ef911d4f6162d25b42b36bd71b99dd256565a68410c707ee29c40a01f3797036 | Triage

Submit
Reports

Overview

overview

Static

static

3

DHL PACKAGE - PDF.exe

windows7-x64

DHL PACKAGE - PDF.exe

windows10-2004-x64

$APPDATA/f...60.dll

windows7-x64

1

$APPDATA/f...60.dll

windows10-2004-x64

1

$APPDATA/f...xy.exe

windows7-x64

3

$APPDATA/f...xy.exe

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$TEMP/2006...60.dll

windows7-x64

1

$TEMP/2006...60.dll

windows10-2004-x64

1

$TEMP/Situ...le.dll

windows7-x64

3

$TEMP/Situ...le.dll

windows10-2004-x64

$TEMP/mode...ap.dll

windows7-x64

3

$TEMP/mode...ap.dll

windows10-2004-x64

3

$TEMP/mode...UI.dll

windows7-x64

1

$TEMP/mode...UI.dll

windows10-2004-x64

1

$TEMP/mode...UI.dll

windows7-x64

1

$TEMP/mode...UI.dll

windows10-2004-x64

1

$TEMP/mode...lc.exe

windows7-x64

3

$TEMP/mode...lc.exe

windows10-2004-x64

3

$TEMP/mode...or.dll

windows7-x64

3

$TEMP/mode...or.dll

windows10-2004-x64

3

Analysis

max time kernel
93s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09-09-2024 00:12

Sharing

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

DHL PACKAGE - PDF.exe

Resource

win7-20240903-en

formbook c232 discovery rat spyware stealer trojan

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

DHL PACKAGE - PDF.exe

Resource

win10v2004-20240802-en

formbook c232 credential_access discovery persistence rat spyware stealer trojan

windows10-2004-x64

17 signatures

150 seconds

Behavioral task

behavioral3

Sample

$APPDATA/for/page_1/13.opends60.dll

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral4

Sample

$APPDATA/for/page_1/13.opends60.dll

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral5

Sample

$APPDATA/for/page_1/MicrosoftXslDebugProxy.exe

Resource

win7-20240708-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral6

Sample

$APPDATA/for/page_1/MicrosoftXslDebugProxy.exe

Resource

win10v2004-20240802-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral7

Sample

$PLUGINSDIR/System.dll

Resource

win7-20240903-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral8

Sample

$PLUGINSDIR/System.dll

Resource

win10v2004-20240802-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral9

Sample

$PLUGINSDIR/nsDialogs.dll

Resource

win7-20240704-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral10

Sample

$PLUGINSDIR/nsDialogs.dll

Resource

win10v2004-20240802-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral11

Sample

$TEMP/2006/35.opends60.dll

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

$TEMP/2006/35.opends60.dll

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

$TEMP/SitulaCystocele.dll

Resource

win7-20240708-en

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral14

Sample

$TEMP/SitulaCystocele.dll

Resource

win10v2004-20240802-en

formbook c232 credential_access discovery persistence rat spyware stealer trojan

windows10-2004-x64

14 signatures

150 seconds

Behavioral task

behavioral15

Sample

$TEMP/mode/Thumbs.db/intern/ActiveSyncBootstrap.dll

Resource

win7-20240903-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral16

Sample

$TEMP/mode/Thumbs.db/intern/ActiveSyncBootstrap.dll

Resource

win10v2004-20240802-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral17

Sample

$TEMP/mode/Thumbs.db/intern/MicrosoftVisualStudioUI.dll

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral18

Sample

$TEMP/mode/Thumbs.db/intern/MicrosoftVisualStudioUI.dll

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral19

Sample

$TEMP/mode/Thumbs.db/intern/NatDbgDEUI.dll

Resource

win7-20240704-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral20

Sample

$TEMP/mode/Thumbs.db/intern/NatDbgDEUI.dll

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral21

Sample

$TEMP/mode/Thumbs.db/intern/PermCalc.exe

Resource

win7-20240903-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral22

Sample

$TEMP/mode/Thumbs.db/intern/PermCalc.exe

Resource

win10v2004-20240802-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral23

Sample

$TEMP/mode/Thumbs.db/intern/Vsa7Director.dll

Resource

win7-20240708-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral24

Sample

$TEMP/mode/Thumbs.db/intern/Vsa7Director.dll

Resource

win10v2004-20240802-en

windows10-2004-x64

3 signatures

150 seconds

Report Analysis Logs

General

Target

$APPDATA/for/page_1/13.opends60.dll
Size

51B
MD5

f04aa19e6a25638e61867d3495058e79
SHA1

f06f9e02611cdd1cf3d960897c262f528d2bfc32
SHA256

e3d2cfcd73d4f98f610173031b36e4ef77771c50bdb3ec3c8b4f2734b52a73c3
SHA512

7037e51cc7e02be051e16c70ac65c10a6943640a92e91860550f3115220fb2ff78340427a4c796b411dccd803eaafc6fd5cf179432d206445fc819bd2f3df667

Score

1^/10

Malware Config

Signatures

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\for\page_1\13.opends60.dll,#1
1⤵
PID:4452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

© 2018-2025

Terms | Privacy