Overview

overview

7

Static

static

Dhl Delive......exe

windows7_x64

7

Dhl Delive......exe

windows10_x64

7

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    17-07-2020 05:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Dhl Delivery Note-AWD 20....exe

  • Size

    844KB

  • MD5

    4edfea7124a45b9e92dcefd45058b482

  • SHA1

    fb4b8a24c75f3c05d22131ead74cd96c2142c350

  • SHA256

    faf1dca0b043816dc1a448c778e8fc03030add15983e04a7cc39851297615c4f

  • SHA512

    c3a8534c67845104d1008827679f5189aeb67bc44ff21f39117227b145555f92c292dba617c46e474c458b924d302c1dbfe77bf565c82da3ff26a53113e6b230

Score
7/10
persistencespyware

Malware Config

Signatures

  • Suspicious use of SendNotifyMessage 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of SendNotifyMessage
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1240
    • C:\Users\Admin\AppData\Local\Temp\Dhl Delivery Note-AWD 20....exe
      "C:\Users\Admin\AppData\Local\Temp\Dhl Delivery Note-AWD 20....exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      • Suspicious behavior: EnumeratesProcesses
      PID:1392
      • C:\Users\Admin\AppData\Local\Temp\Dhl Delivery Note-AWD 20....exe
        "{path}"
        3⤵
          PID:1800
        • C:\Users\Admin\AppData\Local\Temp\Dhl Delivery Note-AWD 20....exe
          "{path}"
          3⤵
            PID:1812
          • C:\Users\Admin\AppData\Local\Temp\Dhl Delivery Note-AWD 20....exe
            "{path}"
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetThreadContext
            • Suspicious behavior: MapViewOfSection
            • Suspicious behavior: EnumeratesProcesses
            PID:1828
        • C:\Windows\SysWOW64\wlanext.exe
          "C:\Windows\SysWOW64\wlanext.exe"
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetThreadContext
          • Suspicious behavior: MapViewOfSection
          • Drops file in Program Files directory
          • Adds Run key to start application
          • Modifies Internet Explorer settings
          • Suspicious use of WriteProcessMemory
          • Suspicious behavior: EnumeratesProcesses
          PID:1876
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Users\Admin\AppData\Local\Temp\Dhl Delivery Note-AWD 20....exe"
            3⤵
            • Deletes itself
            PID:1884
          • C:\Program Files\Mozilla Firefox\Firefox.exe
            "C:\Program Files\Mozilla Firefox\Firefox.exe"
            3⤵
              PID:1596

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\4L36R4-V\4L3logim.jpeg
          Download Submit
        • C:\Users\Admin\AppData\Roaming\4L36R4-V\4L3logrf.ini
          Download Submit
        • C:\Users\Admin\AppData\Roaming\4L36R4-V\4L3logri.ini
          Download Submit
        • C:\Users\Admin\AppData\Roaming\4L36R4-V\4L3logrv.ini
          Download Submit
        • memory/1596-8-0x0000000000000000-mapping.dmp
          Download
        • memory/1596-9-0x000000013FEE0000-0x000000013FF73000-memory.dmp
          Filesize

          588KB

          Download
        • memory/1828-1-0x000000000041E320-mapping.dmp
          Download
        • memory/1828-0-0x0000000000400000-0x000000000042D000-memory.dmp
          Filesize

          180KB

          Download
        • memory/1876-3-0x0000000000450000-0x0000000000466000-memory.dmp
          Filesize

          88KB

          Download
        • memory/1876-7-0x00000000031E0000-0x000000000329A000-memory.dmp
          Filesize

          744KB

          Download
        • memory/1876-6-0x0000000076590000-0x00000000766EC000-memory.dmp
          Filesize

          1.4MB

          Download
        • memory/1876-5-0x0000000001E70000-0x0000000001F13000-memory.dmp
          Filesize

          652KB

          Download
        • memory/1876-2-0x0000000000000000-mapping.dmp
          Download
        • memory/1884-4-0x0000000000000000-mapping.dmp
          Download