Analysis
- max time kernel
125s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
06/09/2024, 07:03
General
- Target DHL airwaybill # 6913321715 & BL Draft copy.exe
- Size 758KB
- Sample240906-hvcvxasgpc
- SHA256 07374ff867cc60e550cbae355fbb87e46eb76fc7cd74ba4005125d1ac3329e52
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 19 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL airwaybill # 6913321715 & BL Draft copy.exe"C:\Users\Admin\AppData\Local\Temp\DHL airwaybill # 6913321715 & BL Draft copy.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL airwaybill # 6913321715 & BL Draft copy.exe"C:\Users\Admin\AppData\Local\Temp\DHL airwaybill # 6913321715 & BL Draft copy.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4240,i,2727319350781907497,7925939240893079607,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4056-11-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4056-16-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4056-15-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4056-14-0x00000000016D0000-0x0000000001A1A000-memory.dmp
memory/4496-8-0x00000000744A0000-0x0000000074C50000-memory.dmp
memory/4496-5-0x00000000744A0000-0x0000000074C50000-memory.dmp
memory/4496-6-0x0000000005880000-0x0000000005898000-memory.dmp
memory/4496-7-0x00000000744AE000-0x00000000744AF000-memory.dmp
memory/4496-0-0x00000000744AE000-0x00000000744AF000-memory.dmp
memory/4496-9-0x0000000006640000-0x00000000066CE000-memory.dmp
memory/4496-10-0x000000000A290000-0x000000000A32C000-memory.dmp
memory/4496-4-0x00000000053F0000-0x00000000053FA000-memory.dmp
memory/4496-13-0x00000000744A0000-0x0000000074C50000-memory.dmp
memory/4496-3-0x0000000005350000-0x00000000053E2000-memory.dmp
memory/4496-2-0x0000000005900000-0x0000000005EA4000-memory.dmp
memory/4496-1-0x00000000008D0000-0x0000000000994000-memory.dmp