48c2d31acc0c9de4e78cf10a906fb274f9512bf32c221ed5d5272ba98e9f0b44

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23/12/2022, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DHL Original BL, PL, CI Copies.htm.exe
Size 460KB
Sample221223-e25bysfh27
SHA256 48c2d31acc0c9de4e78cf10a906fb274f9512bf32c221ed5d5272ba98e9f0b44
MD5 1e541a8d92056c764a76b7eeb3f589e8
SHA1 50666cbff8ddc27f8831a8c32bc1293e6af98f9e
SHA512 04f78b030ce678221ea787cf51bd343d3e68b5adec75a3fcfa08f35f3ff97d70efd8150789187c12e23eb6cdc45cc6b09811f53ae2544100e6039c451a4b02bb
SSDEEP 6144:Jkw20xk6e96C2U/2aqg9JBP/WBfUMnntkvFPvyRqOs4bZuowh+RizLsYBspSzGDb:ulzAKpwU+nAFPviZM+jmASSmh161l
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1100	tdlwbapu.exe
1488	tdlwbapu.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Control Panel\International\Geo\Nation	tdlwbapu.exe

Loads dropped DLL 4 IoCs

pid	Process
2044	DHL Original BL, PL, CI Copies.htm.exe
2044	DHL Original BL, PL, CI Copies.htm.exe
1100	tdlwbapu.exe
644	NAPSTAT.EXE

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1100 set thread context of 1488	1100	tdlwbapu.exe	29
PID 1488 set thread context of 1244	1488	tdlwbapu.exe	17
PID 644 set thread context of 1244	644	NAPSTAT.EXE	17

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1214520366-621468234-4062160515-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	NAPSTAT.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1488	tdlwbapu.exe
1488	tdlwbapu.exe
1488	tdlwbapu.exe
1488	tdlwbapu.exe
644	NAPSTAT.EXE
644	NAPSTAT.EXE
644	NAPSTAT.EXE
644	NAPSTAT.EXE
644	NAPSTAT.EXE
644	NAPSTAT.EXE
644	NAPSTAT.EXE
644	NAPSTAT.EXE
644	NAPSTAT.EXE
644	NAPSTAT.EXE
644	NAPSTAT.EXE
644	NAPSTAT.EXE
644	NAPSTAT.EXE
644	NAPSTAT.EXE
644	NAPSTAT.EXE
644	NAPSTAT.EXE
644	NAPSTAT.EXE
644	NAPSTAT.EXE
644	NAPSTAT.EXE
644	NAPSTAT.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1244	Explorer.EXE

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
1100	tdlwbapu.exe
1488	tdlwbapu.exe
1488	tdlwbapu.exe
1488	tdlwbapu.exe
644	NAPSTAT.EXE
644	NAPSTAT.EXE
644	NAPSTAT.EXE
644	NAPSTAT.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1488	tdlwbapu.exe
Token: SeDebugPrivilege	644	NAPSTAT.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1244	Explorer.EXE
1244	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1244	Explorer.EXE
1244	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1100	2044	DHL Original BL, PL, CI Copies.htm.exe	28
PID 2044 wrote to memory of 1100	2044	DHL Original BL, PL, CI Copies.htm.exe	28
PID 2044 wrote to memory of 1100	2044	DHL Original BL, PL, CI Copies.htm.exe	28
PID 2044 wrote to memory of 1100	2044	DHL Original BL, PL, CI Copies.htm.exe	28
PID 1100 wrote to memory of 1488	1100	tdlwbapu.exe	29
PID 1100 wrote to memory of 1488	1100	tdlwbapu.exe	29
PID 1100 wrote to memory of 1488	1100	tdlwbapu.exe	29
PID 1100 wrote to memory of 1488	1100	tdlwbapu.exe	29
PID 1100 wrote to memory of 1488	1100	tdlwbapu.exe	29
PID 1244 wrote to memory of 644	1244	Explorer.EXE	31
PID 1244 wrote to memory of 644	1244	Explorer.EXE	31
PID 1244 wrote to memory of 644	1244	Explorer.EXE	31
PID 1244 wrote to memory of 644	1244	Explorer.EXE	31
PID 644 wrote to memory of 1724	644	NAPSTAT.EXE	34
PID 644 wrote to memory of 1724	644	NAPSTAT.EXE	34
PID 644 wrote to memory of 1724	644	NAPSTAT.EXE	34
PID 644 wrote to memory of 1724	644	NAPSTAT.EXE	34
PID 644 wrote to memory of 1724	644	NAPSTAT.EXE	34

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Users\Admin\AppData\Local\Temp\DHL Original BL, PL, CI Copies.htm.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL Original BL, PL, CI Copies.htm.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Users\Admin\AppData\Local\Temp\tdlwbapu.exe
    "C:\Users\Admin\AppData\Local\Temp\tdlwbapu.exe" C:\Users\Admin\AppData\Local\Temp\ihwiobkhxt.lyr
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Users\Admin\AppData\Local\Temp\tdlwbapu.exe
      "C:\Users\Admin\AppData\Local\Temp\tdlwbapu.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:1488
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:560
- C:\Windows\SysWOW64\NAPSTAT.EXE
  "C:\Windows\SysWOW64\NAPSTAT.EXE"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:644
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ihwiobkhxt.lyr

Path C:\Users\Admin\AppData\Local\Temp\ihwiobkhxt.lyr
Size 5KB
SHA256 0eb97f8971e3218e0b9e2864607b244d3ef94fb4666bf8405d59680d184dc05c
MD5 38e4018ab4a530f70b457400debb489e
SHA1 395bfc890f298c47b17e0abb54b922e29324f90b
SHA512 6ef0e1a3576c2b5c58022d71ea2cae1036343cbf8f17034b19fa192add7e378a037100aff5bde79c145d0a1bd8d01428707ac7a36de062db8d3635feb016db67
SSDEEP 96:wRP0doOtICvS8lzcGfCDXS+QBlituNzELe83wqLHdDn9qRxle:5t7rCGfCDXSNBSakl3wS9D9qRq
MD5 SHA1 SHA512 SSDEEP

Submit Download

klwtnljh.dfv

Path C:\Users\Admin\AppData\Local\Temp\klwtnljh.dfv
Size 185KB
SHA256 a894683f6eb79be3e7a25970a1bb71be19c1fa19094aed395129d85192013027
MD5 0cb6f8b0942fb67d1e16d8c7c044705b
SHA1 8982db5dd4602a1b658b2f9d17e48954f3dab9cc
SHA512 4a1ee06ac192b16c59a5d99b0bb5a4ac384835713b97739031e66ff8126d6da8ece704e14ac3254901d7395f0db89d8d85fa94bc312850ff35ce2c0ce8c89378
SSDEEP 3072:kI4YjAFD5nAED/bwxLFICn3KxebShMB8wnOwao5CB5JZOH4F2xPliWkZ/Kw6oGbL:kI4TPD/bQNK44MGwnFN5JY8ZluKw63aI
MD5 SHA1 SHA512 SSDEEP

Submit Download

tdlwbapu.exe

Path C:\Users\Admin\AppData\Local\Temp\tdlwbapu.exe
Size 104KB
SHA256 605eaa9b74466eac15379a2636feba7fdb433fc51fc9b2fd8627895d906c9e51
MD5 91c443cbaca0d1915487d88857dd530f
SHA1 0dfc74636127d2cd4f31c534e9568b95720c112c
SHA512 8d798deb8d9ea5dd34d3450b169616260acf34bec5266452e23dfd08dde46029f100cc4a575affbef938eca62136091c5acee097c693dc8bca2c32d01730f172
SSDEEP 3072:CPoA4ymNHDqv/v9ItBpG+DrmM+vy278tepuv:Mo9ymNHQ/Q7V1
MD5 SHA1 SHA512 SSDEEP

Submit Download

tdlwbapu.exe

Path C:\Users\Admin\AppData\Local\Temp\tdlwbapu.exe
Size 104KB
SHA256 605eaa9b74466eac15379a2636feba7fdb433fc51fc9b2fd8627895d906c9e51
MD5 91c443cbaca0d1915487d88857dd530f
SHA1 0dfc74636127d2cd4f31c534e9568b95720c112c
SHA512 8d798deb8d9ea5dd34d3450b169616260acf34bec5266452e23dfd08dde46029f100cc4a575affbef938eca62136091c5acee097c693dc8bca2c32d01730f172
SSDEEP 3072:CPoA4ymNHDqv/v9ItBpG+DrmM+vy278tepuv:Mo9ymNHQ/Q7V1
MD5 SHA1 SHA512 SSDEEP

Submit Download

tdlwbapu.exe

Path C:\Users\Admin\AppData\Local\Temp\tdlwbapu.exe
Size 104KB
SHA256 605eaa9b74466eac15379a2636feba7fdb433fc51fc9b2fd8627895d906c9e51
MD5 91c443cbaca0d1915487d88857dd530f
SHA1 0dfc74636127d2cd4f31c534e9568b95720c112c
SHA512 8d798deb8d9ea5dd34d3450b169616260acf34bec5266452e23dfd08dde46029f100cc4a575affbef938eca62136091c5acee097c693dc8bca2c32d01730f172
SSDEEP 3072:CPoA4ymNHDqv/v9ItBpG+DrmM+vy278tepuv:Mo9ymNHQ/Q7V1
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path \Users\Admin\AppData\Local\Temp\sqlite3.dll
Size 949KB
SHA256 8cde0275d60da0d11954f73c7c8862cfc4b306f61bb8b1ce14abe4a193af2652
MD5 38a3e021eb32c9976adaf0b3372080fc
SHA1 68e02803c646be21007d90bec841c176b82211fd
SHA512 b886cc112f2750e7300b66f7242850659fa49fdc97f75aed376cb9f5440875f303a143bf8b51068ec42674f1ebe1dfcc40534f3a7aed3cc4d20f9274b9a66d18
SSDEEP 12288:XDEAIY5U9dDfmrw3xnhMRCFxJLjt0+J9G6p1pKfd+8EkzpGtE3RcAx:z9hu9FfmkBnh0CFj2+Jn1pKf3720cAx
MD5 SHA1 SHA512 SSDEEP

Submit Download

tdlwbapu.exe

Path \Users\Admin\AppData\Local\Temp\tdlwbapu.exe
Size 104KB
SHA256 605eaa9b74466eac15379a2636feba7fdb433fc51fc9b2fd8627895d906c9e51
MD5 91c443cbaca0d1915487d88857dd530f
SHA1 0dfc74636127d2cd4f31c534e9568b95720c112c
SHA512 8d798deb8d9ea5dd34d3450b169616260acf34bec5266452e23dfd08dde46029f100cc4a575affbef938eca62136091c5acee097c693dc8bca2c32d01730f172
SSDEEP 3072:CPoA4ymNHDqv/v9ItBpG+DrmM+vy278tepuv:Mo9ymNHQ/Q7V1
MD5 SHA1 SHA512 SSDEEP

Submit Download

tdlwbapu.exe

Path \Users\Admin\AppData\Local\Temp\tdlwbapu.exe
Size 104KB
SHA256 605eaa9b74466eac15379a2636feba7fdb433fc51fc9b2fd8627895d906c9e51
MD5 91c443cbaca0d1915487d88857dd530f
SHA1 0dfc74636127d2cd4f31c534e9568b95720c112c
SHA512 8d798deb8d9ea5dd34d3450b169616260acf34bec5266452e23dfd08dde46029f100cc4a575affbef938eca62136091c5acee097c693dc8bca2c32d01730f172
SSDEEP 3072:CPoA4ymNHDqv/v9ItBpG+DrmM+vy278tepuv:Mo9ymNHQ/Q7V1
MD5 SHA1 SHA512 SSDEEP

Submit Download

tdlwbapu.exe

Path \Users\Admin\AppData\Local\Temp\tdlwbapu.exe
Size 104KB
SHA256 605eaa9b74466eac15379a2636feba7fdb433fc51fc9b2fd8627895d906c9e51
MD5 91c443cbaca0d1915487d88857dd530f
SHA1 0dfc74636127d2cd4f31c534e9568b95720c112c
SHA512 8d798deb8d9ea5dd34d3450b169616260acf34bec5266452e23dfd08dde46029f100cc4a575affbef938eca62136091c5acee097c693dc8bca2c32d01730f172
SSDEEP 3072:CPoA4ymNHDqv/v9ItBpG+DrmM+vy278tepuv:Mo9ymNHQ/Q7V1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/644-74-0x00000000008B0000-0x000000000093F000-memory.dmp

Download

memory/644-73-0x0000000000B30000-0x0000000000E33000-memory.dmp

Download

memory/644-71-0x0000000000F50000-0x0000000000F96000-memory.dmp

Download

memory/644-72-0x0000000000080000-0x00000000000AD000-memory.dmp

Download

memory/1244-69-0x0000000004E80000-0x0000000004F56000-memory.dmp

Download

memory/1244-75-0x00000000064A0000-0x000000000653A000-memory.dmp

Download

memory/1244-77-0x00000000064A0000-0x000000000653A000-memory.dmp

Download

memory/1488-68-0x0000000000110000-0x0000000000120000-memory.dmp

Download

memory/1488-67-0x00000000009A0000-0x0000000000CA3000-memory.dmp

Download

memory/1488-66-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2044-54-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Download