Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows7_x64 -
resource
win7 -
submitted
07-07-2020 05:06
Static task
static1
Behavioral task
behavioral1
Sample
Dhl shipment documents.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Dhl shipment documents.exe
Resource
win10
0 signatures
0 seconds
General
-
Target
Dhl shipment documents.exe
-
Size
816KB
-
MD5
c36de042c317262fbeb25e0901e2441e
-
SHA1
c4f38f77ef79cd4b44e1f6344f492281946fd707
-
SHA256
353be7f64ffa25bf3d8ea90b55b9b288633883f00f328841007f82324a37a4d7
-
SHA512
b73e515912165b9a7838e4bde1ed590c7f65221243f56cc5bc9e735fc625c44b87758b04e6a1a1505ff44b42b10012c8855b04c6f3483180cf19a35e25f9b1ee
Score
5/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Dhl shipment documents.exeDhl shipment documents.exedescription pid process target process PID 1768 wrote to memory of 1860 1768 Dhl shipment documents.exe schtasks.exe PID 1768 wrote to memory of 1860 1768 Dhl shipment documents.exe schtasks.exe PID 1768 wrote to memory of 1860 1768 Dhl shipment documents.exe schtasks.exe PID 1768 wrote to memory of 1860 1768 Dhl shipment documents.exe schtasks.exe PID 1768 wrote to memory of 1904 1768 Dhl shipment documents.exe Dhl shipment documents.exe PID 1768 wrote to memory of 1904 1768 Dhl shipment documents.exe Dhl shipment documents.exe PID 1768 wrote to memory of 1904 1768 Dhl shipment documents.exe Dhl shipment documents.exe PID 1768 wrote to memory of 1904 1768 Dhl shipment documents.exe Dhl shipment documents.exe PID 1768 wrote to memory of 1904 1768 Dhl shipment documents.exe Dhl shipment documents.exe PID 1768 wrote to memory of 1904 1768 Dhl shipment documents.exe Dhl shipment documents.exe PID 1768 wrote to memory of 1904 1768 Dhl shipment documents.exe Dhl shipment documents.exe PID 1768 wrote to memory of 1904 1768 Dhl shipment documents.exe Dhl shipment documents.exe PID 1768 wrote to memory of 1904 1768 Dhl shipment documents.exe Dhl shipment documents.exe PID 1904 wrote to memory of 1948 1904 Dhl shipment documents.exe dw20.exe PID 1904 wrote to memory of 1948 1904 Dhl shipment documents.exe dw20.exe PID 1904 wrote to memory of 1948 1904 Dhl shipment documents.exe dw20.exe PID 1904 wrote to memory of 1948 1904 Dhl shipment documents.exe dw20.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Dhl shipment documents.exedescription pid process target process PID 1768 set thread context of 1904 1768 Dhl shipment documents.exe Dhl shipment documents.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dhl shipment documents.exe"C:\Users\Admin\AppData\Local\Temp\Dhl shipment documents.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qFmllAChfUoYL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp950D.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Dhl shipment documents.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 3763⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp950D.tmp
-
memory/1860-0-0x0000000000000000-mapping.dmp
-
memory/1904-2-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1904-3-0x00000000004941DE-mapping.dmp
-
memory/1904-4-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1904-5-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1948-6-0x0000000000000000-mapping.dmp
-
memory/1948-7-0x0000000002060000-0x0000000002071000-memory.dmpFilesize
68KB
-
memory/1948-10-0x00000000023A0000-0x00000000023B1000-memory.dmpFilesize
68KB