Windows Analysis Report DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

ID:	1360
Product:	CloudBasic
Start time:	12:51:29
Start date:	27.09.2021
Sample:	DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Architecture:	WINDOWS
MD5:	8e2b177d2ab29c95f067559a029cf5e8
SHA1:	f347fa229d51836344ab5bf89fa531e19aa5e324
SHA256:	b9fdde7d748e27a130c509a589a2c8b92aad279604d3e4ee7ac28187fc5660be
Filetype:	Win32 Executable (generic) a (10002005/4) 99.15%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Temp\LABERT\Cirkusforestillinger.exe	data	DA500D43204B3E3DFEA43798760ED75D	206EE6A976EC8582810DB1EF8C6ED81599F24355	7B5C4219B3D03A3F8FF154FBAE97DA72A5E640AE13E7A414B2746804DBF2B8F8

AV Detection:

Multi AV Scanner detection for submitted file

Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Virustotal: Detection: 31%			Perma Link
Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	ReversingLabs: Detection: 17%

Antivirus / Scanner detection for submitted sample

Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Avira: detected

Compliance:

Uses 32bit PE files

Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic

Snort IDS: 2018752 ET TROJAN Generic .bin download from Dotted Quad 192.168.11.20:49806 -> 178.32.63.50:80

Uses dynamic DNS services

Source: unknown

DNS query: name: septnet.duckdns.org

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: TELIANETTeliaCarrierEU TELIANETTeliaCarrierEU
Source: Joe Sandbox View	ASN Name: OVHFR OVHFR

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /moss/Host_AKhLBP62.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: 178.32.63.50Cache-Control: no-cache

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.11.20:49807 -> 193.104.197.28:6577

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50
Source: unknown	TCP traffic detected without corresponding DNS query: 178.32.63.50

URLs found in memory or binary data

Source: ieinstal.exe, 00000006.00000002.318237428388.00000000035C0000.00000004.00000001.sdmp	String found in binary or memory: http://178.32.63.50/boss/Host_AKhLBP62.bin
Source: ieinstal.exe, 00000006.00000002.318237428388.00000000035C0000.00000004.00000001.sdmp	String found in binary or memory: http://178.32.63.50/moss/Host_AKhLBP62.bin
Source: ieinstal.exe, 00000006.00000002.318237025480.0000000003229000.00000004.00000020.sdmp	String found in binary or memory: http://178.32.63.50/moss/Host_AKhLBP62.bin:
Source: ieinstal.exe, 00000006.00000002.318237025480.0000000003229000.00000004.00000020.sdmp	String found in binary or memory: http://178.32.63.50/moss/Host_AKhLBP62.binF
Source: ieinstal.exe, 00000006.00000002.318237428388.00000000035C0000.00000004.00000001.sdmp	String found in binary or memory: http://178.32.63.50/moss/Host_AKhLBP62.binhttp://178.32.63.50/boss/Host_AKhLBP62.binwininet.dllMozil

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: septnet.duckdns.org

Downloads files from webservers via HTTP

Source: global traffic

HTTP traffic detected: GET /moss/Host_AKhLBP62.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: 178.32.63.50Cache-Control: no-cache

System Summary:

Potential malicious icon found

Source: initial sample

Icon embedded in PE file: bad icon match: 20047c7c70f0e004

Uses 32bit PE files

Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Detected potential crypto function

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_00403DD6		2_2_00403DD6
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_0040415B		2_2_0040415B
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_023018E5		2_2_023018E5
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_0230C119		2_2_0230C119
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_0230E165		2_2_0230E165
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_0230303C		2_2_0230303C
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_02304419		2_2_02304419
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_02304245		2_2_02304245
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_023042B5		2_2_023042B5
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_02304484		2_2_02304484
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_0230CED6		2_2_0230CED6
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_023036D9		2_2_023036D9
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_0230452C		2_2_0230452C
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_02303700		2_2_02303700
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_02304358		2_2_02304358
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_02303BBC		2_2_02303BBC
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_02303BBE		2_2_02303BBE
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_02302F90		2_2_02302F90
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_02304195		2_2_02304195
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_02302F9B		2_2_02302F9B
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_02304184		2_2_02304184

Contains functionality to call native functions

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_0230DC5F NtProtectVirtualMemory,		2_2_0230DC5F
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_0230C119 NtAllocateVirtualMemory,		2_2_0230C119
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_02307B69 NtWriteVirtualMemory,		2_2_02307B69
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_02307BAC NtWriteVirtualMemory,		2_2_02307BAC
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_030CED4E NtProtectVirtualMemory,		6_2_030CED4E
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_030CEC4F Sleep,NtProtectVirtualMemory,		6_2_030CEC4F
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_030CECBD Sleep,NtProtectVirtualMemory,		6_2_030CECBD
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_030CED49 NtProtectVirtualMemory,		6_2_030CED49
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_030CED5C NtProtectVirtualMemory,NtProtectVirtualMemory,		6_2_030CED5C
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_030CEDB8 NtProtectVirtualMemory,		6_2_030CEDB8
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_030CEE3A NtProtectVirtualMemory,		6_2_030CEE3A

Sample file is different than original file name gathered from version info

Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe, 00000002.00000002.313749031092.0000000000419000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameVOLDFRELSERS.exe vs DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe
Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Binary or memory string: OriginalFilenameVOLDFRELSERS.exe vs DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

PE file contains strange resources

Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Tries to load missing DLLs

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Section loaded: edgegdi.dll			Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Section loaded: edgegdi.dll			Jump to behavior

Sample is known by Antivirus

Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Virustotal: Detection: 31%
Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	ReversingLabs: Detection: 17%

PE file has an executable .text section and no other executable section

Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Parts of this applications are using VB runtime library 6.0 (Probably coded in Visual Basic)

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe 'C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe'
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe'
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe'			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Creates temporary files

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe

File created: C:\Users\user\AppData\Local\Temp\LABERT

Jump to behavior

Classification label

Source: classification engine

Classification label: mal100.rans.troj.evad.winEXE@3/1@1/2

Creates mutexes

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Mutant created: \Sessions\1\BaseNamedObjects\oILYSlqV

Data Obfuscation:

Yara detected GuLoader

Source: Yara match

File source: 00000002.00000002.313750716611.0000000002300000.00000040.00000001.sdmp, type: MEMORY

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_00409455 push es; iretd		2_2_00409456
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_00407E31 push ds; retf		2_2_00407E32
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_004072C1 push edx; retf		2_2_004072C2
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_00406294 push edx; retf		2_2_00406297
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_00406D73 push es; retf		2_2_00406D76
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_004099EF push esp; iretd		2_2_004099F2
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_00407BFF push FFFFFFA7h; iretd		2_2_00407C53
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_02300390 push BDC367A8h; ret		2_2_02300383
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_02307F80 push FFFFFFAFh; ret		2_2_02307F93
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_02304F84 push esi; iretd		2_2_02304F87

Boot Survival:

Creates an autostart registry key

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Halvngen7			Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Halvngen7			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Tries to detect Any.run

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe			Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	File opened: C:\Program Files\qga\qga.exe			Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe			Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	File opened: C:\Program Files\qga\qga.exe			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: ieinstal.exe, 00000006.00000002.318237428388.00000000035C0000.00000004.00000001.sdmp	Binary or memory string: NTDLLKERNEL32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEUSER32PSAPI.DLLMSI.DLLPUBLISHERSHELL32ADVAPI32TEMP=\CIRKUSFORESTILLINGER.EXE\LABERTSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNHALVNGEN7HTTP://178.32.63.50/MOSS/HOST_AKHLBP62.BINHTTP://178.32.63.50/BOSS/HOST_AKHLBP62.BINWININET.DLLMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKO
Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe, 00000002.00000002.313750631050.00000000022E0000.00000004.00000001.sdmp	Binary or memory string: NTDLLKERNEL32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEUSER32PSAPI.DLLMSI.DLLPUBLISHERSHELL32ADVAPI32TEMP=PROGRAMFILES=\INTERNET EXPLORER\IEINSTAL.EXEWINDIR=\SYSWOW64\MSVBVM60.DLL
Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe, 00000002.00000002.313750631050.00000000022E0000.00000004.00000001.sdmp, ieinstal.exe, 00000006.00000002.318237428388.00000000035C0000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe TID: 6880	Thread sleep count: 9976 > 30			Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe TID: 6880	Thread sleep time: -49880s >= -30000s			Jump to behavior

Sleep loop found (likely to delay execution)

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Thread sleep count: Count: 9976 delay: -5

Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Code function: 2_2_02303B3F rdtsc

2_2_02303B3F

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Window / User API: threadDelayed 9976

Jump to behavior

Queries a list of all running drivers

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

System information queried: ModuleInformation

Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe, 00000002.00000002.313750631050.00000000022E0000.00000004.00000001.sdmp	Binary or memory string: ntdllkernel32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exeuser32psapi.dllMsi.dllPublishershell32advapi32TEMP=ProgramFiles=\internet explorer\ieinstal.exewindir=\syswow64\msvbvm60.dll
Source: ieinstal.exe, 00000006.00000002.318236722320.00000000031E8000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: ieinstal.exe, 00000006.00000002.318237428388.00000000035C0000.00000004.00000001.sdmp	Binary or memory string: ntdllkernel32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exeuser32psapi.dllMsi.dllPublishershell32advapi32TEMP=\Cirkusforestillinger.exe\LABERTSoftware\Microsoft\Windows\CurrentVersion\RunHalvngen7http://178.32.63.50/moss/Host_AKhLBP62.binhttp://178.32.63.50/boss/Host_AKhLBP62.binwininet.dllMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe, 00000002.00000002.313750631050.00000000022E0000.00000004.00000001.sdmp, ieinstal.exe, 00000006.00000002.318237428388.00000000035C0000.00000004.00000001.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Hides threads from debuggers

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Thread information set: HideFromDebugger			Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Code function: 2_2_02303B3F rdtsc

2_2_02303B3F

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_02305833 mov eax, dword ptr fs:[00000030h]		2_2_02305833
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_02305859 mov eax, dword ptr fs:[00000030h]		2_2_02305859
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_023088B5 mov eax, dword ptr fs:[00000030h]		2_2_023088B5
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_023058BF mov eax, dword ptr fs:[00000030h]		2_2_023058BF
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_0230CED6 mov eax, dword ptr fs:[00000030h]		2_2_0230CED6
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_0230599C mov eax, dword ptr fs:[00000030h]		2_2_0230599C
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 2_2_0230BDCB mov eax, dword ptr fs:[00000030h]		2_2_0230BDCB

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process queried: DebugPort			Jump to behavior

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Code function: 2_2_02308A19 LdrInitializeThunk,

2_2_02308A19

Contains functionality to register its own exception handler

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Code function: 2_2_0230E165 RtlAddVectoredExceptionHandler,

2_2_0230E165

HIPS / PFW / Operating System Protection Evasion:

Writes to foreign memory regions

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Memory written: C:\Program Files (x86)\Internet Explorer\ieinstal.exe base: 30C0000

Jump to behavior

Contains functionality to execute programs as a different user

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Code function: 2_2_0230CED6 LoadLibraryA,LogonUserA,

2_2_0230CED6

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe'

Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: ieinstal.exe, 00000006.00000002.318237700383.00000000039C1000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: ieinstal.exe, 00000006.00000002.318237700383.00000000039C1000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: ieinstal.exe, 00000006.00000002.318237700383.00000000039C1000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: ieinstal.exe, 00000006.00000002.318237700383.00000000039C1000.00000002.00020000.sdmp	Binary or memory string: Progmanlock