Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	5.804544485598051
Filename:	DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe
Filesize:	98304
MD5:	8e2b177d2ab29c95f067559a029cf5e8
SHA1:	f347fa229d51836344ab5bf89fa531e19aa5e324
SHA256:	b9fdde7d748e27a130c509a589a2c8b92aad279604d3e4ee7ac28187fc5660be
SHA512:	29493bc83ab2348c5f3f707079e968302e03256acd3801d9c5e47c13a87cb9ec70145208bb25a4127e30cbe2cd7edca1a6cd82a23ca7a5e5a8a0bb0a19e1aa00
SSDEEP:	768:37nneTCCOKskAtEcDpHR0QWNTsO85zCoLi/0Fqt1fgg9ZPxt/ZbwKbdU5p0:TnWAT4sO87LFIl3Ph2c
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,..SM..SM..SM...Q..RM...o..uM..ek..RM..RichSM..................PE..L......I.................P...@...............`....@........

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Antivirus / Scanner detection for submitted sample	AV Detection
Hides threads from debuggers	Anti Debugging	Security Software Discovery
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion
Tries to detect Any.run	Malware Analysis System Evasion
Uses 32bit PE files	Compliance, System Summary
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Contains functionality to execute programs as a different user	HIPS / PFW / Operating System Protection Evasion	Valid Accounts Access Token Manipulation
Detected potential crypto function	System Summary	Archive Collected Data Encrypted Channel
Contains functionality to call native functions	System Summary
Contains functionality for execution timing, often used to detect debuggers	Malware Analysis System Evasion, Anti Debugging
Sample file is different than original file name gathered from version info	System Summary
PE file contains strange resources	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
Contains functionality to read the PEB	Anti Debugging
Checks if the current process is being debugged	Anti Debugging
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)	Anti Debugging
Sample is known by Antivirus	System Summary
PE file has an executable .text section and no other executable section	System Summary
Reads software policies	System Summary	System Information Discovery
Parts of this applications are using VB runtime library 6.0 (Probably coded in Visual Basic)	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Queries a list of all running drivers	Malware Analysis System Evasion
Contains functionality to register its own exception handler	Anti Debugging
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion

C:\Users\user\AppData\Local\Temp\LABERT\Cirkusforestillinger.exe

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\LABERT\Cirkusforestillinger.exe
Category:	dropped
Dump:	Cirkusforestillinger.exe.6.dr
ID:	dr_0
Target ID:	6
Process:	C:\Program Files (x86)\Internet Explorer\ieinstal.exe
Type:	data
Entropy:	5.8045067757228095
Encrypted:	false
Ssdeep:	768:I7nneTCCOKskAtEcDpHR0QWNTsO85zCoLi/0Fqt1fgg9ZPxt/ZbwKbdU5p0y:MnWAT4sO87LFIl3Ph2cy
Size:	98305
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

'C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe'

Details

Is windows:	false
Is dropped:	false
PID:	872
Target ID:	2
Parent PID:	7844
Name:	DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe
Path:	C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe
Commandline:	'C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe'
Size:	98304
MD5:	8E2B177D2AB29C95F067559A029CF5E8
Time:	12:53:20
Date:	27/09/2021
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	106496
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
PE file contains strange resources	System Summary
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection

C:\Program Files (x86)\Internet Explorer\ieinstal.exe

'C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe'

Details

Is windows:	true
Is dropped:	false
PID:	7104
Target ID:	6
Parent PID:	872
Name:	ieinstal.exe
Path:	C:\Program Files (x86)\Internet Explorer\ieinstal.exe
Commandline:	'C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe'
Size:	480256
MD5:	7871873BABCEA94FBA13900B561C7C55
Time:	12:53:43
Date:	27/09/2021
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xad0000
Modulesize:	495616
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://178.32.63.50/moss/Host_AKhLBP62.bin

178.32.63.50

Details

Name:	http://178.32.63.50/moss/Host_AKhLBP62.bin
IP:	178.32.63.50
TargetID:	6
From Memory:	false
Current Path:	C:\Program Files (x86)\Internet Explorer\ieinstal.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)	Networking
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

http://178.32.63.50/moss/Host_AKhLBP62.bin:

unknown

Details

Name:	http://178.32.63.50/moss/Host_AKhLBP62.bin:
TargetID:	6
From Memory:	true
Current Path:	C:\Program Files (x86)\Internet Explorer\ieinstal.exe
Source:	ieinstal.exe, 00000006.00000002.318237025480.0000000003229000.00000004.00000020.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://178.32.63.50/moss/Host_AKhLBP62.binF

unknown

Details

Name:	http://178.32.63.50/moss/Host_AKhLBP62.binF
TargetID:	6
From Memory:	true
Current Path:	C:\Program Files (x86)\Internet Explorer\ieinstal.exe
Source:	ieinstal.exe, 00000006.00000002.318237025480.0000000003229000.00000004.00000020.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://178.32.63.50/boss/Host_AKhLBP62.bin

unknown

Details

Name:	http://178.32.63.50/boss/Host_AKhLBP62.bin
TargetID:	6
From Memory:	true
Current Path:	C:\Program Files (x86)\Internet Explorer\ieinstal.exe
Source:	ieinstal.exe, 00000006.00000002.318237428388.00000000035C0000.00000004.00000001.sdmp

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

http://178.32.63.50/moss/Host_AKhLBP62.binhttp://178.32.63.50/boss/Host_AKhLBP62.binwininet.dllMozil

unknown

Details

Name:	http://178.32.63.50/moss/Host_AKhLBP62.binhttp://178.32.63.50/boss/Host_AKhLBP62.binwininet.dllMozil
TargetID:	6
From Memory:	true
Current Path:	C:\Program Files (x86)\Internet Explorer\ieinstal.exe
Source:	ieinstal.exe, 00000006.00000002.318237428388.00000000035C0000.00000004.00000001.sdmp

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

Domains

Name

Malicious

septnet.duckdns.org

193.104.197.28

Details

Name:	septnet.duckdns.org
IP:	193.104.197.28
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Uses dynamic DNS services	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

IPs

Domain

Country

Malicious

193.104.197.28

septnet.duckdns.org

unknown

Details

IP:	193.104.197.28
TargetID:	6
Current Path:	C:\Program Files (x86)\Internet Explorer\ieinstal.exe
ASN number:	1299
ASN name:	TELIANETTeliaCarrierEU
Private:	false
Domain:	septnet.duckdns.org

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port

178.32.63.50

unknown

France

Details

IP:	178.32.63.50
TargetID:	6
Current Path:	C:\Program Files (x86)\Internet Explorer\ieinstal.exe
Country:	France
Countrycode:	FRA
ASN number:	16276
ASN name:	OVHFR
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)	Networking
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Halvngen7

Details

TargetID:	6
Path:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value name:	Halvngen7
Value data:	C:\Users\user\AppData\Local\Temp\LABERT\Cirkusforestillinger.exe

Signature Hits	Behavior Group	Mitre Attack
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder

HKEY_CURRENT_USER\SOFTWARE\NetWire

HostId

HKEY_CURRENT_USER\SOFTWARE\NetWire

Install Date

Memdumps

Base Address

Regiontype

Protect

Malicious

2300000

unkown

page execute and read and write

7F7B0000

unkown image

page readonly

2C20000

heap private

page read and write

1C531000

unkown

page read and write

7F7C0000

unkown image

page readonly

23A0000

heap private

page read and write

1C72F000

unkown

page read and write

2ACE000

unkown image

page readonly

21E0000

unkown

page read and write

2E31000

unkown

page read and write

19B000

unkown

page read and write

8DF000

unkown

page read and write

39B0000

unkown image

page readonly

400000

unkown image

page readonly

7F7B2000

unkown image

page readonly

2B71000

unkown image

page readonly

1A0000

unkown image

page readonly

2320000

unkown image

page readonly

69E000

unkown

page read and write

2B01000

unkown image

page readonly

1EE1F000

unkown

page read and write

2AF6000

unkown image

page readonly

614000

unkown

page read and write

534000

heap default

page read and write

610000

heap default

page read and write

2C30000

unkown

page read and write

2B83000

unkown image

page readonly

30A0000

unkown image

page readonly

2B9B000

unkown image

page readonly

2B35000

unkown image

page readonly

500000

unkown

page read and write

2250000

heap private

page read and write

35C0000

unkown

page read and write

2240000

unkown image

page readonly

31D0000

unkown image

page readonly

2340000

unkown

page read and write

2B31000

unkown image

page readonly

7FFC0000

unkown image

page readonly

1ECDC000

unkown

page read and write

79F000

unkown

page read and write

2ADC000

unkown image

page readonly

2B2E000

unkown

page read and write

2B7D000

unkown image

page readonly

2DC0000

unkown image

page readonly

2DF0000

unkown image

page readonly

3A3000

unkown

page read and write

2AE2000

unkown image

page readonly

1ED9E000

unkown

page read and write

10000

unkown image

page readonly

39C1000

unkown image

page readonly

31E8000

heap default

page read and write

2D30000

unkown image

page readonly

20000

unkown image

page readonly

3314000

unkown

page read and write

31C0000

unkown image

page readonly

2B5F000

unkown image

page readonly

7FFB2000

unkown image

page readonly

2B56000

unkown image

page readonly

297F000

unkown image

page readonly

2220000

unkown image

page readonly

3000000

unkown image

page readonly

7F7D0000

unkown image

page readonly

2F1E000

unkown

page read and write

7FFC2000

unkown image

page readonly

1E7D0000

heap private

page read and write

29CC000

unkown image

page readonly

91E000

unkown

page read and write

400000

unkown image

page readonly

2BA7000

unkown image

page readonly

30000

unkown image

page read and write

7F7C2000

unkown image

page readonly

1EDDE000

unkown

page read and write

3620000

heap private

page read and write

2AC5000

unkown image

page readonly

2B40000

unkown image

page readonly

2DF0000

unkown image

page readonly

2ACC000

unkown image

page readonly

7F7B0000

unkown image

page readonly

2BB4000

unkown image

page readonly

2DE0000

unkown image

page read and write

3263000

heap default

page read and write

22F0000

unkown image

page readonly

7FFC2000

unkown image

page readonly

1ED1F000

unkown

page read and write

7F7D0000

unkown image

page readonly

21C0000

unkown

page execute read

96000

unkown

page read and write

419000

unkown image

page readonly

2B07000

unkown image

page readonly

7F7B0000

unkown image

page readonly

7FFD0000

unkown image

page readonly

C20000

unkown image

page readonly

2B65000

unkown image

page readonly

2BC0000

heap private

page read and write

1F0000

unkown image

page readonly

A1F000

unkown

page read and write

2B95000

unkown image

page readonly

2330000

heap private

page read and write

620000

unkown

page read and write

323A000

heap default

page read and write

2B15000

unkown image

page readonly

7F7C0000

unkown image

page readonly

35D0000

unkown

page readonly

7FFB2000

unkown image

page readonly

7F7B2000

unkown image

page readonly

401000

unkown image

page execute read

1C530000

unkown

page read and write

30CE000

unkown

page execute and read and write

3000000

unkown image

page readonly

3301000

unkown image

page readonly

7FFB0000

unkown image

page readonly

2B38000

unkown image

page readonly

4F1000

unkown image

page readonly

400000

unkown image

page readonly

22E0000

unkown

page read and write

3570000

unkown

page read and write

1E4E0000

unkown

page read and write

614000

unkown

page read and write

2C24000

heap private

page read and write

DA0000

unkown image

page readonly

1C0000

unkown image

page readonly

2BAE000

unkown image

page readonly

1D0000

unkown image

page readonly

51E000

heap default

page read and write

7F7C0000

unkown image

page readonly

7FFD0000

unkown image

page readonly

7F7D0000

unkown image

page readonly

2B2E000

unkown image

page readonly

40000

unkown image

page readonly

2B21000

unkown image

page readonly

2B62000

unkown image

page readonly

2AE5000

unkown image

page readonly

419000

unkown image

page readonly

7F7C2000

unkown image

page readonly

1C531000

unkown

page read and write

39F000

unkown

page read and write

31E0000

heap default

page read and write

324E000

heap default

page read and write

7FE50000

unkown image

page readonly

29D0000

unkown image

page readonly

3830000

unkown image

page readonly

32F0000

unkown image

page readonly

3310000

heap default

page read and write

7FFC0000

unkown image

page readonly

4DD0000

unkown

page read and write

1E0000

unkown image

page readonly

2AAB000

unkown image

page readonly

2B19000

unkown image

page readonly

510000

heap default

page read and write

2988000

unkown image

page readonly

7F7B2000

unkown image

page readonly

2AA0000

unkown image

page readonly

32E0000

unkown image

page readonly

3630000

unkown image

page readonly

416000

unkown image

page read and write

23B0000

unkown

page read and write

401000

unkown image

page execute read

51A000

heap default

page read and write

2BAA000

unkown image

page readonly

A20000

unkown image

page readonly

2B0C000

unkown image

page readonly

30A0000

unkown image

page readonly

2260000

unkown

page read and write

3229000

heap default

page read and write

2AD1000

unkown image

page readonly

1EBBF000

unkown

page read and write

7FFB0000

unkown image

page readonly

3000000

unkown image

page readonly

1E5E0000

unkown

page read and write

2ABA000

unkown image

page readonly

35E0000

unkown image

page readonly

2339000

heap private

page read and write

7F7C2000

unkown image

page readonly

2ADA000

unkown image

page readonly

2B91000

unkown image

page readonly

2BB4000

unkown image

page readonly

1ED15000

unkown

page read and write

2DD0000

unkown image

page readonly

40000

unkown image

page readonly

7F650000

unkown image

page readonly

2BB4000

unkown image

page readonly

1E4E1000

unkown

page read and write

1ED5B000

unkown

page read and write

7DE000

unkown

page read and write

1EB7E000

unkown

page read and write

There are 175 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report

Files

Processes

URLs

Domains

IPs

Registry

Memdumps