Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-05-2024 18:07

General

  • Target

    dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe

  • Size

    652KB

  • MD5

    3783014e89435e8f979155435933d4f0

  • SHA1

    c711fb0d97d5d363e241ed5532c6331e0fe8aa57

  • SHA256

    a7a04842ca3e817e5ae28cf389f590ba2a4f76c63e25249419bad63277b7312f

  • SHA512

    611452baa7692ffd4a5f3fb73d60a0e1b4ecc8a77d1d94021c87e369909c8d9d583c5e2ae575fd7ebb95b5a3e70fb670fa4d97a4594644b74d1bb1adc9c75010

  • SSDEEP

    12288:NgeDYSnG4nSUWbjU0WHUMTJRewXLvWkgTkVj:tDYSnG4n2bjmHUMhvKI

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 7 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
    "C:\Users\Admin\AppData\Local\Temp\dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:3608
    • C:\Users\Admin\AppData\Local\Temp\dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
      "C:\Users\Admin\AppData\Local\Temp\dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2952
      • C:\Users\Admin\AppData\Local\Temp\dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
        C:\Users\Admin\AppData\Local\Temp\dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe /stext "C:\Users\Admin\AppData\Local\Temp\viisaiosdpftborhk"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4212
      • C:\Users\Admin\AppData\Local\Temp\dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
        C:\Users\Admin\AppData\Local\Temp\dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe /stext "C:\Users\Admin\AppData\Local\Temp\flvlbszlrxxymvnttoiro"
        3⤵
        • Accesses Microsoft Outlook accounts
        PID:4584
      • C:\Users\Admin\AppData\Local\Temp\dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
        C:\Users\Admin\AppData\Local\Temp\dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe /stext "C:\Users\Admin\AppData\Local\Temp\hfadulknffpcobcxczctzdbv"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:628

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsz6C77.tmp\System.dll

    Filesize

    11KB

    MD5

    fc3772787eb239ef4d0399680dcc4343

    SHA1

    db2fa99ec967178cd8057a14a428a8439a961a73

    SHA256

    9b93c61c9d63ef8ec80892cc0e4a0877966dca9b0c3eb85555cebd2ddf4d6eed

    SHA512

    79e491ca4591a5da70116114b7fbb66ee15a0532386035e980c9dfe7afb59b1f9d9c758891e25bfb45c36b07afd3e171bac37a86c887387ef0e80b1eaf296c89

  • C:\Users\Admin\AppData\Local\Temp\viisaiosdpftborhk

    Filesize

    4KB

    MD5

    73ddf6cd83c2ad8a2fbb2383e322ffbc

    SHA1

    05270f8bb7b5cc6ab9a61ae7453d047379089147

    SHA256

    0ef9194c6e90b23c416316fc5a15f549ee5b2472014fcd7648d72ca9a865b409

    SHA512

    714db1956faa795005b15324b9604105881d6b484fe899876fe0df85783c61a72f556a875833af8625625212503b95eea2eb353a1d98f6a7af47a3658ea5262d

  • C:\Users\Admin\Pictures\belejrernes.lnk

    Filesize

    1KB

    MD5

    d198743e1f9c150aa9c4ca4d77651cf8

    SHA1

    319fffd55bd06999712b8b2aca83e5c5dac0c080

    SHA256

    09ea038f2a9171f785e715dc1417eadbba925ca6a86fa23163a162236b6a4953

    SHA512

    804dbc29ba3dcb7ca5827c030dedc3de3a2df9fb71f3415ae19004c79c9e148f9e30a52531333650041729037e57e3b7d7d8bbae60448cd628d8791824841089

  • memory/628-399-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/628-397-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/628-390-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/628-394-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/628-396-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/2952-345-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-322-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-301-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-302-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-298-0x0000000001710000-0x0000000006F6F000-memory.dmp

    Filesize

    88.4MB

  • memory/2952-303-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-304-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-305-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-306-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-307-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-310-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-311-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-312-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-313-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-314-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-349-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-316-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-318-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-319-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-320-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-321-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-348-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-323-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-324-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-325-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-326-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-327-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-328-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-329-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-330-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-331-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-347-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-333-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-334-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-335-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-336-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-337-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-339-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-341-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-342-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-343-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-344-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-299-0x00000000004E4000-0x00000000004E5000-memory.dmp

    Filesize

    4KB

  • memory/2952-346-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-332-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-300-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-315-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-352-0x0000000077941000-0x0000000077A61000-memory.dmp

    Filesize

    1.1MB

  • memory/2952-355-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-356-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-357-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-358-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-359-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-360-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-361-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-362-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-363-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-364-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-365-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-366-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-367-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-368-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-369-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-370-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-371-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-372-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-373-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-374-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-375-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-376-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-377-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-378-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-379-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-380-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-381-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/2952-413-0x0000000007260000-0x0000000007279000-memory.dmp

    Filesize

    100KB

  • memory/2952-412-0x0000000007260000-0x0000000007279000-memory.dmp

    Filesize

    100KB

  • memory/2952-292-0x00000000779C8000-0x00000000779C9000-memory.dmp

    Filesize

    4KB

  • memory/2952-297-0x0000000077941000-0x0000000077A61000-memory.dmp

    Filesize

    1.1MB

  • memory/2952-409-0x0000000007260000-0x0000000007279000-memory.dmp

    Filesize

    100KB

  • memory/2952-293-0x0000000077941000-0x0000000077A61000-memory.dmp

    Filesize

    1.1MB

  • memory/2952-295-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/3608-291-0x0000000010004000-0x0000000010005000-memory.dmp

    Filesize

    4KB

  • memory/3608-290-0x0000000077941000-0x0000000077A61000-memory.dmp

    Filesize

    1.1MB

  • memory/4212-393-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/4212-391-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/4212-406-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/4212-386-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/4584-395-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/4584-392-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/4584-398-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/4584-387-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB