4cffbdf1d3e2016475da67b15f0ab12a9658e0970f691cebe0bd161e2e1772b2

Analysis

max time kernel
109s
max time network
149s
platform
windows10_x64
resource
win10v200430
submitted
21/07/2020, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DHL_CUSTOMERS_FORM.exe
Size 1.5MB
Sample200721-9yfynwhnnx
SHA256 4cffbdf1d3e2016475da67b15f0ab12a9658e0970f691cebe0bd161e2e1772b2
MD5 1177bf332db50a89e3bfd846b5c42ea4
SHA1 c9cfb486662d9c127cb7c5cdc4ec305715677eb4
SHA512 37dbfdd16eec416538a4fac324662a636ce98246ca70b02baea0894798baf44ce392b01d83ea573993f3ef4bbb5d175749651ac48d7490bdc88810a3b29b2d48
MD5 SHA1 SHA512

Score

7^/10

spyware

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2860	2104	DHL_CUSTOMERS_FORM.exe	69
PID 2104 wrote to memory of 2860	2104	DHL_CUSTOMERS_FORM.exe	69
PID 2104 wrote to memory of 2860	2104	DHL_CUSTOMERS_FORM.exe	69

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2104	DHL_CUSTOMERS_FORM.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1640	2860	WerFault.exe	69

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	1640	WerFault.exe
Token: SeBackupPrivilege	1640	WerFault.exe
Token: SeDebugPrivilege	1640	WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe

Loads dropped DLL 6 IoCs

pid	Process
2104	DHL_CUSTOMERS_FORM.exe
2104	DHL_CUSTOMERS_FORM.exe
2104	DHL_CUSTOMERS_FORM.exe
2104	DHL_CUSTOMERS_FORM.exe
2104	DHL_CUSTOMERS_FORM.exe
2104	DHL_CUSTOMERS_FORM.exe

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ad97-14.dat	js

C:\Users\Admin\AppData\Local\Temp\DHL_CUSTOMERS_FORM.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_CUSTOMERS_FORM.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Loads dropped DLL
PID:2104
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell Add-MpPreference -ExclusionPath C:\
  2⤵
  PID:2860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 704
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    PID:1640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1640-10-0x00000000051A0000-0x00000000051A1000-memory.dmp

Download

memory/1640-2-0x00000000049B0000-0x00000000049B1000-memory.dmp

Download

memory/1640-3-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Download

memory/2104-0-0x0000000002400000-0x0000000002554000-memory.dmp

Download