Loading ...

Play interactive tourEdit tour

Analysis Report DHL_Shipment_Notification#5436637389_22_FEB.exe

Overview

General Information

Sample Name:DHL_Shipment_Notification#5436637389_22_FEB.exe
Analysis ID:355962
MD5:6660a5670795be34d107d51a5323a6f3
SHA1:ccfcbc36c22530b58bb6f35707667f658923c9bf
SHA256:6d44a1e98afe47c5a977fd9977f45d173a28a4cbe76f27e2adc5aa702b7ffc75
Tags:GuLoader

Most interesting Screenshot:

Detection

GuLoader
Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected GuLoader
Contains functionality to hide a thread from the debugger
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Hides threads from debuggers
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected VB6 Downloader Generic
Abnormal high CPU Usage
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
PE file contains strange resources
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Startup

  • System is w10x64
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: DHL_Shipment_Notification#5436637389_22_FEB.exe PID: 2092JoeSecurity_VB6DownloaderGenericYara detected VB6 Downloader GenericJoe Security
    Process Memory Space: DHL_Shipment_Notification#5436637389_22_FEB.exe PID: 2092JoeSecurity_GuLoaderYara detected GuLoaderJoe Security

      Sigma Overview

      No Sigma rule has matched

      Signature Overview

      Click to jump to signature section

      Show All Signature Results

      AV Detection:

      barindex
      Multi AV Scanner detection for submitted fileShow sources
      Source: DHL_Shipment_Notification#5436637389_22_FEB.exeReversingLabs: Detection: 14%

      Compliance:

      barindex
      Uses 32bit PE filesShow sources
      Source: DHL_Shipment_Notification#5436637389_22_FEB.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      Source: global trafficTCP traffic: 192.168.2.4:49766 -> 165.22.240.4:443
      Source: unknownDNS traffic detected: queries for: waeorat-71.tk
      Source: DHL_Shipment_Notification#5436637389_22_FEB.exeString found in binary or memory: https://cdn.discordapp.com/attachments/805672355845111821/813267825312661544/nWLXPcDe252.bin
      Source: DHL_Shipment_Notification#5436637389_22_FEB.exe, 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmpString found in binary or memory: https://waeorat-71.tk/admin/nWLXPcDe252.bin
      Source: DHL_Shipment_Notification#5436637389_22_FEB.exe, 00000011.00000002.1159594852.0000000000560000.00000040.00000001.sdmpString found in binary or memory: https://waeorat-71.tk/admin/nWLXPcDe252.binhttps://cdn.discordapp.com/attachments/805672355845111821
      Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeProcess Stats: CPU usage > 98%
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_0056719A NtProtectVirtualMemory,17_2_0056719A
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_00564453 NtSetInformationThread,InternetOpenA,InternetOpenUrlA,Sleep,17_2_00564453
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_0056059C EnumWindows,NtSetInformationThread,17_2_0056059C
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_00562016 NtSetInformationThread,17_2_00562016
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_005610CD NtProtectVirtualMemory,17_2_005610CD
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_005610FD NtProtectVirtualMemory,17_2_005610FD
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_005610E9 NtProtectVirtualMemory,17_2_005610E9
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_005610BD NtProtectVirtualMemory,17_2_005610BD
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_005610AD NtProtectVirtualMemory,17_2_005610AD
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_00560246 NtSetInformationThread,17_2_00560246
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_005655EC NtSetInformationThread,17_2_005655EC
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_00566645 NtSetInformationThread,17_2_00566645
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_0056064D NtSetInformationThread,17_2_0056064D
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_00560607 NtSetInformationThread,17_2_00560607
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_0056062D NtSetInformationThread,17_2_0056062D
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_005606D5 NtSetInformationThread,17_2_005606D5
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_005676CD NtProtectVirtualMemory,17_2_005676CD
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_005606F5 NtSetInformationThread,17_2_005606F5
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_00565693 NtSetInformationThread,17_2_00565693
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_00565745 NtSetInformationThread,17_2_00565745
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_005657EE NtSetInformationThread,17_2_005657EE
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_0056397D NtSetInformationThread,17_2_0056397D
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_00562FED NtSetInformationThread,17_2_00562FED
      Source: DHL_Shipment_Notification#5436637389_22_FEB.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
      Source: DHL_Shipment_Notification#5436637389_22_FEB.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
      Source: DHL_Shipment_Notification#5436637389_22_FEB.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
      Source: DHL_Shipment_Notification#5436637389_22_FEB.exe, 00000000.00000000.636727770.0000000000419000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameWAB.EXE vs DHL_Shipment_Notification#5436637389_22_FEB.exe
      Source: DHL_Shipment_Notification#5436637389_22_FEB.exe, 00000011.00000002.1162732129.000000001DD80000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemswsock.dll.muij% vs DHL_Shipment_Notification#5436637389_22_FEB.exe
      Source: DHL_Shipment_Notification#5436637389_22_FEB.exe, 00000011.00000000.996681854.0000000000419000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameWAB.EXE vs DHL_Shipment_Notification#5436637389_22_FEB.exe
      Source: DHL_Shipment_Notification#5436637389_22_FEB.exeBinary or memory string: OriginalFilenameWAB.EXE vs DHL_Shipment_Notification#5436637389_22_FEB.exe
      Source: DHL_Shipment_Notification#5436637389_22_FEB.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      Source: classification engineClassification label: mal84.troj.evad.winEXE@2/0@1/1
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeFile created: C:\Users\user\AppData\Local\Temp\~DF591F2071FB6AD237.TMPJump to behavior
      Source: DHL_Shipment_Notification#5436637389_22_FEB.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: DHL_Shipment_Notification#5436637389_22_FEB.exeReversingLabs: Detection: 14%
      Source: unknownProcess created: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe 'C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe'
      Source: unknownProcess created: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe 'C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exe'

      Data Obfuscation:

      barindex
      Yara detected GuLoaderShow sources
      Source: Yara matchFile source: Process Memory Space: DHL_Shipment_Notification#5436637389_22_FEB.exe PID: 2092, type: MEMORY
      Yara detected VB6 Downloader GenericShow sources
      Source: Yara matchFile source: Process Memory Space: DHL_Shipment_Notification#5436637389_22_FEB.exe PID: 2092, type: MEMORY
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_0056500E pushfd ; retf 17_2_00565015
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_005651A6 push ss; iretd 17_2_005651A7
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

      Malware Analysis System Evasion:

      barindex
      Detected RDTSC dummy instruction sequence (likely for instruction hammering)Show sources
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeRDTSC instruction interceptor: First address: 0000000000500223 second address: 0000000000500223 instructions:
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeRDTSC instruction interceptor: First address: 00000000005003EA second address: 00000000005003EA instructions:
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeRDTSC instruction interceptor: First address: 000000000050646C second address: 000000000050646C instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FCFFCB33B88h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d add edi, edx 0x0000001f dec dword ptr [ebp+000000F8h] 0x00000025 cmp dword ptr [ebp+000000F8h], 00000000h 0x0000002c jne 00007FCFFCB33B43h 0x0000002e jmp 00007FCFFCB33B92h 0x00000030 cmp ch, 0000003Bh 0x00000033 jmp 00007FCFFCB33B92h 0x00000035 cmp ah, ch 0x00000037 call 00007FCFFCB33BDBh 0x0000003c call 00007FCFFCB33B98h 0x00000041 lfence 0x00000044 mov edx, dword ptr [7FFE0014h] 0x0000004a lfence 0x0000004d ret 0x0000004e mov esi, edx 0x00000050 pushad 0x00000051 rdtsc
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeRDTSC instruction interceptor: First address: 000000000050325D second address: 000000000050325D instructions:
      Tries to detect Any.runShow sources
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exeJump to behavior
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeFile opened: C:\Program Files\qga\qga.exeJump to behavior
      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
      Source: DHL_Shipment_Notification#5436637389_22_FEB.exeBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
      Tries to detect virtualization through RDTSC time measurementsShow sources
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeRDTSC instruction interceptor: First address: 0000000000500223 second address: 0000000000500223 instructions:
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeRDTSC instruction interceptor: First address: 00000000005003EA second address: 00000000005003EA instructions:
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeRDTSC instruction interceptor: First address: 000000000050646C second address: 000000000050646C instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FCFFCB33B88h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d add edi, edx 0x0000001f dec dword ptr [ebp+000000F8h] 0x00000025 cmp dword ptr [ebp+000000F8h], 00000000h 0x0000002c jne 00007FCFFCB33B43h 0x0000002e jmp 00007FCFFCB33B92h 0x00000030 cmp ch, 0000003Bh 0x00000033 jmp 00007FCFFCB33B92h 0x00000035 cmp ah, ch 0x00000037 call 00007FCFFCB33BDBh 0x0000003c call 00007FCFFCB33B98h 0x00000041 lfence 0x00000044 mov edx, dword ptr [7FFE0014h] 0x0000004a lfence 0x0000004d ret 0x0000004e mov esi, edx 0x00000050 pushad 0x00000051 rdtsc
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeRDTSC instruction interceptor: First address: 000000000050648C second address: 000000000050648C instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007FCFFCB366EDh 0x0000001d popad 0x0000001e call 00007FCFFCB3617Dh 0x00000023 lfence 0x00000026 rdtsc
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeRDTSC instruction interceptor: First address: 000000000050325D second address: 000000000050325D instructions:
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeRDTSC instruction interceptor: First address: 000000000056648C second address: 000000000056648C instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007FCFFCB366EDh 0x0000001d popad 0x0000001e call 00007FCFFCB3617Dh 0x00000023 lfence 0x00000026 rdtsc
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_00564453 rdtsc 17_2_00564453
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeLast function: Thread delayed
      Source: DHL_Shipment_Notification#5436637389_22_FEB.exeBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

      Anti Debugging:

      barindex
      Contains functionality to hide a thread from the debuggerShow sources
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_00564453 NtSetInformationThread 000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,?,?17_2_00564453
      Hides threads from debuggersShow sources
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeThread information set: HideFromDebuggerJump to behavior
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeProcess queried: DebugPortJump to behavior
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_00564453 rdtsc 17_2_00564453
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_00564229 LdrInitializeThunk,17_2_00564229
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_00562016 mov eax, dword ptr fs:[00000030h]17_2_00562016
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_005626D3 mov eax, dword ptr fs:[00000030h]17_2_005626D3
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_0056268A mov eax, dword ptr fs:[00000030h]17_2_0056268A
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_0056583A mov eax, dword ptr fs:[00000030h]17_2_0056583A
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_0056295A mov eax, dword ptr fs:[00000030h]17_2_0056295A
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_00563958 mov eax, dword ptr fs:[00000030h]17_2_00563958
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_0056298D mov eax, dword ptr fs:[00000030h]17_2_0056298D
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_005629AD mov eax, dword ptr fs:[00000030h]17_2_005629AD
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_00566B77 mov eax, dword ptr fs:[00000030h]17_2_00566B77
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_00565FF1 mov eax, dword ptr fs:[00000030h]17_2_00565FF1
      Source: DHL_Shipment_Notification#5436637389_22_FEB.exe, 00000011.00000002.1159756548.0000000000E60000.00000002.00000001.sdmpBinary or memory string: Program Manager
      Source: DHL_Shipment_Notification#5436637389_22_FEB.exe, 00000011.00000002.1159756548.0000000000E60000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
      Source: DHL_Shipment_Notification#5436637389_22_FEB.exe, 00000011.00000002.1159756548.0000000000E60000.00000002.00000001.sdmpBinary or memory string: Progman
      Source: DHL_Shipment_Notification#5436637389_22_FEB.exe, 00000011.00000002.1159756548.0000000000E60000.00000002.00000001.sdmpBinary or memory string: Progmanlock
      Source: C:\Users\user\Desktop\DHL_Shipment_Notification#5436637389_22_FEB.exeCode function: 17_2_00566055 cpuid 17_2_00566055

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection2Virtualization/Sandbox Evasion21OS Credential DumpingSecurity Software Discovery621Remote ServicesData from Local SystemExfiltration Over Other Network MediumEncrypted Channel2Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsProcess Injection2LSASS MemoryVirtualization/Sandbox Evasion21Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothNon-Application Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information1Security Account ManagerProcess Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationApplication Layer Protocol2Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Information Discovery211Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA SecretsRemote System Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings

      Behavior Graph

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.