Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
08-07-2021 12:05
Static task
static1
Behavioral task
behavioral1
Sample
DHL_PACKAGE_HD98232.pdf.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
DHL_PACKAGE_HD98232.pdf.exe
Resource
win10v20210410
General
-
Target
DHL_PACKAGE_HD98232.pdf.exe
-
Size
1.3MB
-
MD5
0e72b26fbd7f27c2753c02193337c280
-
SHA1
fc000dd71eeace99e08c54e6a8ec6d578c80ed20
-
SHA256
6095dd10965d4e081e87c366736e0305b7d42f84dbdb10471bcedacfe145f7a5
-
SHA512
0f222aef8358f3a712871316eb9aa1c24efc36c90396701c4cbae558a3e52bab6c6acedd2a21555e914204fab47f30b586a6322a81fa925042c05eda4ec34950
Malware Config
Signatures
-
RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
-
WebMonitor Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1116-68-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor behavioral1/memory/1116-69-0x000000000049D8CA-mapping.dmp family_webmonitor behavioral1/memory/1116-71-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\WebMonitor-ced9 = "C:\\Users\\Admin\\AppData\\Roaming\\WebMonitor-ced9.exe" RegSvcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WebMonitor-ced9 = "C:\\Users\\Admin\\AppData\\Roaming\\WebMonitor-ced9.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
DHL_PACKAGE_HD98232.pdf.exedescription pid process target process PID 1944 set thread context of 1116 1944 DHL_PACKAGE_HD98232.pdf.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
DHL_PACKAGE_HD98232.pdf.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1944 DHL_PACKAGE_HD98232.pdf.exe Token: SeShutdownPrivilege 1116 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 1116 RegSvcs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
DHL_PACKAGE_HD98232.pdf.exedescription pid process target process PID 1944 wrote to memory of 1072 1944 DHL_PACKAGE_HD98232.pdf.exe schtasks.exe PID 1944 wrote to memory of 1072 1944 DHL_PACKAGE_HD98232.pdf.exe schtasks.exe PID 1944 wrote to memory of 1072 1944 DHL_PACKAGE_HD98232.pdf.exe schtasks.exe PID 1944 wrote to memory of 1072 1944 DHL_PACKAGE_HD98232.pdf.exe schtasks.exe PID 1944 wrote to memory of 1116 1944 DHL_PACKAGE_HD98232.pdf.exe RegSvcs.exe PID 1944 wrote to memory of 1116 1944 DHL_PACKAGE_HD98232.pdf.exe RegSvcs.exe PID 1944 wrote to memory of 1116 1944 DHL_PACKAGE_HD98232.pdf.exe RegSvcs.exe PID 1944 wrote to memory of 1116 1944 DHL_PACKAGE_HD98232.pdf.exe RegSvcs.exe PID 1944 wrote to memory of 1116 1944 DHL_PACKAGE_HD98232.pdf.exe RegSvcs.exe PID 1944 wrote to memory of 1116 1944 DHL_PACKAGE_HD98232.pdf.exe RegSvcs.exe PID 1944 wrote to memory of 1116 1944 DHL_PACKAGE_HD98232.pdf.exe RegSvcs.exe PID 1944 wrote to memory of 1116 1944 DHL_PACKAGE_HD98232.pdf.exe RegSvcs.exe PID 1944 wrote to memory of 1116 1944 DHL_PACKAGE_HD98232.pdf.exe RegSvcs.exe PID 1944 wrote to memory of 1116 1944 DHL_PACKAGE_HD98232.pdf.exe RegSvcs.exe PID 1944 wrote to memory of 1116 1944 DHL_PACKAGE_HD98232.pdf.exe RegSvcs.exe PID 1944 wrote to memory of 1116 1944 DHL_PACKAGE_HD98232.pdf.exe RegSvcs.exe PID 1944 wrote to memory of 1116 1944 DHL_PACKAGE_HD98232.pdf.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL_PACKAGE_HD98232.pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL_PACKAGE_HD98232.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sKUmEKiiItxu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5E17.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5E17.tmpMD5
29047727459169c1a38a2deda91e10bc
SHA1da41255f155b7d477269a6720cfeebadbb836cef
SHA2562f54ab283a834f10fa48c169e8a6065d179bebdc49941ad2ddb3a1530c5047d0
SHA512c3c6a57ee2d00bdf411ae841f447ab312af486e5178e03b8ff84986a272794765d05d01322e63243a119f89e6440e09ebd6b2d626165c089b5ce8ade104eb471
-
memory/1072-66-0x0000000000000000-mapping.dmp
-
memory/1116-68-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB
-
memory/1116-69-0x000000000049D8CA-mapping.dmp
-
memory/1116-70-0x0000000076691000-0x0000000076693000-memory.dmpFilesize
8KB
-
memory/1116-71-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB
-
memory/1116-72-0x0000000002D60000-0x0000000003D60000-memory.dmpFilesize
16.0MB
-
memory/1944-60-0x0000000000A60000-0x0000000000A61000-memory.dmpFilesize
4KB
-
memory/1944-62-0x0000000004EC0000-0x0000000004EC1000-memory.dmpFilesize
4KB
-
memory/1944-63-0x0000000000320000-0x000000000032F000-memory.dmpFilesize
60KB
-
memory/1944-64-0x0000000008150000-0x0000000008250000-memory.dmpFilesize
1024KB
-
memory/1944-65-0x0000000009250000-0x0000000009354000-memory.dmpFilesize
1.0MB