Analysis
-
max time kernel
60s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
08-07-2021 12:05
Static task
static1
Behavioral task
behavioral1
Sample
DHL_PACKAGE_HD98232.pdf.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
DHL_PACKAGE_HD98232.pdf.exe
Resource
win10v20210410
General
-
Target
DHL_PACKAGE_HD98232.pdf.exe
-
Size
1.3MB
-
MD5
0e72b26fbd7f27c2753c02193337c280
-
SHA1
fc000dd71eeace99e08c54e6a8ec6d578c80ed20
-
SHA256
6095dd10965d4e081e87c366736e0305b7d42f84dbdb10471bcedacfe145f7a5
-
SHA512
0f222aef8358f3a712871316eb9aa1c24efc36c90396701c4cbae558a3e52bab6c6acedd2a21555e914204fab47f30b586a6322a81fa925042c05eda4ec34950
Malware Config
Signatures
-
RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
-
WebMonitor Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3876-128-0x000000000049D8CA-mapping.dmp family_webmonitor behavioral2/memory/3876-127-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor behavioral2/memory/3876-129-0x0000000000400000-0x00000000004F3000-memory.dmp family_webmonitor -
Suspicious use of SetThreadContext 1 IoCs
Processes:
DHL_PACKAGE_HD98232.pdf.exedescription pid process target process PID 3908 set thread context of 3876 3908 DHL_PACKAGE_HD98232.pdf.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
DHL_PACKAGE_HD98232.pdf.exepid process 3908 DHL_PACKAGE_HD98232.pdf.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
DHL_PACKAGE_HD98232.pdf.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 3908 DHL_PACKAGE_HD98232.pdf.exe Token: SeShutdownPrivilege 3876 RegSvcs.exe Token: SeCreatePagefilePrivilege 3876 RegSvcs.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
DHL_PACKAGE_HD98232.pdf.exeRegSvcs.exedescription pid process target process PID 3908 wrote to memory of 2332 3908 DHL_PACKAGE_HD98232.pdf.exe schtasks.exe PID 3908 wrote to memory of 2332 3908 DHL_PACKAGE_HD98232.pdf.exe schtasks.exe PID 3908 wrote to memory of 2332 3908 DHL_PACKAGE_HD98232.pdf.exe schtasks.exe PID 3908 wrote to memory of 3876 3908 DHL_PACKAGE_HD98232.pdf.exe RegSvcs.exe PID 3908 wrote to memory of 3876 3908 DHL_PACKAGE_HD98232.pdf.exe RegSvcs.exe PID 3908 wrote to memory of 3876 3908 DHL_PACKAGE_HD98232.pdf.exe RegSvcs.exe PID 3908 wrote to memory of 3876 3908 DHL_PACKAGE_HD98232.pdf.exe RegSvcs.exe PID 3908 wrote to memory of 3876 3908 DHL_PACKAGE_HD98232.pdf.exe RegSvcs.exe PID 3908 wrote to memory of 3876 3908 DHL_PACKAGE_HD98232.pdf.exe RegSvcs.exe PID 3908 wrote to memory of 3876 3908 DHL_PACKAGE_HD98232.pdf.exe RegSvcs.exe PID 3908 wrote to memory of 3876 3908 DHL_PACKAGE_HD98232.pdf.exe RegSvcs.exe PID 3908 wrote to memory of 3876 3908 DHL_PACKAGE_HD98232.pdf.exe RegSvcs.exe PID 3876 wrote to memory of 2416 3876 RegSvcs.exe cmd.exe PID 3876 wrote to memory of 2416 3876 RegSvcs.exe cmd.exe PID 3876 wrote to memory of 2416 3876 RegSvcs.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL_PACKAGE_HD98232.pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL_PACKAGE_HD98232.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sKUmEKiiItxu" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE12E.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uqcOIx7ZXrsNOVaI.bat" "3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpE12E.tmpMD5
8418b94adf7e2db9572e4f785f334b5b
SHA15c9ed0c6481a2e30d07db7871d44f9b659ec2669
SHA2564ec401f774064973966e832ff4c497d8e6281c0ea45f27e452b4572d096fa1f5
SHA512010ef727df25ffd96012c755d8d6e8fdce015ee7f756fd1a864d7d41b8c6a9bb0a7ce0cc8da331a0993c2fe24ea2f183269b795aa4675a44ded4e0da3c3e11b2
-
C:\Users\Admin\AppData\Local\Temp\uqcOIx7ZXrsNOVaI.batMD5
9e86c940add690e2f87dbf6b50e57039
SHA121aac921fd75883d402b7d66bdb93218f118c4e2
SHA256e16e317ae5b2959ef431a520e6260dfe4e8305b939c9bc53bdeb65eb2c5ca4ff
SHA512c6647b8ab0f030bdbb989314baacfd8c9d4dd3ae4b354d46b1e09002373265fb8ac63c866899ab751171001a2d9563b0ba684bf447aa629ad4406df9d700ec59
-
memory/2332-125-0x0000000000000000-mapping.dmp
-
memory/2416-130-0x0000000000000000-mapping.dmp
-
memory/3876-129-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB
-
memory/3876-127-0x0000000000400000-0x00000000004F3000-memory.dmpFilesize
972KB
-
memory/3876-128-0x000000000049D8CA-mapping.dmp
-
memory/3908-119-0x0000000004FD0000-0x0000000004FD1000-memory.dmpFilesize
4KB
-
memory/3908-123-0x0000000008900000-0x0000000008A00000-memory.dmpFilesize
1024KB
-
memory/3908-124-0x000000000C000000-0x000000000C104000-memory.dmpFilesize
1.0MB
-
memory/3908-122-0x0000000006BD0000-0x0000000006BDF000-memory.dmpFilesize
60KB
-
memory/3908-121-0x0000000004FB0000-0x00000000054AE000-memory.dmpFilesize
5.0MB
-
memory/3908-120-0x0000000005220000-0x0000000005221000-memory.dmpFilesize
4KB
-
memory/3908-114-0x00000000005C0000-0x00000000005C1000-memory.dmpFilesize
4KB
-
memory/3908-118-0x0000000005050000-0x0000000005051000-memory.dmpFilesize
4KB
-
memory/3908-117-0x00000000054B0000-0x00000000054B1000-memory.dmpFilesize
4KB
-
memory/3908-116-0x0000000004F10000-0x0000000004F11000-memory.dmpFilesize
4KB