Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    17-07-2020 05:13

General

  • Target

    Dhl Delivery Note-AWD 20....exe

  • Size

    844KB

  • MD5

    4edfea7124a45b9e92dcefd45058b482

  • SHA1

    fb4b8a24c75f3c05d22131ead74cd96c2142c350

  • SHA256

    faf1dca0b043816dc1a448c778e8fc03030add15983e04a7cc39851297615c4f

  • SHA512

    c3a8534c67845104d1008827679f5189aeb67bc44ff21f39117227b145555f92c292dba617c46e474c458b924d302c1dbfe77bf565c82da3ff26a53113e6b230

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious use of WriteProcessMemory 18 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2968
    • C:\Users\Admin\AppData\Local\Temp\Dhl Delivery Note-AWD 20....exe
      "C:\Users\Admin\AppData\Local\Temp\Dhl Delivery Note-AWD 20....exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetThreadContext
      PID:3872
      • C:\Users\Admin\AppData\Local\Temp\Dhl Delivery Note-AWD 20....exe
        "{path}"
        3⤵
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        PID:1932
    • C:\Windows\SysWOW64\ipconfig.exe
      "C:\Windows\SysWOW64\ipconfig.exe"
      2⤵
      • Suspicious behavior: MapViewOfSection
      • Drops file in Program Files directory
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Modifies Internet Explorer settings
      • Gathers network information
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      PID:1840
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\Dhl Delivery Note-AWD 20....exe"
        3⤵
          PID:1828
        • C:\Windows\SysWOW64\cmd.exe
          /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
          3⤵
            PID:2420
          • C:\Program Files\Mozilla Firefox\Firefox.exe
            "C:\Program Files\Mozilla Firefox\Firefox.exe"
            3⤵
              PID:2736
        • C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
          C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
          1⤵
            PID:3824

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\DB1
          • C:\Users\Admin\AppData\Roaming\4L36R4-V\4L3logim.jpeg
          • C:\Users\Admin\AppData\Roaming\4L36R4-V\4L3logrf.ini
          • C:\Users\Admin\AppData\Roaming\4L36R4-V\4L3logrg.ini
          • C:\Users\Admin\AppData\Roaming\4L36R4-V\4L3logri.ini
          • C:\Users\Admin\AppData\Roaming\4L36R4-V\4L3logrv.ini
          • memory/1828-6-0x0000000000000000-mapping.dmp
          • memory/1840-5-0x00000000010C0000-0x00000000010CB000-memory.dmp
            Filesize

            44KB

          • memory/1840-10-0x00000000062F0000-0x00000000063C8000-memory.dmp
            Filesize

            864KB

          • memory/1840-7-0x0000000003FC0000-0x00000000040C6000-memory.dmp
            Filesize

            1.0MB

          • memory/1840-4-0x00000000010C0000-0x00000000010CB000-memory.dmp
            Filesize

            44KB

          • memory/1840-3-0x0000000000000000-mapping.dmp
          • memory/1932-0-0x0000000000400000-0x000000000042D000-memory.dmp
            Filesize

            180KB

          • memory/1932-1-0x000000000041E320-mapping.dmp
          • memory/2420-8-0x0000000000000000-mapping.dmp
          • memory/2736-11-0x0000000000000000-mapping.dmp
          • memory/2736-12-0x00007FF74FDC0000-0x00007FF74FE53000-memory.dmp
            Filesize

            588KB

          • memory/2736-13-0x00007FF74FDC0000-0x00007FF74FE53000-memory.dmp
            Filesize

            588KB

          • memory/2736-14-0x00007FF74FDC0000-0x00007FF74FE53000-memory.dmp
            Filesize

            588KB