Analysis
-
max time kernel
125s -
max time network
127s -
platform
windows10_x64 -
resource
win10 -
submitted
13-07-2020 06:23
Static task
static1
Behavioral task
behavioral1
Sample
Attached DHL.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
Attached DHL.exe
Resource
win10
General
-
Target
Attached DHL.exe
-
Size
354KB
-
MD5
417c52dec5ca2c6385c20f4d44af7115
-
SHA1
3af4fbf7324ea4d34ea5c1dc8409002dc3e6cce8
-
SHA256
6e2fd15a9c77550b18d299a364b3de14f594505d3fe366957635e2ff984c96e7
-
SHA512
5aa4229601a63e5693808e5017fe3e9fc5a96f561eed9d52c777174c8f7ed7d1557a2a8792b2c50627b9977df7df31fb66097985734a016943b934ff77267e27
Malware Config
Extracted
Protocol: smtp- Host:
mail.misrnour.com - Port:
587 - Username:
[email protected] - Password:
Em12!@34#$29
Signatures
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Attached DHL.exedescription pid process target process PID 3852 wrote to memory of 3512 3852 Attached DHL.exe schtasks.exe PID 3852 wrote to memory of 3512 3852 Attached DHL.exe schtasks.exe PID 3852 wrote to memory of 3512 3852 Attached DHL.exe schtasks.exe PID 3852 wrote to memory of 1852 3852 Attached DHL.exe Attached DHL.exe PID 3852 wrote to memory of 1852 3852 Attached DHL.exe Attached DHL.exe PID 3852 wrote to memory of 1852 3852 Attached DHL.exe Attached DHL.exe PID 3852 wrote to memory of 1852 3852 Attached DHL.exe Attached DHL.exe PID 3852 wrote to memory of 1852 3852 Attached DHL.exe Attached DHL.exe PID 3852 wrote to memory of 1852 3852 Attached DHL.exe Attached DHL.exe PID 3852 wrote to memory of 1852 3852 Attached DHL.exe Attached DHL.exe PID 3852 wrote to memory of 1852 3852 Attached DHL.exe Attached DHL.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Attached DHL.exedescription pid process target process PID 3852 set thread context of 1852 3852 Attached DHL.exe Attached DHL.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Attached DHL.exeAttached DHL.exedescription pid process Token: SeDebugPrivilege 3852 Attached DHL.exe Token: SeDebugPrivilege 1852 Attached DHL.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Attached DHL.exeAttached DHL.exepid process 3852 Attached DHL.exe 1852 Attached DHL.exe 1852 Attached DHL.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Attached DHL.exe"C:\Users\Admin\AppData\Local\Temp\Attached DHL.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3852 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wyEASOaRt" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBD7E.tmp"2⤵
- Creates scheduled task(s)
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\Attached DHL.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1852
-
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exeC:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe1⤵PID:3224
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Attached DHL.exe.log
-
C:\Users\Admin\AppData\Local\Temp\tmpBD7E.tmp
-
memory/1852-2-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1852-3-0x000000000044687E-mapping.dmp
-
memory/3512-0-0x0000000000000000-mapping.dmp