Analysis
- max time kernel
66s - max time network
114s - platform
windows10_x64 - resource
win10 - submitted
18/08/2020, 11:01
Static task
static1
Behavioral task
behavioral1
Sample
DHL.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
DHL.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target DHL.exe
- Size 993KB
- Sample200818-tblsvs3l62
- SHA256 7fce676b063449eecd1236727598513639a7fd166d6e2f86dce138b97636d572
- MD5 2593808318d4f797e305492da210762f
- SHA1 78ddaf57df35cf80fcef8ccd456d48748ab079cf
- SHA512 f906181c58adf83c4abecd69660e337748aa251cba48f96f1662abbf393e9a989285888d2fb29a11be94180e9c45358261dc3a7e2d6caa9cf2edcd30ceae50c7
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 3796 msefnm.pif 2988 RegSvcs.exe 2488 RegSvcs.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3796 set thread context of 2988 3796 msefnm.pif 83 - Program crash 1 IoCs
pid pid_target Process procid_target 2728 2988 WerFault.exe 83 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3796 msefnm.pif 3796 msefnm.pif 3796 msefnm.pif 3796 msefnm.pif 3796 msefnm.pif 3796 msefnm.pif 3796 msefnm.pif 3796 msefnm.pif 3796 msefnm.pif 3796 msefnm.pif 3796 msefnm.pif 3796 msefnm.pif 3796 msefnm.pif 3796 msefnm.pif - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3796 msefnm.pif - Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 3856 wrote to memory of 3796 3856 DHL.exe 67 PID 3856 wrote to memory of 3796 3856 DHL.exe 67 PID 3856 wrote to memory of 3796 3856 DHL.exe 67 PID 3796 wrote to memory of 3020 3796 msefnm.pif 69 PID 3796 wrote to memory of 3020 3796 msefnm.pif 69 PID 3796 wrote to memory of 3020 3796 msefnm.pif 69 PID 3796 wrote to memory of 3232 3796 msefnm.pif 70 PID 3796 wrote to memory of 3232 3796 msefnm.pif 70 PID 3796 wrote to memory of 3232 3796 msefnm.pif 70 PID 3796 wrote to memory of 3548 3796 msefnm.pif 71 PID 3796 wrote to memory of 3548 3796 msefnm.pif 71 PID 3796 wrote to memory of 3548 3796 msefnm.pif 71 PID 3796 wrote to memory of 3976 3796 msefnm.pif 72 PID 3796 wrote to memory of 3976 3796 msefnm.pif 72 PID 3796 wrote to memory of 3976 3796 msefnm.pif 72 PID 3796 wrote to memory of 520 3796 msefnm.pif 73 PID 3796 wrote to memory of 520 3796 msefnm.pif 73 PID 3796 wrote to memory of 520 3796 msefnm.pif 73 PID 3796 wrote to memory of 1648 3796 msefnm.pif 76 PID 3796 wrote to memory of 1648 3796 msefnm.pif 76 PID 3796 wrote to memory of 1648 3796 msefnm.pif 76 PID 3796 wrote to memory of 1908 3796 msefnm.pif 80 PID 3796 wrote to memory of 1908 3796 msefnm.pif 80 PID 3796 wrote to memory of 1908 3796 msefnm.pif 80 PID 3796 wrote to memory of 2488 3796 msefnm.pif 82 PID 3796 wrote to memory of 2488 3796 msefnm.pif 82 PID 3796 wrote to memory of 2488 3796 msefnm.pif 82 PID 3796 wrote to memory of 2988 3796 msefnm.pif 83 PID 3796 wrote to memory of 2988 3796 msefnm.pif 83 PID 3796 wrote to memory of 2988 3796 msefnm.pif 83 PID 3796 wrote to memory of 2988 3796 msefnm.pif 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL.exe"C:\Users\Admin\AppData\Local\Temp\DHL.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\46115479\msefnm.pif"C:\Users\Admin\AppData\Local\Temp\46115479\msefnm.pif" oexktuuhf.skc2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe"3⤵PID:3020
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe"3⤵PID:3232
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe"3⤵PID:3548
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe"3⤵PID:3976
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe"3⤵PID:520
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe"3⤵PID:1648
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe"3⤵PID:1908
-
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"3⤵
- Executes dropped EXE
PID:2488
-
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"3⤵
- Executes dropped EXE
PID:2988 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 964⤵
- Program crash
PID:2728
-
-
-