Analysis
- max time kernel
139s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
15/10/2024, 14:12
General
- Target TNT Original Documents AWB 8013580.bat.exe
- Size 655KB
- Sample241015-rhvpmaydne
- SHA256 40472fbefd08c24147afbf941b4504ee7a4658409e0077ec98c1e7dfb4c507fa
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TNT Original Documents AWB 8013580.bat.exe"C:\Users\Admin\AppData\Local\Temp\TNT Original Documents AWB 8013580.bat.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TNT Original Documents AWB 8013580.bat.exe"C:\Users\Admin\AppData\Local\Temp\TNT Original Documents AWB 8013580.bat.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/764-8-0x0000000074C5E000-0x0000000074C5F000-memory.dmp
memory/764-9-0x0000000074C50000-0x0000000075400000-memory.dmp
memory/764-2-0x00000000057A0000-0x0000000005D44000-memory.dmp
memory/764-3-0x0000000005290000-0x0000000005322000-memory.dmp
memory/764-4-0x0000000074C50000-0x0000000075400000-memory.dmp
memory/764-5-0x0000000005340000-0x000000000534A000-memory.dmp
memory/764-1-0x00000000007F0000-0x000000000089A000-memory.dmp
memory/764-6-0x0000000005510000-0x00000000055AC000-memory.dmp
memory/764-0-0x0000000074C5E000-0x0000000074C5F000-memory.dmp
memory/764-7-0x00000000054F0000-0x0000000005502000-memory.dmp
memory/764-10-0x0000000006A50000-0x0000000006ADE000-memory.dmp
memory/764-13-0x0000000074C50000-0x0000000075400000-memory.dmp
memory/3716-11-0x0000000000400000-0x0000000000446000-memory.dmp
memory/3716-14-0x0000000000400000-0x0000000000446000-memory.dmp
memory/3716-15-0x0000000001630000-0x000000000197A000-memory.dmp
memory/3716-16-0x0000000000400000-0x0000000000446000-memory.dmp