Windows Analysis Report DHL Waybill receipt.exe

Overview

General Information

Sample Name: DHL Waybill receipt.exe
Analysis ID: 532850
MD5: fccf07d7a10aff74cedc0e93fbe77f90
SHA1: 8e7d667885cdc3646d46c3a72ee13451c86cbd4d
SHA256: 854fdbaa39b3da5ed2d094c57511d14dc97c392358da47e42fbbd7b2d03101d2
Tags: AgentTeslaDHLexe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AntiVM3
Installs a global keyboard hook
Tries to steal Mail credentials (via file / registry access)
Initial sample is a PE file and has a suspicious name
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Contains functionality to register a low level keyboard hook
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Yara detected Credential Stealer
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Detected TCP or UDP traffic on non-standard ports
Uses SMTP (mail sending)
Creates a window with clipboard capturing capabilities
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Found malware configuration
Source: 0.2.DHL Waybill receipt.exe.3d934e0.3.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "john.ramos@unitedappliencesgroup.com", "Password": "fYmh*3R6#+sv", "Host": "smtp.unitedappliencesgroup.com"}
Multi AV Scanner detection for submitted file
Source: DHL Waybill receipt.exe ReversingLabs: Detection: 31%
Antivirus or Machine Learning detection for unpacked file
Source: 3.2.DHL Waybill receipt.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 3.0.DHL Waybill receipt.exe.400000.10.unpack Avira: Label: TR/Spy.Gen8
Source: 3.0.DHL Waybill receipt.exe.400000.8.unpack Avira: Label: TR/Spy.Gen8
Source: 3.0.DHL Waybill receipt.exe.400000.12.unpack Avira: Label: TR/Spy.Gen8
Source: 3.0.DHL Waybill receipt.exe.400000.6.unpack Avira: Label: TR/Spy.Gen8
Source: 3.0.DHL Waybill receipt.exe.400000.4.unpack Avira: Label: TR/Spy.Gen8

Compliance:

barindex
Uses 32bit PE files
Source: DHL Waybill receipt.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: DHL Waybill receipt.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.5:49855 -> 208.91.199.223:587
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 208.91.199.223 208.91.199.223
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.5:49855 -> 208.91.199.223:587
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.5:49855 -> 208.91.199.223:587
Source: DHL Waybill receipt.exe, 00000003.00000002.515087639.0000000002F81000.00000004.00000001.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: DHL Waybill receipt.exe, 00000003.00000002.515087639.0000000002F81000.00000004.00000001.sdmp String found in binary or memory: http://DynDns.comDynDNS
Source: DHL Waybill receipt.exe, 00000003.00000002.515087639.0000000002F81000.00000004.00000001.sdmp String found in binary or memory: http://KjvtHQ.com
Source: DHL Waybill receipt.exe, 00000003.00000002.516134139.00000000032E1000.00000004.00000001.sdmp String found in binary or memory: http://smtp.unitedappliencesgroup.com
Source: DHL Waybill receipt.exe, 00000003.00000002.516134139.00000000032E1000.00000004.00000001.sdmp String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: DHL Waybill receipt.exe, 00000003.00000002.516134139.00000000032E1000.00000004.00000001.sdmp, DHL Waybill receipt.exe, 00000003.00000002.516100681.00000000032DB000.00000004.00000001.sdmp, DHL Waybill receipt.exe, 00000003.00000003.469252817.0000000001144000.00000004.00000001.sdmp, DHL Waybill receipt.exe, 00000003.00000002.516067178.00000000032D7000.00000004.00000001.sdmp String found in binary or memory: https://YDMv4fA4ajY4A2Rc.net
Source: DHL Waybill receipt.exe, 00000000.00000002.257252389.0000000003A99000.00000004.00000001.sdmp, DHL Waybill receipt.exe, 00000003.00000000.249607108.0000000000402000.00000040.00000001.sdmp, DHL Waybill receipt.exe, 00000003.00000000.251632964.0000000000402000.00000040.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: DHL Waybill receipt.exe, 00000003.00000002.515087639.0000000002F81000.00000004.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
Source: unknown DNS traffic detected: queries for: smtp.unitedappliencesgroup.com

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Installs a global keyboard hook
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\DHL Waybill receipt.exe Jump to behavior
Contains functionality to register a low level keyboard hook
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_01320918 SetWindowsHookExW 0000000D,00000000,?,? 3_2_01320918
Creates a DirectInput object (often for capturing keystrokes)
Source: DHL Waybill receipt.exe, 00000000.00000002.253890872.0000000000E48000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
Creates a window with clipboard capturing capabilities
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior

System Summary:

barindex
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: DHL Waybill receipt.exe
.NET source code contains very large array initializations
Source: 3.2.DHL Waybill receipt.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bD602F5ECu002d6DD9u002d402Au002dB460u002d68BF51135F0Du007d/F334B3FCu002dA0E0u002d4A3Cu002d97FFu002dD31A2D202388.cs Large array initialization: .cctor: array initializer size 11963
Source: 3.0.DHL Waybill receipt.exe.400000.10.unpack, u003cPrivateImplementationDetailsu003eu007bD602F5ECu002d6DD9u002d402Au002dB460u002d68BF51135F0Du007d/F334B3FCu002dA0E0u002d4A3Cu002d97FFu002dD31A2D202388.cs Large array initialization: .cctor: array initializer size 11963
Source: 3.0.DHL Waybill receipt.exe.400000.8.unpack, u003cPrivateImplementationDetailsu003eu007bD602F5ECu002d6DD9u002d402Au002dB460u002d68BF51135F0Du007d/F334B3FCu002dA0E0u002d4A3Cu002d97FFu002dD31A2D202388.cs Large array initialization: .cctor: array initializer size 11963
Source: 3.0.DHL Waybill receipt.exe.400000.12.unpack, u003cPrivateImplementationDetailsu003eu007bD602F5ECu002d6DD9u002d402Au002dB460u002d68BF51135F0Du007d/F334B3FCu002dA0E0u002d4A3Cu002d97FFu002dD31A2D202388.cs Large array initialization: .cctor: array initializer size 11963
Uses 32bit PE files
Source: DHL Waybill receipt.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Detected potential crypto function
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 0_2_0106E76A 0_2_0106E76A
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 0_2_0106E778 0_2_0106E778
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 0_2_0106BDC4 0_2_0106BDC4
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 0_2_04FA4F50 0_2_04FA4F50
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 0_2_04FAE0B8 0_2_04FAE0B8
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 0_2_04FAC1D8 0_2_04FAC1D8
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 0_2_04FAE1D0 0_2_04FAE1D0
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 0_2_04FAC1C8 0_2_04FAC1C8
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 0_2_04FA4E88 0_2_04FA4E88
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 0_2_04FA4F41 0_2_04FA4F41
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 0_2_00692050 0_2_00692050
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 1_2_001D2050 1_2_001D2050
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_0132E018 3_2_0132E018
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_01320006 3_2_01320006
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_01320F50 3_2_01320F50
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_01329590 3_2_01329590
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_013385B0 3_2_013385B0
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_01330040 3_2_01330040
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_0133DBB8 3_2_0133DBB8
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_01334A34 3_2_01334A34
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_0133A12F 3_2_0133A12F
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_0133A1B2 3_2_0133A1B2
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_01332398 3_2_01332398
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_0133A250 3_2_0133A250
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_013491AC 3_2_013491AC
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_01346850 3_2_01346850
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_0134E268 3_2_0134E268
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_01345AF0 3_2_01345AF0
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_0134D509 3_2_0134D509
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_0134D5D2 3_2_0134D5D2
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_0134D471 3_2_0134D471
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_01349CB1 3_2_01349CB1
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_0134AB02 3_2_0134AB02
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_01344B51 3_2_01344B51
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_01344B9D 3_2_01344B9D
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_01344BE9 3_2_01344BE9
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_00B02050 3_2_00B02050
Sample file is different than original file name gathered from version info
Source: DHL Waybill receipt.exe Binary or memory string: OriginalFilename vs DHL Waybill receipt.exe
Source: DHL Waybill receipt.exe, 00000000.00000002.254418452.0000000002A91000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameInnerException.dll" vs DHL Waybill receipt.exe
Source: DHL Waybill receipt.exe, 00000000.00000002.254418452.0000000002A91000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameurHctEuzUbYyBfycprxPlEqnVuAMRHMF.exe4 vs DHL Waybill receipt.exe
Source: DHL Waybill receipt.exe, 00000000.00000002.257252389.0000000003A99000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUI.dllF vs DHL Waybill receipt.exe
Source: DHL Waybill receipt.exe, 00000000.00000002.257252389.0000000003A99000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameurHctEuzUbYyBfycprxPlEqnVuAMRHMF.exe4 vs DHL Waybill receipt.exe
Source: DHL Waybill receipt.exe, 00000000.00000002.258205731.0000000005BF0000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameUI.dllF vs DHL Waybill receipt.exe
Source: DHL Waybill receipt.exe, 00000000.00000002.253890872.0000000000E48000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameclr.dllT vs DHL Waybill receipt.exe
Source: DHL Waybill receipt.exe Binary or memory string: OriginalFilename vs DHL Waybill receipt.exe
Source: DHL Waybill receipt.exe Binary or memory string: OriginalFilename vs DHL Waybill receipt.exe
Source: DHL Waybill receipt.exe, 00000003.00000000.251632964.0000000000402000.00000040.00000001.sdmp Binary or memory string: OriginalFilenameurHctEuzUbYyBfycprxPlEqnVuAMRHMF.exe4 vs DHL Waybill receipt.exe
Source: DHL Waybill receipt.exe, 00000003.00000002.512922970.000000000121A000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameclr.dllT vs DHL Waybill receipt.exe
Source: DHL Waybill receipt.exe, 00000003.00000002.511253105.0000000000F58000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs DHL Waybill receipt.exe
Source: DHL Waybill receipt.exe Binary or memory string: OriginalFilenameCOMServerEnt.exeB vs DHL Waybill receipt.exe
Source: DHL Waybill receipt.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: DHL Waybill receipt.exe ReversingLabs: Detection: 31%
Source: DHL Waybill receipt.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\DHL Waybill receipt.exe "C:\Users\user\Desktop\DHL Waybill receipt.exe"
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process created: C:\Users\user\Desktop\DHL Waybill receipt.exe C:\Users\user\Desktop\DHL Waybill receipt.exe
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process created: C:\Users\user\Desktop\DHL Waybill receipt.exe C:\Users\user\Desktop\DHL Waybill receipt.exe
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process created: C:\Users\user\Desktop\DHL Waybill receipt.exe C:\Users\user\Desktop\DHL Waybill receipt.exe Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process created: C:\Users\user\Desktop\DHL Waybill receipt.exe C:\Users\user\Desktop\DHL Waybill receipt.exe Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHL Waybill receipt.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@5/1@2/2
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: 3.2.DHL Waybill receipt.exe.400000.0.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.2.DHL Waybill receipt.exe.400000.0.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.0.DHL Waybill receipt.exe.400000.10.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.0.DHL Waybill receipt.exe.400000.10.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.0.DHL Waybill receipt.exe.400000.8.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.0.DHL Waybill receipt.exe.400000.8.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: DHL Waybill receipt.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: DHL Waybill receipt.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

barindex
.NET source code contains potential unpacker
Source: DHL Waybill receipt.exe, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.DHL Waybill receipt.exe.690000.0.unpack, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.DHL Waybill receipt.exe.690000.0.unpack, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.0.DHL Waybill receipt.exe.1d0000.2.unpack, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.0.DHL Waybill receipt.exe.1d0000.0.unpack, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.0.DHL Waybill receipt.exe.1d0000.1.unpack, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.0.DHL Waybill receipt.exe.1d0000.3.unpack, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.2.DHL Waybill receipt.exe.1d0000.0.unpack, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.DHL Waybill receipt.exe.b00000.11.unpack, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.DHL Waybill receipt.exe.b00000.9.unpack, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.2.DHL Waybill receipt.exe.b00000.1.unpack, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.DHL Waybill receipt.exe.b00000.13.unpack, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 0_2_0106E768 pushfd ; ret 0_2_0106E769
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_0134B537 push edi; retn 0000h 3_2_0134B539
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_01342308 push cs; ret 3_2_013423AF
Source: initial sample Static PE information: section name: .text entropy: 7.85914519961

Hooking and other Techniques for Hiding and Protection:

barindex
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 0.2.DHL Waybill receipt.exe.2ab1428.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.254418452.0000000002A91000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: DHL Waybill receipt.exe PID: 6312, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: DHL Waybill receipt.exe, 00000000.00000002.254418452.0000000002A91000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Source: DHL Waybill receipt.exe, 00000000.00000002.254418452.0000000002A91000.00000004.00000001.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe TID: 4380 Thread sleep time: -35062s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe TID: 3976 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe TID: 2920 Thread sleep time: -16602069666338586s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe TID: 5028 Thread sleep count: 2676 > 30 Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe TID: 5028 Thread sleep count: 7179 > 30 Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Window / User API: threadDelayed 2676 Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Window / User API: threadDelayed 7179 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Thread delayed: delay time: 35062 Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: DHL Waybill receipt.exe, 00000000.00000002.254418452.0000000002A91000.00000004.00000001.sdmp Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: DHL Waybill receipt.exe, 00000000.00000002.254418452.0000000002A91000.00000004.00000001.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: DHL Waybill receipt.exe, 00000000.00000002.254418452.0000000002A91000.00000004.00000001.sdmp Binary or memory string: vmware
Source: DHL Waybill receipt.exe, 00000003.00000002.513209462.0000000001282000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: DHL Waybill receipt.exe, 00000000.00000002.254418452.0000000002A91000.00000004.00000001.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Anti Debugging:

barindex
Enables debug privileges
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process token adjusted: Debug Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Code function: 3_2_0133DBB8 LdrInitializeThunk, 3_2_0133DBB8
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process created: C:\Users\user\Desktop\DHL Waybill receipt.exe C:\Users\user\Desktop\DHL Waybill receipt.exe Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Process created: C:\Users\user\Desktop\DHL Waybill receipt.exe C:\Users\user\Desktop\DHL Waybill receipt.exe Jump to behavior
Source: DHL Waybill receipt.exe, 00000003.00000002.514410708.0000000001970000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: DHL Waybill receipt.exe, 00000003.00000002.514410708.0000000001970000.00000002.00020000.sdmp Binary or memory string: Progman
Source: DHL Waybill receipt.exe, 00000003.00000002.514410708.0000000001970000.00000002.00020000.sdmp Binary or memory string: SProgram Managerl
Source: DHL Waybill receipt.exe, 00000003.00000002.514410708.0000000001970000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd,
Source: DHL Waybill receipt.exe, 00000003.00000002.514410708.0000000001970000.00000002.00020000.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Queries volume information: C:\Users\user\Desktop\DHL Waybill receipt.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Queries volume information: C:\Users\user\Desktop\DHL Waybill receipt.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected AgentTesla
Source: Yara match File source: 3.0.DHL Waybill receipt.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.DHL Waybill receipt.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.DHL Waybill receipt.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.DHL Waybill receipt.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL Waybill receipt.exe.3d934e0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.DHL Waybill receipt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.DHL Waybill receipt.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL Waybill receipt.exe.3d934e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL Waybill receipt.exe.3cf7cc0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL Waybill receipt.exe.3b2ccd8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000000.249607108.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.251632964.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.250868237.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.509034503.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.250192706.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.257252389.0000000003A99000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.515087639.0000000002F81000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: DHL Waybill receipt.exe PID: 6312, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: DHL Waybill receipt.exe PID: 3688, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\ Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\DHL Waybill receipt.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000003.00000002.515087639.0000000002F81000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: DHL Waybill receipt.exe PID: 3688, type: MEMORYSTR

Remote Access Functionality:

barindex
Yara detected AgentTesla
Source: Yara match File source: 3.0.DHL Waybill receipt.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.DHL Waybill receipt.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.DHL Waybill receipt.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.DHL Waybill receipt.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL Waybill receipt.exe.3d934e0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.DHL Waybill receipt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.DHL Waybill receipt.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL Waybill receipt.exe.3d934e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL Waybill receipt.exe.3cf7cc0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL Waybill receipt.exe.3b2ccd8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000000.249607108.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.251632964.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.250868237.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.509034503.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.250192706.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.257252389.0000000003A99000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.515087639.0000000002F81000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: DHL Waybill receipt.exe PID: 6312, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: DHL Waybill receipt.exe PID: 3688, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 532850 Sample: DHL Waybill receipt.exe Startdate: 02/12/2021 Architecture: WINDOWS Score: 100 23 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->23 25 Found malware configuration 2->25 27 Multi AV Scanner detection for submitted file 2->27 29 9 other signatures 2->29 6 DHL Waybill receipt.exe 3 2->6         started        process3 file4 15 C:\Users\user\...\DHL Waybill receipt.exe.log, ASCII 6->15 dropped 9 DHL Waybill receipt.exe 2 6->9         started        13 DHL Waybill receipt.exe 6->13         started        process5 dnsIp6 17 smtp.unitedappliencesgroup.com 9->17 19 us2.smtp.mailhostbox.com 208.91.199.223, 49855, 587 PUBLIC-DOMAIN-REGISTRYUS United States 9->19 21 192.168.2.1 unknown unknown 9->21 31 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 9->31 33 Tries to steal Mail credentials (via file / registry access) 9->33 35 Tries to harvest and steal ftp login credentials 9->35 37 2 other signatures 9->37 signatures7
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
208.91.199.223
 us2.smtp.mailhostbox.com United States
394695 PUBLIC-DOMAIN-REGISTRYUS false

Private
IP
192.168.2.1

Contacted Domains

Name IP Active
us2.smtp.mailhostbox.com 208.91.199.223 true
smtp.unitedappliencesgroup.com unknown unknown