0b8cfd98e1eba6b6bc294f25a09c5ddb28bd9eda15ef8c97478f4a56ee373f92

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7v20201028
submitted
09/11/2020, 20:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DHL_Details.exe
Size 785KB
Sample201109-ca849s2trs
SHA256 0b8cfd98e1eba6b6bc294f25a09c5ddb28bd9eda15ef8c97478f4a56ee373f92
MD5 351a1952d7e75067285c8d0810e9217f
SHA1 205f06bbe625a386f4a19076730ba891d63f8b48
SHA512 a1925eb8d08502bac49c61a49f2180aeefca8cd126de35a3fbb9f405bd96e013a9a070627cd0e32a4a508fb665e885b6bee5a23d94a2c10eff1dcf5ef8d6063a
MD5 SHA1 SHA512

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1476	1040	WerFault.exe	24

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1476	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 1476	1040	DHL_Details.exe	31
PID 1040 wrote to memory of 1476	1040	DHL_Details.exe	31
PID 1040 wrote to memory of 1476	1040	DHL_Details.exe	31
PID 1040 wrote to memory of 1476	1040	DHL_Details.exe	31

C:\Users\Admin\AppData\Local\Temp\DHL_Details.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_Details.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 876
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/296-0-0x000007FEF7880000-0x000007FEF7AFA000-memory.dmp

Download

memory/1476-2-0x0000000001DB0000-0x0000000001DC1000-memory.dmp

Download

memory/1476-3-0x0000000001DB0000-0x0000000001DC1000-memory.dmp

Download

memory/1476-5-0x0000000002680000-0x0000000002691000-memory.dmp

Download