000051A0000-0x0000000005744000-memory.dmp
memory/768-3-0x0000000004C90000-0x0000000004D22000-memory.dmp
memory/768-5-0x0000000004C10000-0x0000000004C1A000-memory.dmp
memory/768-4-0x0000000004F20000-0x0000000004F30000-memory.dmp
memory/768-6-0x0000000004F30000-0x0000000004FCC000-memory.dmp
memory/768-7-0x0000000004C80000-0x0000000004C92000-memory.dmp
memory/768-8-0x0000000004E80000-0x0000000004E8C000-memory.dmp
memory/768-9-0x0000000006300000-0x0000000006386000-memory.dmp
memory/768-0-0x0000000000180000-0x000000000022E000-memory.dmp
memory/2632-22-0x0000000002ED0000-0x000000000321A000-memory.dmp
memory/2632-23-0x0000000000D20000-0x0000000000D5C000-memory.dmp
memory/2632-25-0x0000000000D20000-0x0000000000D5C000-memory.dmp
memory/2632-19-0x0000000000D20000-0x0000000000D5C000-memory.dmp
memory/2632-20-0x0000000000D20000-0x0000000000D5C000-memory.dmp
memory/2632-24-0x0000000002DE0000-0x0000000002E85000-memory.dmp
memory/3380-28-0x00000000026F0000-0x00000000027A6000-memory.dmp
memory/3380-27-0x00000000026F0000-0x00000000027A6000-memory.dmp
memory/3380-26-0x00000000026F0000-0x00000000027A6000-memory.dmp
memory/3380-18-0x000000000DF00000-0x0000000010426000-memory.dmp
memory/3404-17-0x0000000001460000-0x0000000001486000-memory.dmp
memory/3404-10-0x0000000000400000-0x000000000043F000-memory.dmp
memory/3404-21-0x0000000000400000-0x000000000043F000-memory.dmp
memory/3404-13-0x00000000015E0000-0x000000000192A000-memory.dmp
memory/3404-16-0x0000000000400000-0x000000000043F000-memory.dmp
memory/3404-15-0x0000000000400000-0x000000000043F000-memory.dmp
memory/3404-14-0x0000000000400000-0x000000000043F000-memory.dmp