Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
08/04/2024, 14:08
General
- Target DHL_AWB#6078538091.exe
- Size 1.2MB
- Sample240408-rfjvcaec51
- SHA256 ccc2d47913200e1b73cc2195fd00798181dc8ef052aae7ae6b6df00ae45e6ea7
Malware Config
Signatures
- Suspicious use of SetThreadContext 4 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 8 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL_AWB#6078538091.exe"C:\Users\Admin\AppData\Local\Temp\DHL_AWB#6078538091.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\DHL_AWB#6078538091.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\dvdplay.exe"C:\Windows\SysWOW64\dvdplay.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
aut4074.tmp
memory/184-21-0x0000000000400000-0x000000000043F000-memory.dmp
memory/184-22-0x0000000000F70000-0x0000000000F93000-memory.dmp
memory/184-14-0x0000000001600000-0x000000000194A000-memory.dmp
memory/184-15-0x0000000000400000-0x000000000043F000-memory.dmp
memory/184-16-0x0000000000400000-0x000000000043F000-memory.dmp
memory/184-17-0x0000000000400000-0x000000000043F000-memory.dmp
memory/184-18-0x0000000000F70000-0x0000000000F93000-memory.dmp
memory/184-13-0x0000000000400000-0x000000000043F000-memory.dmp
memory/3476-26-0x00000000076B0000-0x000000000776A000-memory.dmp
memory/3476-27-0x00000000076B0000-0x000000000776A000-memory.dmp
memory/3476-36-0x00000000076B0000-0x000000000776A000-memory.dmp
memory/4052-12-0x0000000001720000-0x0000000001724000-memory.dmp
memory/4156-19-0x0000000001090000-0x00000000010CC000-memory.dmp
memory/4156-20-0x0000000001090000-0x00000000010CC000-memory.dmp
memory/4156-23-0x00000000017E0000-0x0000000001B2A000-memory.dmp
memory/4156-24-0x0000000001090000-0x00000000010CC000-memory.dmp
memory/4156-25-0x0000000001670000-0x0000000001712000-memory.dmp
memory/4156-34-0x0000000001090000-0x00000000010CC000-memory.dmp
memory/4156-35-0x0000000001670000-0x0000000001712000-memory.dmp