Analysis
- max time kernel
148s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20250129-en - resource tags
- submitted
05/02/2025, 16:50
General
- Target DHL eInvoice_1105872175.bat.exe
- Size 1.2MB
- Sample250205-vcchmsxkhl
- SHA256 8262eff81e1dfcbfc3faf587466a7690b55ec6ea5f2f89711a971b22eaa9bf43
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Drops startup file 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL eInvoice_1105872175.bat.exe"C:\Users\Admin\AppData\Local\Temp\DHL eInvoice_1105872175.bat.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 123⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4760 -ip 47601⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1436-0-0x0000000074B2E000-0x0000000074B2F000-memory.dmp
memory/1436-1-0x0000000000910000-0x0000000000A4C000-memory.dmp
memory/1436-2-0x00000000053C0000-0x00000000054FC000-memory.dmp
memory/1436-4-0x0000000005610000-0x00000000056A2000-memory.dmp
memory/1436-3-0x0000000005AC0000-0x0000000006064000-memory.dmp
memory/1436-8-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-42-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-14-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-66-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-69-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-64-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-62-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-60-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-58-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-56-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-54-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-52-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-50-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-48-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-46-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-44-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-40-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-38-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-36-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-34-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-32-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-30-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-28-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-26-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-24-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-22-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-20-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-18-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-17-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-10-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-12-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-6-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-5-0x00000000053C0000-0x00000000054F5000-memory.dmp
memory/1436-1327-0x0000000074B20000-0x00000000752D0000-memory.dmp
memory/1436-1329-0x0000000074B20000-0x00000000752D0000-memory.dmp
memory/1436-1330-0x00000000058D0000-0x0000000005962000-memory.dmp
memory/1436-1331-0x0000000005960000-0x00000000059AC000-memory.dmp
memory/1436-1328-0x0000000005810000-0x00000000058A6000-memory.dmp
memory/1436-1332-0x0000000005A20000-0x0000000005A74000-memory.dmp
memory/1436-1343-0x0000000074B20000-0x00000000752D0000-memory.dmp
memory/1436-1342-0x0000000074B20000-0x00000000752D0000-memory.dmp
memory/1436-1340-0x0000000074B20000-0x00000000752D0000-memory.dmp
memory/1436-1338-0x0000000074B20000-0x00000000752D0000-memory.dmp