Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
21/07/2023, 06:40
General
-
Target
DHL_docs_inv_bl_waybill_2107202300000000000000_XL.exe
-
Size
300KB
-
MD5
8ab22cb821633ca1f488566adfa99715
-
SHA1
8421b2a9840ecaab1077287cbdc3c240be247cf5
-
SHA256
a444429e646f262a1380c2ec47c7459010b36f1ded2174026584d43070974da7
-
SHA512
a7d973b1f68698b7268d349a882e826f2bfd4e04e50e829919695b2521690fef02708f1f0c6d0d10d2fbd336c0faa0f3e0e68aabfb8559ecbf5b6cf70ab4d220
-
SSDEEP
6144:/Ya6YTWv5u8VY53iik0OF3oC07bbOJmaCddxirbqR+v8nJzqlCCR:/YuUVYFk0OF3ovfCJknireR+02R
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL_docs_inv_bl_waybill_2107202300000000000000_XL.exe"C:\Users\Admin\AppData\Local\Temp\DHL_docs_inv_bl_waybill_2107202300000000000000_XL.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL_docs_inv_bl_waybill_2107202300000000000000_XL.exe"C:\Users\Admin\AppData\Local\Temp\DHL_docs_inv_bl_waybill_2107202300000000000000_XL.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5f575acfcbf6b3c30939678812dc954ee
SHA1d497137c6633db14b0090220e5600bda11a3f3a1
SHA2564b51766f9360222f06f0ed3dad473c9d59307c4d792d96ffc179c02824931f85
SHA512a2803dc8b2ec5cb03a3703e30548909ecab17a984874633439ed54dbfadcc04ea355cb33d24db24970c429690e937229c412993c73b3f1af28f8d8284be125ff
-
Filesize
1024KB
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
408KB
-
Filesize
320KB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB