Analysis
-
max time kernel
134s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
04-03-2021 00:16
Static task
static1
Behavioral task
behavioral1
Sample
DHL Document.exe
Resource
win7v20201028
General
-
Target
DHL Document.exe
-
Size
1.1MB
-
MD5
92900a9f09ad28e0e6068988f85383c4
-
SHA1
d2088728af43a30bd69fd4bff9db5e9a6f54d55c
-
SHA256
73429ed369e556843e28f21b233a49aa9cc7b55d36c5be69f3745a75d17eaf1f
-
SHA512
77ff1b0a1d99f92204955a60599953965292ead8dc41c2b993a4c522350eeb50efead8fcc7500d72e823b04efa6165e750fcc5f5f793f8af192252cebc354d40
Malware Config
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/660-16-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/660-17-0x000000000040242D-mapping.dmp netwire behavioral2/memory/660-18-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Suspicious use of SetThreadContext 1 IoCs
Processes:
DHL Document.exedescription pid process target process PID 1192 set thread context of 660 1192 DHL Document.exe DHL Document.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
DHL Document.exedescription pid process target process PID 1192 wrote to memory of 980 1192 DHL Document.exe schtasks.exe PID 1192 wrote to memory of 980 1192 DHL Document.exe schtasks.exe PID 1192 wrote to memory of 980 1192 DHL Document.exe schtasks.exe PID 1192 wrote to memory of 660 1192 DHL Document.exe DHL Document.exe PID 1192 wrote to memory of 660 1192 DHL Document.exe DHL Document.exe PID 1192 wrote to memory of 660 1192 DHL Document.exe DHL Document.exe PID 1192 wrote to memory of 660 1192 DHL Document.exe DHL Document.exe PID 1192 wrote to memory of 660 1192 DHL Document.exe DHL Document.exe PID 1192 wrote to memory of 660 1192 DHL Document.exe DHL Document.exe PID 1192 wrote to memory of 660 1192 DHL Document.exe DHL Document.exe PID 1192 wrote to memory of 660 1192 DHL Document.exe DHL Document.exe PID 1192 wrote to memory of 660 1192 DHL Document.exe DHL Document.exe PID 1192 wrote to memory of 660 1192 DHL Document.exe DHL Document.exe PID 1192 wrote to memory of 660 1192 DHL Document.exe DHL Document.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL Document.exe"C:\Users\Admin\AppData\Local\Temp\DHL Document.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lTZDstzxRzxl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp782A.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\DHL Document.exe"C:\Users\Admin\AppData\Local\Temp\DHL Document.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp782A.tmpMD5
734e3f0480ca10f9b9cedc6d451e7d12
SHA19c113cfb6c427b9f547ae6ae315698f07d15b7e5
SHA25621b877010f002f6c7a0b8e37e37dc84eca0ceaa358544b428fb9ef5a5f167875
SHA512b0dc7201d1c3ffd85707677d0f93e4097bb527c805f912448ab2b8e0f395d163c9134b850ec3b0f86a7f1744400224e7c11d33fa2b2d3b89f53050a12a0fcbd4
-
memory/660-18-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/660-17-0x000000000040242D-mapping.dmp
-
memory/660-16-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/980-14-0x0000000000000000-mapping.dmp
-
memory/1192-7-0x0000000005150000-0x0000000005151000-memory.dmpFilesize
4KB
-
memory/1192-9-0x00000000052B0000-0x00000000052B1000-memory.dmpFilesize
4KB
-
memory/1192-10-0x0000000005B50000-0x0000000005B51000-memory.dmpFilesize
4KB
-
memory/1192-11-0x00000000050F0000-0x00000000050F7000-memory.dmpFilesize
28KB
-
memory/1192-12-0x00000000053B0000-0x00000000053B1000-memory.dmpFilesize
4KB
-
memory/1192-13-0x0000000005FC0000-0x000000000600F000-memory.dmpFilesize
316KB
-
memory/1192-8-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/1192-2-0x0000000073D20000-0x000000007440E000-memory.dmpFilesize
6.9MB
-
memory/1192-6-0x0000000005650000-0x0000000005651000-memory.dmpFilesize
4KB
-
memory/1192-5-0x0000000004FC0000-0x0000000004FC1000-memory.dmpFilesize
4KB
-
memory/1192-3-0x0000000000690000-0x0000000000691000-memory.dmpFilesize
4KB