Analysis
-
max time kernel
80s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:22
Static task
static1
Behavioral task
behavioral1
Sample
DHL ARRIVAL SHIPMENT PRE-ALERT.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
DHL ARRIVAL SHIPMENT PRE-ALERT.exe
Resource
win10v2004-20220414-en
General
-
Target
DHL ARRIVAL SHIPMENT PRE-ALERT.exe
-
Size
1.0MB
-
MD5
d66436765b3cb3dc1a97beab0c6c7ae2
-
SHA1
bb5f32c172af5efd89c25960bed8edc76467a9b9
-
SHA256
dc05645067f3f3ccf6a4e647dcf935c928fd981ef904672603a7ab409488166e
-
SHA512
5591c88812f92ce11bbc87c01dceba3de905c5b7473582f2eb58f91929da4baf1bf44b5beb025d97027b85152969a64ef9c680881e4f30f7ac3a58a4e707e8a3
Malware Config
Extracted
C:\Users\Admin\AppData\Local\79FE0CC911\Log.txt
masslogger
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
DHL ARRIVAL SHIPMENT PRE-ALERT.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\International\Geo\Nation DHL ARRIVAL SHIPMENT PRE-ALERT.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
Processes:
DHL ARRIVAL SHIPMENT PRE-ALERT.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL ARRIVAL SHIPMENT PRE-ALERT.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL ARRIVAL SHIPMENT PRE-ALERT.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
DHL ARRIVAL SHIPMENT PRE-ALERT.exedescription pid process target process PID 892 set thread context of 1292 892 DHL ARRIVAL SHIPMENT PRE-ALERT.exe DHL ARRIVAL SHIPMENT PRE-ALERT.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
DHL ARRIVAL SHIPMENT PRE-ALERT.exepid process 1292 DHL ARRIVAL SHIPMENT PRE-ALERT.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
DHL ARRIVAL SHIPMENT PRE-ALERT.exeDHL ARRIVAL SHIPMENT PRE-ALERT.exepid process 892 DHL ARRIVAL SHIPMENT PRE-ALERT.exe 892 DHL ARRIVAL SHIPMENT PRE-ALERT.exe 1292 DHL ARRIVAL SHIPMENT PRE-ALERT.exe 1292 DHL ARRIVAL SHIPMENT PRE-ALERT.exe 1292 DHL ARRIVAL SHIPMENT PRE-ALERT.exe 1292 DHL ARRIVAL SHIPMENT PRE-ALERT.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
DHL ARRIVAL SHIPMENT PRE-ALERT.exeDHL ARRIVAL SHIPMENT PRE-ALERT.exedescription pid process Token: SeDebugPrivilege 892 DHL ARRIVAL SHIPMENT PRE-ALERT.exe Token: SeDebugPrivilege 1292 DHL ARRIVAL SHIPMENT PRE-ALERT.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
DHL ARRIVAL SHIPMENT PRE-ALERT.exepid process 1292 DHL ARRIVAL SHIPMENT PRE-ALERT.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
DHL ARRIVAL SHIPMENT PRE-ALERT.exedescription pid process target process PID 892 wrote to memory of 1296 892 DHL ARRIVAL SHIPMENT PRE-ALERT.exe schtasks.exe PID 892 wrote to memory of 1296 892 DHL ARRIVAL SHIPMENT PRE-ALERT.exe schtasks.exe PID 892 wrote to memory of 1296 892 DHL ARRIVAL SHIPMENT PRE-ALERT.exe schtasks.exe PID 892 wrote to memory of 1296 892 DHL ARRIVAL SHIPMENT PRE-ALERT.exe schtasks.exe PID 892 wrote to memory of 1292 892 DHL ARRIVAL SHIPMENT PRE-ALERT.exe DHL ARRIVAL SHIPMENT PRE-ALERT.exe PID 892 wrote to memory of 1292 892 DHL ARRIVAL SHIPMENT PRE-ALERT.exe DHL ARRIVAL SHIPMENT PRE-ALERT.exe PID 892 wrote to memory of 1292 892 DHL ARRIVAL SHIPMENT PRE-ALERT.exe DHL ARRIVAL SHIPMENT PRE-ALERT.exe PID 892 wrote to memory of 1292 892 DHL ARRIVAL SHIPMENT PRE-ALERT.exe DHL ARRIVAL SHIPMENT PRE-ALERT.exe PID 892 wrote to memory of 1292 892 DHL ARRIVAL SHIPMENT PRE-ALERT.exe DHL ARRIVAL SHIPMENT PRE-ALERT.exe PID 892 wrote to memory of 1292 892 DHL ARRIVAL SHIPMENT PRE-ALERT.exe DHL ARRIVAL SHIPMENT PRE-ALERT.exe PID 892 wrote to memory of 1292 892 DHL ARRIVAL SHIPMENT PRE-ALERT.exe DHL ARRIVAL SHIPMENT PRE-ALERT.exe PID 892 wrote to memory of 1292 892 DHL ARRIVAL SHIPMENT PRE-ALERT.exe DHL ARRIVAL SHIPMENT PRE-ALERT.exe PID 892 wrote to memory of 1292 892 DHL ARRIVAL SHIPMENT PRE-ALERT.exe DHL ARRIVAL SHIPMENT PRE-ALERT.exe -
outlook_office_path 1 IoCs
Processes:
DHL ARRIVAL SHIPMENT PRE-ALERT.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL ARRIVAL SHIPMENT PRE-ALERT.exe -
outlook_win_path 1 IoCs
Processes:
DHL ARRIVAL SHIPMENT PRE-ALERT.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 DHL ARRIVAL SHIPMENT PRE-ALERT.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL ARRIVAL SHIPMENT PRE-ALERT.exe"C:\Users\Admin\AppData\Local\Temp\DHL ARRIVAL SHIPMENT PRE-ALERT.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\icBEmexdsavHL" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE11C.tmp"2⤵
- Creates scheduled task(s)
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\DHL ARRIVAL SHIPMENT PRE-ALERT.exe"{path}"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:1292
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ae8c4d35cfc332031941f7f12cbd473d
SHA1ad9feb7468d715c2f301e40cf56d8375d61b57ac
SHA256ec5b4bb5e51cb2b25c06916b7931407ba3103cefc47cbbf02549f113aa78ea71
SHA51225f16ed5871585c146397bd154fca94aa1e69ff86c895d5d751577a2816a3984e93d934a4d9d9f57973d1be1e8c3a118468dc3f77653504cf41d234fb7793b95