Edit tour

Windows Analysis Report
DHL Shipping documents 0020398484995500.exe

Overview

General Information

Sample name:	DHL Shipping documents 0020398484995500.exe
Analysis ID:	1523785
MD5:	1506261e1a6e12c9eadfcbe91a859f76
SHA1:	061aa09172c0daef3fc975919a02413ab3a6f01e
SHA256:	0dc8ced22931e20ec965bc36c06a974016fe223434d9553007b4a6c04973b2cb
Tags:	DHLDHLIndonesiaexeuser-ngokoptmp
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

.NET source code contains potential unpacker

AI detected suspicious sample

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

DHL Shipping documents 0020398484995500.exe (PID: 5016 cmdline: "C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe" MD5: 1506261E1A6E12C9EADFCBE91A859F76)

DHL Shipping documents 0020398484995500.exe (PID: 6380 cmdline: "C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe" MD5: 1506261E1A6E12C9EADFCBE91A859F76)

DHL Shipping documents 0020398484995500.exe (PID: 6396 cmdline: "C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe" MD5: 1506261E1A6E12C9EADFCBE91A859F76)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.concaribe.com", "Username": "testi@concaribe.com", "Password": "ro}UWgz#!38E"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.4517263503.0000000002EBC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.4517263503.0000000002E91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.4517263503.0000000002E91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.4513145018.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.4513145018.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2050716658.0000000003FD9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2050716658.0000000003FD9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: DHL Shipping documents 0020398484995500.exe PID: 5016	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DHL Shipping documents 0020398484995500.exe PID: 5016	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: DHL Shipping documents 0020398484995500.exe PID: 6396	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DHL Shipping documents 0020398484995500.exe PID: 6396	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.DHL Shipping documents 0020398484995500.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.DHL Shipping documents 0020398484995500.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.DHL Shipping documents 0020398484995500.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33afd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33b6f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33bf9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33c8b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33cf5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33d67:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33dfd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33e8d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.DHL Shipping documents 0020398484995500.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x30e3d:$s2: GetPrivateProfileString 0x30540:$s3: get_OSFullName 0x31c11:$s5: remove_Key 0x31dd9:$s5: remove_Key 0x32d01:$s6: FtpWebRequest 0x33adf:$s7: logins 0x34051:$s7: logins 0x36d62:$s7: logins 0x36e14:$s7: logins 0x38766:$s7: logins 0x379ae:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x1269cd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1619fd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x19c81d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x126a3f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x161a6f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x19c88f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x126ac9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x161af9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x19c919:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x126b5b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x161b8b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x19c9ab:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x126bc5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x161bf5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x19ca15:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x126c37:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x161c67:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x19ca87:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x126ccd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x161cfd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x19cb1d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x123d0d:$s2: GetPrivateProfileString 0x15ed3d:$s2: GetPrivateProfileString 0x199b5d:$s2: GetPrivateProfileString 0x123410:$s3: get_OSFullName 0x15e440:$s3: get_OSFullName 0x199260:$s3: get_OSFullName 0x124ae1:$s5: remove_Key 0x124ca9:$s5: remove_Key 0x15fb11:$s5: remove_Key 0x15fcd9:$s5: remove_Key 0x19a931:$s5: remove_Key 0x19aaf9:$s5: remove_Key 0x125bd1:$s6: FtpWebRequest 0x160c01:$s6: FtpWebRequest 0x19ba21:$s6: FtpWebRequest 0x1269af:$s7: logins 0x126f21:$s7: logins 0x129c32:$s7: logins 0x129ce4:$s7: logins 0x12b636:$s7: logins 0x1619df:$s7: logins
0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x1683fd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1a342d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1de24d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16846f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1a349f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1de2bf:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1684f9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1a3529:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1de349:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16858b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1a35bb:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1de3db:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1685f5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x1a3625:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x1de445:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x168667:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x1a3697:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x1de4b7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x1686fd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x1a372d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x1de54d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x16573d:$s2: GetPrivateProfileString 0x1a076d:$s2: GetPrivateProfileString 0x1db58d:$s2: GetPrivateProfileString 0x164e40:$s3: get_OSFullName 0x19fe70:$s3: get_OSFullName 0x1dac90:$s3: get_OSFullName 0x166511:$s5: remove_Key 0x1666d9:$s5: remove_Key 0x1a1541:$s5: remove_Key 0x1a1709:$s5: remove_Key 0x1dc361:$s5: remove_Key 0x1dc529:$s5: remove_Key 0x167601:$s6: FtpWebRequest 0x1a2631:$s6: FtpWebRequest 0x1dd451:$s6: FtpWebRequest 0x1683df:$s7: logins 0x168951:$s7: logins 0x16b662:$s7: logins 0x16b714:$s7: logins 0x16d066:$s7: logins 0x1a340f:$s7: logins
Click to see the 7 entries

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: DHL Shipping documents 0020398484995500.exe

Avira: detected

Found malware configuration

Source: 3.2.DHL Shipping documents 0020398484995500.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.concaribe.com", "Username": "testi@concaribe.com", "Password": "ro}UWgz#!38E"}

Multi AV Scanner detection for domain / URL

Source: ftp.concaribe.com	Virustotal: Detection: 6%			Perma Link
Source: http://ftp.concaribe.com	Virustotal: Detection: 6%			Perma Link

Multi AV Scanner detection for submitted file

Source: DHL Shipping documents 0020398484995500.exe	ReversingLabs: Detection: 34%
Source: DHL Shipping documents 0020398484995500.exe	Virustotal: Detection: 40%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: DHL Shipping documents 0020398484995500.exe

Joe Sandbox ML: detected

Source: DHL Shipping documents 0020398484995500.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49706 version: TLS 1.2

Source: DHL Shipping documents 0020398484995500.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 192.185.13.234 192.185.13.234

Source: Joe Sandbox View

ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ftp.concaribe.com

Source: DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4517263503.0000000002EBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://concaribe.com
Source: DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4517263503.0000000002EBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.concaribe.com
Source: DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4517263503.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: DHL Shipping documents 0020398484995500.exe, 00000000.00000002.2050716658.0000000003FD9000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4513145018.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: DHL Shipping documents 0020398484995500.exe, 00000000.00000002.2050716658.0000000003FD9000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4517263503.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4513145018.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4517263503.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4517263503.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: DHL Shipping documents 0020398484995500.exe	String found in binary or memory: https://github.com/dnSpy/dnSpy/wiki/Debugging-Unity-Games

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49706 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.DHL Shipping documents 0020398484995500.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.DHL Shipping documents 0020398484995500.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: DHL Shipping documents 0020398484995500.exe

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 0_2_0149E00C	0_2_0149E00C
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_00FDA228	3_2_00FDA228
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_00FDE770	3_2_00FDE770
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_00FDAAB0	3_2_00FDAAB0
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_00FD4A58	3_2_00FD4A58
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_00FD3E40	3_2_00FD3E40
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_00FD4188	3_2_00FD4188
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A7A8B4	3_2_06A7A8B4
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A7A598	3_2_06A7A598
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A7BDF0	3_2_06A7BDF0
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A7DBF0	3_2_06A7DBF0
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A956A0	3_2_06A956A0
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A966C0	3_2_06A966C0
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A9C240	3_2_06A9C240
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A92380	3_2_06A92380
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A9B300	3_2_06A9B300
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A97E40	3_2_06A97E40
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A97760	3_2_06A97760
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A9E468	3_2_06A9E468
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A90040	3_2_06A90040
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A95DC8	3_2_06A95DC8
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A90006	3_2_06A90006

Source: DHL Shipping documents 0020398484995500.exe, 00000000.00000002.2050716658.0000000003FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSoftwareGame.dll: vs DHL Shipping documents 0020398484995500.exe
Source: DHL Shipping documents 0020398484995500.exe, 00000000.00000002.2050716658.0000000003FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb6643012-12fd-45a5-9ab2-ac7e7ee5488b.exe4 vs DHL Shipping documents 0020398484995500.exe
Source: DHL Shipping documents 0020398484995500.exe, 00000000.00000002.2049391209.000000000116E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs DHL Shipping documents 0020398484995500.exe
Source: DHL Shipping documents 0020398484995500.exe, 00000000.00000002.2050654227.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb6643012-12fd-45a5-9ab2-ac7e7ee5488b.exe4 vs DHL Shipping documents 0020398484995500.exe
Source: DHL Shipping documents 0020398484995500.exe, 00000000.00000000.2044424346.0000000000BB2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamepoiliu.exe. vs DHL Shipping documents 0020398484995500.exe
Source: DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4513950685.0000000000EF8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs DHL Shipping documents 0020398484995500.exe
Source: DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4513145018.000000000043E000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb6643012-12fd-45a5-9ab2-ac7e7ee5488b.exe4 vs DHL Shipping documents 0020398484995500.exe
Source: DHL Shipping documents 0020398484995500.exe	Binary or memory string: OriginalFilenamepoiliu.exe. vs DHL Shipping documents 0020398484995500.exe

Source: DHL Shipping documents 0020398484995500.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 3.2.DHL Shipping documents 0020398484995500.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.DHL Shipping documents 0020398484995500.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: DHL Shipping documents 0020398484995500.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack, Form1.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack, Form1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack, Form1.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack, Form1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL Shipping documents 0020398484995500.exe.57d0000.2.raw.unpack, Form1.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.DHL Shipping documents 0020398484995500.exe.57d0000.2.raw.unpack, Form1.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/0@2/2

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

Mutant created: NULL

Source: DHL Shipping documents 0020398484995500.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: DHL Shipping documents 0020398484995500.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: DHL Shipping documents 0020398484995500.exe	ReversingLabs: Detection: 34%
Source: DHL Shipping documents 0020398484995500.exe	Virustotal: Detection: 40%

Source: unknown	Process created: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe "C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe"
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process created: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe "C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe"
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process created: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe "C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe"
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process created: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe "C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process created: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe "C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe"	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: DHL Shipping documents 0020398484995500.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: DHL Shipping documents 0020398484995500.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: DHL Shipping documents 0020398484995500.exe, RandomGenerator.cs	.Net Code: Polan System.AppDomain.Load(byte[])
Source: DHL Shipping documents 0020398484995500.exe, MonoTypeLoaderImpl.cs	.Net Code: Load
Source: DHL Shipping documents 0020398484995500.exe, DbgMonoDebugInternalRuntimeImpl.cs	.Net Code: CreateInstance
Source: DHL Shipping documents 0020398484995500.exe, DbgMonoDebugInternalRuntimeImpl.cs	.Net Code: CreateInstanceNoConstructor
Source: DHL Shipping documents 0020398484995500.exe, DbgMonoDebugInternalRuntimeImpl.cs	.Net Code: CreateSZArrayCore
Source: DHL Shipping documents 0020398484995500.exe, DbgMonoDebugInternalRuntimeImpl.cs	.Net Code: CreateArrayCore

Source: DHL Shipping documents 0020398484995500.exe

Static PE information: 0xEB230CD7 [Tue Jan 4 01:26:47 2095 UTC]

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A7FEF0 push es; ret		3_2_06A7FEF4
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A73FB7 push 2406B7DAh; retf		3_2_06A73FD5

Source: DHL Shipping documents 0020398484995500.exe

Static PE information: section name: .text entropy: 7.455106876960115

Source: 0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack, Form1.cs	High entropy of concatenated method names: 'oxycobaltammine', 'fringier', 'unchorded', 'wAhRr7CKv', 'Dispose', 'lVOGV1721', 'ULHqFVpPeqZbNsBNpV', 'TchE2TMnA4CKf52ZUf', 'f0mq9hQrUpsqOwSyGd', 'nTd0Zl0tx6BYOWEqZW'
Source: 0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack, QJDLGErGwGLnDsDTGnUfx.cs	High entropy of concatenated method names: 'pwiMsJJwOLAUrsrsiLrJk', 'vkJkyBAyMrJJZpZnJUUsB', 'pBDTEixOwwhDhOiywipLh', 'wZnEyxixGJZZTGvwQsrMDAvGiTwBJLT', 'erhT', 'aerhTteS46w', 'LvfQyBLvviAnvZJBUkfipTGCDTvQDxU', 'F6WFViyxW', 'TE3wDwuNS', 'MyGetProcAddressWrapper'
Source: 0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack, Form1.cs	High entropy of concatenated method names: 'oxycobaltammine', 'fringier', 'unchorded', 'wAhRr7CKv', 'Dispose', 'lVOGV1721', 'ULHqFVpPeqZbNsBNpV', 'TchE2TMnA4CKf52ZUf', 'f0mq9hQrUpsqOwSyGd', 'nTd0Zl0tx6BYOWEqZW'
Source: 0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack, QJDLGErGwGLnDsDTGnUfx.cs	High entropy of concatenated method names: 'pwiMsJJwOLAUrsrsiLrJk', 'vkJkyBAyMrJJZpZnJUUsB', 'pBDTEixOwwhDhOiywipLh', 'wZnEyxixGJZZTGvwQsrMDAvGiTwBJLT', 'erhT', 'aerhTteS46w', 'LvfQyBLvviAnvZJBUkfipTGCDTvQDxU', 'F6WFViyxW', 'TE3wDwuNS', 'MyGetProcAddressWrapper'
Source: 0.2.DHL Shipping documents 0020398484995500.exe.57d0000.2.raw.unpack, Form1.cs	High entropy of concatenated method names: 'oxycobaltammine', 'fringier', 'unchorded', 'wAhRr7CKv', 'Dispose', 'lVOGV1721', 'ULHqFVpPeqZbNsBNpV', 'TchE2TMnA4CKf52ZUf', 'f0mq9hQrUpsqOwSyGd', 'nTd0Zl0tx6BYOWEqZW'
Source: 0.2.DHL Shipping documents 0020398484995500.exe.57d0000.2.raw.unpack, QJDLGErGwGLnDsDTGnUfx.cs	High entropy of concatenated method names: 'pwiMsJJwOLAUrsrsiLrJk', 'vkJkyBAyMrJJZpZnJUUsB', 'pBDTEixOwwhDhOiywipLh', 'wZnEyxixGJZZTGvwQsrMDAvGiTwBJLT', 'erhT', 'aerhTteS46w', 'LvfQyBLvviAnvZJBUkfipTGCDTvQDxU', 'F6WFViyxW', 'TE3wDwuNS', 'MyGetProcAddressWrapper'

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Memory allocated: 1490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Memory allocated: 2FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Memory allocated: 4FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Memory allocated: FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Memory allocated: 2E40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Memory allocated: 13B0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599777	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598058	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597947	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597835	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597718	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597609	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597500	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597390	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597281	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597172	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597062	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596843	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596515	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595968	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595526	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595093	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 594874	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 594765	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 594547	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 594437	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Window / User API: threadDelayed 2108			Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Window / User API: threadDelayed 7747			Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 940	Thread sleep count: 2108 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 940	Thread sleep count: 7747 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -599777s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -598796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -598468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -598250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -598058s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -597947s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -597835s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -597718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -597609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -597500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -597390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -597281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -597172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -597062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -596953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -596843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -596734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -596625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -596515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -596406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -596297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -596187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -596078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -595968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -595859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -595750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -595640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -595526s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -595422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -595312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -595203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -595093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -594984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -594874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -594765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -594656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -594547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -594437s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599777	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598058	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597947	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597835	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597718	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597609	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597500	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597390	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597281	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597172	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597062	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596843	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596515	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595968	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595526	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595093	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 594874	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 594765	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 594547	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 594437	Jump to behavior

Source: DHL Shipping documents 0020398484995500.exe	Binary or memory string: ResumeVirtualMachine
Source: DHL Shipping documents 0020398484995500.exe	Binary or memory string: InitializeVirtualMachine
Source: DHL Shipping documents 0020398484995500.exe	Binary or memory string: get_VirtualMachine
Source: DHL Shipping documents 0020398484995500.exe	Binary or memory string: get_MonoVirtualMachine
Source: DHL Shipping documents 0020398484995500.exe	Binary or memory string: VirtualMachineManager
Source: DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4515719034.00000000010AC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process created: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe "C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe"			Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process created: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe "C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe"			Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Queries volume information: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Queries volume information: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 3.2.DHL Shipping documents 0020398484995500.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4517263503.0000000002EBC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4517263503.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4513145018.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2050716658.0000000003FD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL Shipping documents 0020398484995500.exe PID: 5016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL Shipping documents 0020398484995500.exe PID: 6396, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 3.2.DHL Shipping documents 0020398484995500.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4517263503.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4513145018.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2050716658.0000000003FD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL Shipping documents 0020398484995500.exe PID: 5016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL Shipping documents 0020398484995500.exe PID: 6396, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 3.2.DHL Shipping documents 0020398484995500.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4517263503.0000000002EBC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4517263503.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4513145018.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2050716658.0000000003FD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL Shipping documents 0020398484995500.exe PID: 5016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL Shipping documents 0020398484995500.exe PID: 6396, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Disable or Modify Tools	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	1 Credentials in Registry	111 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	2 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	24 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
DHL Shipping documents 0020398484995500.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DHL Shipping documents 0020398484995500.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
DHL Shipping documents 0020398484995500.exe