Edit tour

Windows Analysis Report
DHL_VTER000105453.exe

Overview

General Information

Sample name:	DHL_VTER000105453.exe
Analysis ID:	1436301
MD5:	7dec2c3596f3081f16fb71af0b1340ef
SHA1:	2f95bb30d3d11e88713b66fe1c55113e06890656
SHA256:	0144ad3c79e25335ba0bb88e4c47c497215af9d44f0dc9f8a550bf71d579ca07
Tags:	AgentTeslaDHLexe
Infos:

Detection

AgentTesla, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Contains functionality to register a low level keyboard hook

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

DHL_VTER000105453.exe (PID: 3564 cmdline: "C:\Users\user\Desktop\DHL_VTER000105453.exe" MD5: 7DEC2C3596F3081F16FB71AF0B1340EF)

DHL_VTER000105453.exe (PID: 5060 cmdline: "C:\Users\user\Desktop\DHL_VTER000105453.exe" MD5: 7DEC2C3596F3081F16FB71AF0B1340EF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "nl9.nlkoddos.com", "Username": "99@jolnsmad.site", "Password": "Myname321@"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.2455637570.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.2455637570.0000000002BF5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2455637570.0000000002BF5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.2455637570.0000000002C16000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1233395937.0000000004F70000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000003.00000002.2450708050.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2450708050.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1228882170.0000000002491000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1230174556.000000000366E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1230174556.000000000366E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1228882170.000000000252A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: DHL_VTER000105453.exe PID: 3564	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DHL_VTER000105453.exe PID: 3564	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: DHL_VTER000105453.exe PID: 3564	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: DHL_VTER000105453.exe PID: 5060	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DHL_VTER000105453.exe PID: 5060	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.DHL_VTER000105453.exe.4f70000.9.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.DHL_VTER000105453.exe.4f70000.9.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.DHL_VTER000105453.exe.24f8df0.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.DHL_VTER000105453.exe.24f8df0.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.DHL_VTER000105453.exe.24e8154.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.DHL_VTER000105453.exe.24e8154.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.DHL_VTER000105453.exe.24b6468.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.DHL_VTER000105453.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.DHL_VTER000105453.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.2.DHL_VTER000105453.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.DHL_VTER000105453.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33eab:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33f1d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33fa7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34039:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x340a3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34115:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x341ab:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3423b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.DHL_VTER000105453.exe.3773728.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DHL_VTER000105453.exe.3773728.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DHL_VTER000105453.exe.3773728.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x320ab:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3211d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x321a7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32239:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x322a3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32315:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x323ab:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3243b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.DHL_VTER000105453.exe.37aeb48.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DHL_VTER000105453.exe.37aeb48.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DHL_VTER000105453.exe.37aeb48.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x320ab:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3211d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x321a7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32239:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x322a3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32315:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x323ab:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3243b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.DHL_VTER000105453.exe.37aeb48.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DHL_VTER000105453.exe.37aeb48.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.DHL_VTER000105453.exe.37aeb48.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DHL_VTER000105453.exe.37aeb48.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33eab:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f0cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33f1d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6f13d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33fa7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6f1c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34039:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6f259:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x340a3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6f2c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34115:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6f335:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x341ab:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6f3cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3423b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6f45b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.DHL_VTER000105453.exe.3773728.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DHL_VTER000105453.exe.3773728.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.DHL_VTER000105453.exe.3773728.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DHL_VTER000105453.exe.3773728.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33eab:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f2cb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xaa4eb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33f1d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6f33d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xaa55d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33fa7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6f3c7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xaa5e7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34039:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6f459:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xaa679:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x340a3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6f4c3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xaa6e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34115:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6f535:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xaa755:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x341ab:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6f5cb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xaa7eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.DHL_VTER000105453.exe.269f198.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.DHL_VTER000105453.exe.26a01b0.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.DHL_VTER000105453.exe.26a21c8.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 23 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 89.249.49.141, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\DHL_VTER000105453.exe, Initiated: true, ProcessId: 5060, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49708

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.DHL_VTER000105453.exe.37aeb48.7.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "nl9.nlkoddos.com", "Username": "99@jolnsmad.site", "Password": "Myname321@"}

Multi AV Scanner detection for submitted file

Source: DHL_VTER000105453.exe	ReversingLabs: Detection: 65%
Source: DHL_VTER000105453.exe	Virustotal: Detection: 44%			Perma Link

Machine Learning detection for sample

Source: DHL_VTER000105453.exe

Joe Sandbox ML: detected

Source: DHL_VTER000105453.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.7:49704 version: TLS 1.2

Source: DHL_VTER000105453.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: WIgI.pdbSHA25666 source: DHL_VTER000105453.exe
Source:	Binary string: WIgI.pdb source: DHL_VTER000105453.exe

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 3.2.DHL_VTER000105453.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.37aeb48.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.3773728.6.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.7:49708 -> 89.249.49.141:587

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 89.249.49.141 89.249.49.141
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: IPCTRU IPCTRU

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: ip-api.com

Source: global traffic

TCP traffic: 192.168.2.7:49708 -> 89.249.49.141:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: nl9.nlkoddos.com

Source: DHL_VTER000105453.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: DHL_VTER000105453.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: DHL_VTER000105453.exe, 00000000.00000002.1230174556.000000000366E000.00000004.00000800.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2450708050.0000000000402000.00000040.00000400.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002C16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nl9.nlkoddos.com
Source: DHL_VTER000105453.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: DHL_VTER000105453.exe, 00000003.00000002.2452463721.0000000000E77000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2460798271.0000000006333000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2460798271.00000000062BA000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2460798271.000000000630C000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002C38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: DHL_VTER000105453.exe, 00000003.00000002.2452463721.0000000000E77000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2460798271.0000000006333000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2460798271.00000000062BA000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2460798271.000000000630C000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002C38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002B91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: DHL_VTER000105453.exe	String found in binary or memory: http://tempuri.org/DataSeta.xsd)Microsoft
Source: DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2460798271.0000000006333000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2460798271.000000000630C000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2452463721.0000000000ECC000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2452463721.0000000000EA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2460798271.0000000006333000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2460798271.000000000630C000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2452463721.0000000000ECC000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2452463721.0000000000EA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: DHL_VTER000105453.exe, 00000000.00000002.1230174556.000000000366E000.00000004.00000800.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2450708050.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: DHL_VTER000105453.exe, 00000000.00000002.1230174556.000000000366E000.00000004.00000800.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2450708050.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002B91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002B91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: DHL_VTER000105453.exe	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.7:49704 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.DHL_VTER000105453.exe.37aeb48.7.raw.unpack, 3DlgK9re6m.cs	.Net Code: GpVHF3
Source: 0.2.DHL_VTER000105453.exe.3773728.6.raw.unpack, 3DlgK9re6m.cs	.Net Code: GpVHF3

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe

Code function: 3_2_069C5248 SetWindowsHookExA 0000000D,00000000,?,?,?,?,?,?,?,?,?,069C5890,00000000,00000000

3_2_069C5248

Installs a global keyboard hook

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\DHL_VTER000105453.exe

Jump to behavior

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.DHL_VTER000105453.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DHL_VTER000105453.exe.3773728.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DHL_VTER000105453.exe.37aeb48.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DHL_VTER000105453.exe.37aeb48.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DHL_VTER000105453.exe.3773728.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Code function: 0_2_022DD424	0_2_022DD424
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Code function: 0_2_044E3CE0	0_2_044E3CE0
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Code function: 0_2_044E00F0	0_2_044E00F0
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Code function: 0_2_04A67278	0_2_04A67278
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Code function: 0_2_04A60040	0_2_04A60040
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Code function: 0_2_04A67268	0_2_04A67268
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Code function: 0_2_06A6C1E0	0_2_06A6C1E0
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Code function: 0_2_06A60007	0_2_06A60007
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Code function: 0_2_06A6A878	0_2_06A6A878
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Code function: 0_2_06A60040	0_2_06A60040
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Code function: 0_2_06A66A00	0_2_06A66A00
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Code function: 3_2_010641F0	3_2_010641F0
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Code function: 3_2_01064AC0	3_2_01064AC0
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Code function: 3_2_01063EA8	3_2_01063EA8
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Code function: 3_2_069CA588	3_2_069CA588
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Code function: 3_2_069C0032	3_2_069C0032
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Code function: 3_2_069C0040	3_2_069C0040
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Code function: 3_2_069E079C	3_2_069E079C
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Code function: 3_2_069E6778	3_2_069E6778
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Code function: 3_2_069E8CB8	3_2_069E8CB8
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Code function: 3_2_069E93F3	3_2_069E93F3
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Code function: 3_2_069E3680	3_2_069E3680
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Code function: 3_2_069EADB8	3_2_069EADB8

Source: DHL_VTER000105453.exe

Static PE information: invalid certificate

Source: DHL_VTER000105453.exe, 00000000.00000002.1233225897.0000000004F30000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dllD vs DHL_VTER000105453.exe
Source: DHL_VTER000105453.exe, 00000000.00000002.1228882170.000000000252A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed213acd4-fb3f-466d-9fca-6bbad3fb6fd7.exe4 vs DHL_VTER000105453.exe
Source: DHL_VTER000105453.exe, 00000000.00000002.1230174556.000000000366E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed213acd4-fb3f-466d-9fca-6bbad3fb6fd7.exe4 vs DHL_VTER000105453.exe
Source: DHL_VTER000105453.exe, 00000000.00000002.1230174556.000000000366E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs DHL_VTER000105453.exe
Source: DHL_VTER000105453.exe, 00000000.00000002.1227850824.000000000061E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs DHL_VTER000105453.exe
Source: DHL_VTER000105453.exe, 00000000.00000002.1228882170.0000000002491000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dllD vs DHL_VTER000105453.exe
Source: DHL_VTER000105453.exe, 00000000.00000002.1233774134.0000000006C90000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs DHL_VTER000105453.exe
Source: DHL_VTER000105453.exe, 00000003.00000002.2452463721.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dll vs DHL_VTER000105453.exe
Source: DHL_VTER000105453.exe, 00000003.00000002.2451244129.00000000009C9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs DHL_VTER000105453.exe
Source: DHL_VTER000105453.exe, 00000003.00000002.2450708050.000000000043E000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed213acd4-fb3f-466d-9fca-6bbad3fb6fd7.exe4 vs DHL_VTER000105453.exe
Source: DHL_VTER000105453.exe	Binary or memory string: OriginalFilenameWIgI.exeX vs DHL_VTER000105453.exe

Source: DHL_VTER000105453.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 3.2.DHL_VTER000105453.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DHL_VTER000105453.exe.3773728.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DHL_VTER000105453.exe.37aeb48.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DHL_VTER000105453.exe.37aeb48.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DHL_VTER000105453.exe.3773728.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: DHL_VTER000105453.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.DHL_VTER000105453.exe.4f70000.9.raw.unpack, XG.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.DHL_VTER000105453.exe.4f70000.9.raw.unpack, XG.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.DHL_VTER000105453.exe.37aeb48.7.raw.unpack, slKb.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL_VTER000105453.exe.37aeb48.7.raw.unpack, mAKJ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL_VTER000105453.exe.37aeb48.7.raw.unpack, xQRSe0Fg.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.DHL_VTER000105453.exe.37aeb48.7.raw.unpack, n3rhMa.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.DHL_VTER000105453.exe.37aeb48.7.raw.unpack, MQzE4FWn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL_VTER000105453.exe.37aeb48.7.raw.unpack, nSmgRyX5a1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL_VTER000105453.exe.37aeb48.7.raw.unpack, 6IMLmJtk.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL_VTER000105453.exe.37aeb48.7.raw.unpack, 6IMLmJtk.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 0.2.DHL_VTER000105453.exe.6c90000.10.raw.unpack, EivdxQBqRrY0F7a36q.cs	Security API names: _0020.SetAccessControl
Source: 0.2.DHL_VTER000105453.exe.6c90000.10.raw.unpack, EivdxQBqRrY0F7a36q.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.DHL_VTER000105453.exe.6c90000.10.raw.unpack, EivdxQBqRrY0F7a36q.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.DHL_VTER000105453.exe.6c90000.10.raw.unpack, odH7uxwkgIAlQoNTtV.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: 0.2.DHL_VTER000105453.exe.24e8154.2.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.DHL_VTER000105453.exe.24f8df0.5.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.DHL_VTER000105453.exe.4f70000.9.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@3/3

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHL_VTER000105453.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe

Mutant created: NULL

Source: DHL_VTER000105453.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: DHL_VTER000105453.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: DHL_VTER000105453.exe	ReversingLabs: Detection: 65%
Source: DHL_VTER000105453.exe	Virustotal: Detection: 44%

Source: unknown	Process created: C:\Users\user\Desktop\DHL_VTER000105453.exe "C:\Users\user\Desktop\DHL_VTER000105453.exe"
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process created: C:\Users\user\Desktop\DHL_VTER000105453.exe "C:\Users\user\Desktop\DHL_VTER000105453.exe"
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process created: C:\Users\user\Desktop\DHL_VTER000105453.exe "C:\Users\user\Desktop\DHL_VTER000105453.exe"	Jump to behavior

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: DHL_VTER000105453.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: DHL_VTER000105453.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: DHL_VTER000105453.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: WIgI.pdbSHA25666 source: DHL_VTER000105453.exe
Source:	Binary string: WIgI.pdb source: DHL_VTER000105453.exe

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.DHL_VTER000105453.exe.4f70000.9.raw.unpack, XG.cs	.Net Code: Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777298)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777243)),Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777254))})
Source: 0.2.DHL_VTER000105453.exe.24e8154.2.raw.unpack, XG.cs	.Net Code: Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777298)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777243)),Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777254))})
Source: 0.2.DHL_VTER000105453.exe.24f8df0.5.raw.unpack, XG.cs	.Net Code: Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777298)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777243)),Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777254))})

.NET source code contains potential unpacker

Source: DHL_VTER000105453.exe, Form1.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.DHL_VTER000105453.exe.6c90000.10.raw.unpack, EivdxQBqRrY0F7a36q.cs	.Net Code: PLBTRis4Th System.Reflection.Assembly.Load(byte[])

Source: DHL_VTER000105453.exe

Static PE information: 0x837C71F4 [Sun Nov 27 01:42:12 2039 UTC]

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Code function: 3_2_01060C95 push edi; ret	3_2_01060CC2
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Code function: 3_2_069CE1BC push es; retf	3_2_069CE1C8
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Code function: 3_2_069C0D10 push eax; iretd	3_2_069C0D11
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Code function: 3_2_069C69E2 push es; ret	3_2_069C69F0

Source: DHL_VTER000105453.exe

Static PE information: section name: .text entropy: 7.963989519893741

Source: 0.2.DHL_VTER000105453.exe.6c90000.10.raw.unpack, eWJJrjrCfHyAmgdUTJ.cs	High entropy of concatenated method names: 'hjts5vdN3V', 'XUAsBMAhl2', 'DXJPkmAvCY', 'vhsPqFSMv9', 'TWmsOAHdMF', 'pJlsaRuPfn', 'j0hsSZObe4', 'wxhsvKnG3U', 'hRysgATNsF', 'cHqscFKCEy'
Source: 0.2.DHL_VTER000105453.exe.6c90000.10.raw.unpack, KXf5HTv1EDgWO2HJhu.cs	High entropy of concatenated method names: 'cu0V4CKetx', 's0oV8ndruL', 'c53VfvWIYW', 'twbVmHOeyY', 'sFyVCZRC1o', 'GVQV7VB0PI', 'dswVsNxtWP', 'dktVPfnSvh', 'fp5VMQHDS4', 'tbFVD6yPW7'
Source: 0.2.DHL_VTER000105453.exe.6c90000.10.raw.unpack, kenKIqxpGLXmeNMaDd.cs	High entropy of concatenated method names: 'i8pRbD89A', 'Ggh4USfww', 'QKY8UJVvO', 'y99IPVcMC', 't5kmIQhqe', 'ji80QhdOP', 'LitoIhZ6Ry43ee3K9S', 'QavkfujayuEs6hwXtP', 'UqDP5Lype', 'XpND8klPv'
Source: 0.2.DHL_VTER000105453.exe.6c90000.10.raw.unpack, dXSQFsfapwNXECTt00.cs	High entropy of concatenated method names: 'Dispose', 'S9nqtGcbd6', 'Nk86oBn2OQ', 'PXuddnWV4U', 'z5uqBRAiop', 'xrTqzMJCxV', 'ProcessDialogKey', 'ota6ktipa5', 'xer6qfE7JO', 'b2S669T2hf'
Source: 0.2.DHL_VTER000105453.exe.6c90000.10.raw.unpack, bR6y2iNVo4aQFLXY9q.cs	High entropy of concatenated method names: 'OtnqNx1ymu', 'Octqx57b18', 'yp8qQilhZd', 'Q3Mqeel5lh', 'j5IqCrT9x1', 'dibq7HoSI7', 'ixHUcR43WQXA1sQYlR', 'mGLmWVdr4cDJg9rV0Q', 'RDMwfJtiZSvZetpn5j', 'xpEqquNowB'
Source: 0.2.DHL_VTER000105453.exe.6c90000.10.raw.unpack, x9vktFQLSJNVJ3Ty78.cs	High entropy of concatenated method names: 'fWHogqeDnnWSd2Gu9cC', 'NBR6Hpegrvc3gf7OVFx', 'USLnPxKauT', 'DAdnMnZYf1', 'T2knDovyrG', 'QZVvVhewPXgJjqva6Au', 'jjs4PTek1xobkHR9sJX'
Source: 0.2.DHL_VTER000105453.exe.6c90000.10.raw.unpack, EivdxQBqRrY0F7a36q.cs	High entropy of concatenated method names: 'DPFAXMK11u', 'RlIArWqkB6', 'wnwAidfXDg', 'GudAVJipE7', 'f0NAUbRMn0', 'piNAnqiQFJ', 'xp2AN9KL1q', 'WoOAx3ePPb', 'sA4A1VniWN', 'tXTAQTmyfU'
Source: 0.2.DHL_VTER000105453.exe.6c90000.10.raw.unpack, c9F3htae5Y86s64DpE.cs	High entropy of concatenated method names: 'lnBMqFRdAI', 'GgXMAaYIqa', 'qNYMTLXv4n', 'oJ5Mr9Vnkg', 'SIjMiTEcWZ', 'jX6MUVbgT5', 'zyCMn4nA1v', 'SQ3Pb7ntHi', 'KYOP5XYFkM', 'g9FPtvdgh5'
Source: 0.2.DHL_VTER000105453.exe.6c90000.10.raw.unpack, nY6ldg53UZJwNyBNq1.cs	High entropy of concatenated method names: 'j9KNHGCItw', 'xWsNj7dHch', 'Ny0NRBet1d', 'jLaN49cTTo', 'oZ4NpyLnNp', 'KKZN8EikIq', 'RmiNImeDXA', 'SqGNfOMcHT', 'QQSNmrE3PF', 'ctvN0yThT8'
Source: 0.2.DHL_VTER000105453.exe.6c90000.10.raw.unpack, odH7uxwkgIAlQoNTtV.cs	High entropy of concatenated method names: 'JxdivYlcof', 'OAeigl45jh', 'PXJic1Dqvg', 'weiiwl4e3i', 'Lp6ilYjxH7', 'mNviL3OUv0', 'cDCib5Wx8K', 'T1ei5wD90t', 'O18itYqF6p', 'wj2iBHo82M'
Source: 0.2.DHL_VTER000105453.exe.6c90000.10.raw.unpack, kyvUJB2EHZdPSnYWy8.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'rpF6tmwxyv', 'pg16BobqjB', 'Fnq6znHB6j', 'CYuAkjmCx2', 'HNLAq4ULVR', 'NDNA6E1RDa', 'askAApndSK', 'k0xLbgy74Rj8ZLhbecC'
Source: 0.2.DHL_VTER000105453.exe.6c90000.10.raw.unpack, arC5ayzBjcojuaeCSL.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'mnPMuiBgol', 'R6ZMCVKyfi', 'FkKM7CSVTo', 'cAqMsgjKKt', 'ISRMPdZe8C', 'jG9MMjm2Gh', 'Ki9MDVjkEN'
Source: 0.2.DHL_VTER000105453.exe.6c90000.10.raw.unpack, gp9kugeE0OtsrJCCd7.cs	High entropy of concatenated method names: 'BllsQSaybq', 'VMfse80HCb', 'ToString', 'okDsrRkSx7', 'XvYsighUXj', 'k5ksVUPjs1', 'c2CsUj9sVn', 'nctsn0LhlG', 'EObsNExwnB', 'WjCsxbxvS5'
Source: 0.2.DHL_VTER000105453.exe.6c90000.10.raw.unpack, P8FBaNiroknZ56PAXm.cs	High entropy of concatenated method names: 'GY9C2fYGCp', 'vxTCat2vg9', 'jBxCvwhJ0J', 'aLvCg4WQ1r', 'OCHCoQ1W05', 'FlFCJAdmxA', 'QFbCYPOTdA', 'UBpCWw4PTK', 'KuHCF6DMux', 'SPxCKs724b'
Source: 0.2.DHL_VTER000105453.exe.6c90000.10.raw.unpack, jxQ5D9dZlba0DHcb6KH.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'DdtDv9gqKO', 'IdnDgqRdNT', 'zHTDcpbDRf', 'OOZDwbL52e', 'hBHDlQIypV', 'gakDL9fMBT', 'uSYDbyEuht'
Source: 0.2.DHL_VTER000105453.exe.6c90000.10.raw.unpack, tnRDZoKGfOyFAw15eD.cs	High entropy of concatenated method names: 'brnPyZcolr', 'HXrPouiMYK', 'OfBPJvVp1l', 'cepPYkmRgQ', 'uMvPvgJwIv', 'p97PWMq7FP', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.DHL_VTER000105453.exe.6c90000.10.raw.unpack, jRw3G3dh28QPHCpdZW0.cs	High entropy of concatenated method names: 'fU0MH7hvYf', 'QZgMjVcR3L', 'K8jMRKaas6', 'k8ZM4abtt8', 'BbDMpQ8KIf', 'cdkM8mbZNK', 'm4dMIhXX7f', 'ca9MfYkpjp', 'hG9MmwwP45', 'k5iM0K4ZtU'
Source: 0.2.DHL_VTER000105453.exe.6c90000.10.raw.unpack, rdA7BMHBudSB0ROnvU.cs	High entropy of concatenated method names: 'h3oufw2TlU', 'eJVumKR205', 'XNJuyInUa0', 'buwuoX0INd', 'W4MuYdu1K8', 'j1LuWEaZce', 'GWOuKHEICK', 'UFjuhkQXy8', 'ruCu2h9iFE', 'HKBuOBNQLw'
Source: 0.2.DHL_VTER000105453.exe.6c90000.10.raw.unpack, AbL3xt33IMuyAcYcBe.cs	High entropy of concatenated method names: 'H2SPr0M9h5', 'P5UPiqTU9C', 'YiQPVKhj43', 'U54PUApbVJ', 'wEBPnVDmSW', 'VY3PNyjvjj', 'RyQPxriHIn', 'xJkP1p0q0b', 'oY6PQX15qj', 'S8ePe8S1qt'
Source: 0.2.DHL_VTER000105453.exe.6c90000.10.raw.unpack, W2I17ZV14gi8hbPYKi.cs	High entropy of concatenated method names: 'NqRnX6W7vY', 'yKkni0BMS9', 'I2dnUZfxT9', 'HH4nNfwBWy', 'RpHnxsZhHH', 'U85UlO1tF6', 'o2eULVF8n9', 'DDHUbu9aEJ', 'hSjU5LTWWH', 'DelUt2fcG8'
Source: 0.2.DHL_VTER000105453.exe.6c90000.10.raw.unpack, GfU1u4qHP0tZw08pRa.cs	High entropy of concatenated method names: 'wmcNr2O1cA', 'dneNVC0S7G', 'F7GNnY5jE6', 'PQSnBMd3Ul', 'zjqnzcDS8F', 'Y4SNkZYivX', 'vjcNqdCe5t', 'vpMN6wWbee', 'F4sNACHft1', 'beXNTKXUCD'
Source: 0.2.DHL_VTER000105453.exe.4f70000.9.raw.unpack, XG.cs	High entropy of concatenated method names: 'S1d', 'RgtTUJcyZL', 'n1Q', 'M1r', 'Y1a', 'U1m', 'k2an4M', 'gt', 'kU', 'rK'
Source: 0.2.DHL_VTER000105453.exe.24e8154.2.raw.unpack, XG.cs	High entropy of concatenated method names: 'S1d', 'RgtTUJcyZL', 'n1Q', 'M1r', 'Y1a', 'U1m', 'k2an4M', 'gt', 'kU', 'rK'
Source: 0.2.DHL_VTER000105453.exe.24f8df0.5.raw.unpack, XG.cs	High entropy of concatenated method names: 'S1d', 'RgtTUJcyZL', 'n1Q', 'M1r', 'Y1a', 'U1m', 'k2an4M', 'gt', 'kU', 'rK'

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: DHL_VTER000105453.exe PID: 3564, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: DHL_VTER000105453.exe, 00000000.00000002.1230174556.000000000366E000.00000004.00000800.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2450708050.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Memory allocated: 22D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Memory allocated: 2490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Memory allocated: 4490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Memory allocated: 6D10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Memory allocated: 7D10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Memory allocated: 7FA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Memory allocated: 8FA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Memory allocated: 1060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Memory allocated: 2B90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Memory allocated: 2960000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 599667	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 599563	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 598668	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 593799	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 593672	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 593547	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 593390	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 593227	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 593077	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 592899	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 592731	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 592625	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 592516	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 592406	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 592297	Jump to behavior

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Window / User API: threadDelayed 3565			Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Window / User API: threadDelayed 6245			Jump to behavior

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 4216	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -35048813740048126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -599667s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -599563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -599344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -599219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -598891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -598668s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -99657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -99532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -99422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -99313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -99188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -99063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -98938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -98813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -98704s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -98579s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -98454s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -98329s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -98204s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -98047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -97922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -97813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -97688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -97565s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -97453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -97344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -96940s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -95657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -95532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -95407s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -593799s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -593672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -593547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -593390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -593227s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -593077s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -592899s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -592731s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -592625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -592516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -592406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe TID: 5904	Thread sleep time: -592297s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 599667	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 599563	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 598668	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 99657	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 99532	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 99422	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 99313	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 99188	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 99063	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 98938	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 98813	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 98704	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 98579	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 98454	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 98329	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 98204	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 98047	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 97922	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 97813	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 97688	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 97565	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 97453	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 97344	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 96940	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 95657	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 95532	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 95407	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 593799	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 593672	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 593547	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 593390	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 593227	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 593077	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 592899	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 592731	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 592625	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 592516	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 592406	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Thread delayed: delay time: 592297	Jump to behavior

Source: DHL_VTER000105453.exe, 00000003.00000002.2450708050.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: DHL_VTER000105453.exe, 00000000.00000002.1230174556.000000000366E000.00000004.00000800.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000000.00000002.1233774134.0000000006C90000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: uqe5V5IK8GQO3QeMUxS
Source: DHL_VTER000105453.exe, 00000003.00000002.2450708050.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBox
Source: DHL_VTER000105453.exe, 00000003.00000002.2452463721.0000000000ECC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe

Code function: 3_2_01067EC8 CheckRemoteDebuggerPresent,

3_2_01067EC8

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe

Memory written: C:\Users\user\Desktop\DHL_VTER000105453.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe

Process created: C:\Users\user\Desktop\DHL_VTER000105453.exe "C:\Users\user\Desktop\DHL_VTER000105453.exe"

Jump to behavior

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Queries volume information: C:\Users\user\Desktop\DHL_VTER000105453.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Queries volume information: C:\Users\user\Desktop\DHL_VTER000105453.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 3.2.DHL_VTER000105453.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.3773728.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.37aeb48.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.37aeb48.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.3773728.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2455637570.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2455637570.0000000002BF5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2455637570.0000000002C16000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2450708050.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1230174556.000000000366E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL_VTER000105453.exe PID: 3564, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL_VTER000105453.exe PID: 5060, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.4f70000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.4f70000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.24f8df0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.24f8df0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.24e8154.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.24e8154.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.24b6468.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.269f198.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.26a01b0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.26a21c8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1233395937.0000000004F70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1228882170.0000000002491000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1228882170.000000000252A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\DHL_VTER000105453.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 3.2.DHL_VTER000105453.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.3773728.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.37aeb48.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.37aeb48.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.3773728.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2455637570.0000000002BF5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2450708050.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1230174556.000000000366E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL_VTER000105453.exe PID: 3564, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL_VTER000105453.exe PID: 5060, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 3.2.DHL_VTER000105453.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.3773728.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.37aeb48.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.37aeb48.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.3773728.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2455637570.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2455637570.0000000002BF5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2455637570.0000000002C16000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2450708050.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1230174556.000000000366E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL_VTER000105453.exe PID: 3564, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL_VTER000105453.exe PID: 5060, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.4f70000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.4f70000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.24f8df0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.24f8df0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.24e8154.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.24e8154.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.24b6468.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.269f198.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.26a01b0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_VTER000105453.exe.26a21c8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1233395937.0000000004F70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1228882170.0000000002491000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1228882170.000000000252A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	111 Process Injection	1 Deobfuscate/Decode Files or Information	31 Input Capture	24 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	22 Software Packing	NTDS	421 Security Software Discovery	Distributed Component Object Model	31 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	1 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	151 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	151 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DHL_VTER000105453.exe	66%	ReversingLabs	ByteCode-MSIL.Trojan.SnakeKeyLogger
DHL_VTER000105453.exe	44%	Virustotal		Browse
DHL_VTER000105453.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
nl9.nlkoddos.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe
http://tempuri.org/DataSeta.xsd)Microsoft	0%	Avira URL Cloud	safe
http://nl9.nlkoddos.com	0%	Avira URL Cloud	safe
http://nl9.nlkoddos.com	0%	Virustotal		Browse
http://tempuri.org/DataSeta.xsd)Microsoft	2%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	172.67.74.152	true	false		high
ip-api.com	208.95.112.1	true	false		high
nl9.nlkoddos.com	89.249.49.141	true	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	DHL_VTER000105453.exe, 00000000.00000002.1230174556.000000000366E000.00000004.00000800.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2450708050.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://account.dyn.com/	DHL_VTER000105453.exe, 00000000.00000002.1230174556.000000000366E000.00000004.00000800.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2450708050.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2460798271.0000000006333000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2460798271.000000000630C000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2452463721.0000000000ECC000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2452463721.0000000000EA8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://x1.i.lencr.org/0	DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2460798271.0000000006333000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2460798271.000000000630C000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2452463721.0000000000ECC000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2452463721.0000000000EA8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/DataSeta.xsd)Microsoft	DHL_VTER000105453.exe	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ip-api.com	DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://r3.o.lencr.org0	DHL_VTER000105453.exe, 00000003.00000002.2452463721.0000000000E77000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2460798271.0000000006333000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2460798271.00000000062BA000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2460798271.000000000630C000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002C38000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/t	DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002B91000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002B91000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	DHL_VTER000105453.exe	false	URL Reputation: safe	unknown
http://nl9.nlkoddos.com	DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002C16000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://r3.i.lencr.org/0	DHL_VTER000105453.exe, 00000003.00000002.2452463721.0000000000E77000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2460798271.0000000006333000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2460798271.00000000062BA000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2460798271.000000000630C000.00000004.00000020.00020000.00000000.sdmp, DHL_VTER000105453.exe, 00000003.00000002.2455637570.0000000002C38000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
89.249.49.141	nl9.nlkoddos.com	Russian Federation	41310	IPCTRU	true
172.67.74.152	api.ipify.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1436301
Start date and time:	2024-05-04 10:01:33 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DHL_VTER000105453.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 93 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:02:23	API Interceptor	945519x Sleep call for process: DHL_VTER000105453.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	43643456.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	DHL_VTER000105450.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	DHL Receipt_AWB 9899691321..exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	Sipari#U015f.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	Aviso de cuenta vencida de DHL - 1606622076_865764325678976645423546567678967564423567890008765.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	http://www.open-sora.org	Get hash	malicious	Exela Stealer, Growtopia, Python Stealer	Browse	ip-api.com/json
	nXaujG6G1F.exe	Get hash	malicious	Blank Grabber, DCRat, Umbral Stealer	Browse	ip-api.com/json/?fields=225545
	NFs_98776.msi	Get hash	malicious	VMdetect	Browse	ip-api.com/json/
	Invoice _ 2357.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
89.249.49.141	DHL_VTER000105450.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	DHL Receipt_AWB 9899691321..exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	DHL Shipping Documents_AWB 5032675620.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.PWSX-gen.28384.29794.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Trojan.PackedNET.2779.17787.32363.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.PWSX-gen.21084.5000.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	DHL Express_AWB102235516763.PDF.exe	Get hash	malicious	AgentTesla	Browse
	Order and products specication.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.PWSX-gen.9837.19847.exe	Get hash	malicious	AgentTesla	Browse
	45lndAGIDj.exe	Get hash	malicious	AgentTesla	Browse
172.67.74.152	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SongOfVikings.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	SongOfVikings.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	43643456.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	DHL_VTER000105450.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	DHL Receipt_AWB 9899691321..exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	Sipari#U015f.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	Aviso de cuenta vencida de DHL - 1606622076_865764325678976645423546567678967564423567890008765.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	http://www.open-sora.org	Get hash	malicious	Exela Stealer, Growtopia, Python Stealer	Browse	208.95.112.1
	nXaujG6G1F.exe	Get hash	malicious	Blank Grabber, DCRat, Umbral Stealer	Browse	208.95.112.1
	NFs_98776.msi	Get hash	malicious	VMdetect	Browse	208.95.112.1
	Invoice _ 2357.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
nl9.nlkoddos.com	DHL_VTER000105450.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	89.249.49.141
	DHL Receipt_AWB 9899691321..exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	89.249.49.141
	DHL Shipping Documents_AWB 5032675620.exe	Get hash	malicious	AgentTesla	Browse	89.249.49.141
	SecuriteInfo.com.Win32.PWSX-gen.28384.29794.exe	Get hash	malicious	AgentTesla	Browse	89.249.49.141
	SecuriteInfo.com.Trojan.PackedNET.2779.17787.32363.exe	Get hash	malicious	AgentTesla	Browse	89.249.49.141
	SecuriteInfo.com.Win32.PWSX-gen.21084.5000.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	89.249.49.141
	DHL Express_AWB102235516763.PDF.exe	Get hash	malicious	AgentTesla	Browse	89.249.49.141
	Order and products specication.exe	Get hash	malicious	AgentTesla	Browse	89.249.49.141
	SecuriteInfo.com.Win32.PWSX-gen.9837.19847.exe	Get hash	malicious	AgentTesla	Browse	89.249.49.141
	45lndAGIDj.exe	Get hash	malicious	AgentTesla	Browse	89.249.49.141
api.ipify.org	DHL_VTER000105450.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	DHL Receipt_AWB 9899691321..exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	FACTURAS-ALBARANES.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Order PS24S0040.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	1110022.vbs	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Transfer copy PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	Invoice _ 2357.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	FACTURAS-ALBARANES.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	nP050NMmkE.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	http://t.co/aoL5aQEhyc	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TUT-ASUS	43643456.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	DHL_VTER000105450.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	DHL Receipt_AWB 9899691321..exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	Sipari#U015f.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	Aviso de cuenta vencida de DHL - 1606622076_865764325678976645423546567678967564423567890008765.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	http://www.open-sora.org	Get hash	malicious	Exela Stealer, Growtopia, Python Stealer	Browse	208.95.112.1
	nXaujG6G1F.exe	Get hash	malicious	Blank Grabber, DCRat, Umbral Stealer	Browse	208.95.112.1
	NFs_98776.msi	Get hash	malicious	VMdetect	Browse	208.95.112.1
	Invoice _ 2357.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
IPCTRU	DHL_VTER000105450.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	89.249.49.141
	DHL Receipt_AWB 9899691321..exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	89.249.49.141
	DHL Shipping Documents_AWB 5032675620.exe	Get hash	malicious	AgentTesla	Browse	89.249.49.141
	SecuriteInfo.com.Win32.PWSX-gen.28384.29794.exe	Get hash	malicious	AgentTesla	Browse	89.249.49.141
	SecuriteInfo.com.Trojan.PackedNET.2779.17787.32363.exe	Get hash	malicious	AgentTesla	Browse	89.249.49.141
	SecuriteInfo.com.Win32.PWSX-gen.21084.5000.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	89.249.49.141
	DHL Express_AWB102235516763.PDF.exe	Get hash	malicious	AgentTesla	Browse	89.249.49.141
	Order and products specication.exe	Get hash	malicious	AgentTesla	Browse	89.249.49.141
	SecuriteInfo.com.Win32.PWSX-gen.9837.19847.exe	Get hash	malicious	AgentTesla	Browse	89.249.49.141
	45lndAGIDj.exe	Get hash	malicious	AgentTesla	Browse	89.249.49.141
CLOUDFLARENETUS	DHL_VTER000105450.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	DHL Receipt_AWB 9899691321..exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	E7236252-receipt.vbs	Get hash	malicious	XWorm	Browse	104.21.45.138
	I7336446-receipt.vbs	Get hash	malicious	XWorm	Browse	172.67.215.45
	S94847456-receipt.vbs	Get hash	malicious	XWorm	Browse	172.67.215.45
	S847453-receipt.vbs	Get hash	malicious	XWorm	Browse	104.21.45.138
	4365078236450.LnK.lnk	Get hash	malicious	Unknown	Browse	172.67.139.174
	1CMweaqlKp.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	172.67.19.24
	SecuriteInfo.com.PossibleThreat.PALLASNET.H.14592.12237.dll	Get hash	malicious	Unknown	Browse	172.67.129.98
	https://securepdffilesaccess%E3%80%82com/docx/#9403ZGF2ZW1AY3BlcXVpdHkuY29t??nEJx==78463=/..=L5QpUY&u=276b8dda4ef94158348d5b6b8&id=6b7205781d#&vg=008d8185-7421-4d39-a8ea-d6571496b99e&stid=14&pti=1&pa=20041&pos=0&p=525094&channelId=21280b5d95ea9121&s=lsfbx0rnvkkgxzgo1sbi4b3z&sgs=2004:15-17+F-150	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	DHL_VTER000105450.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	DHL Receipt_AWB 9899691321..exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Arrival Notice.pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	Hesaphareketi-01.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	E7236252-receipt.vbs	Get hash	malicious	XWorm	Browse	172.67.74.152
	invoice PDF -2024.gz.vbs	Get hash	malicious	Unknown	Browse	172.67.74.152
	I7336446-receipt.vbs	Get hash	malicious	XWorm	Browse	172.67.74.152
	S94847456-receipt.vbs	Get hash	malicious	XWorm	Browse	172.67.74.152
	S847453-receipt.vbs	Get hash	malicious	XWorm	Browse	172.67.74.152
	LFfjUMuUFU.exe	Get hash	malicious	AsyncRAT, PureLog Stealer, XWorm	Browse	172.67.74.152

Process:	C:\Users\user\Desktop\DHL_VTER000105453.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.956439048355657
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	DHL_VTER000105453.exe
File size:	713'224 bytes
MD5:	7dec2c3596f3081f16fb71af0b1340ef
SHA1:	2f95bb30d3d11e88713b66fe1c55113e06890656
SHA256:	0144ad3c79e25335ba0bb88e4c47c497215af9d44f0dc9f8a550bf71d579ca07
SHA512:	99b383bc464f37fc5b5a8cf3e8415360e9eca70df7358fec3a2e17b045e8d928042a32ca89504ee460048e28f044efda00ef882264fdf4010c318a3a81fe8a53
SSDEEP:	12288:uVUL2iNdl0ZE1huYAo+eovnS+P1R+5DH2qhu1zbCxjLqsewT8Nu/+SyST3xT1O1V:u+1Pl0GDADZvFPD+tHlAoJewINI+SySq
TLSH:	92E4226453A86B34E3BD13F391B67621DFB2B10B3520E29C6DE650DE18F27411A74A8F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....q\|...............0.............6.... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4abe36
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x837C71F4 [Sun Nov 27 01:42:12 2039 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/11/2018 01:00:00 09/11/2021 00:59:59
Subject Chain	CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
Version:	3
Thumbprint MD5:	DABD77E44EF6B3BB91740FA46696B779
Thumbprint SHA-1:	5B9E273CF11941FD8C6BE3F038C4797BBE884268
Thumbprint SHA-256:	4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
Serial:	7C1118CBBADC95DA3752C46E47A27438

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
xor byte ptr [eax], bh
xor al, 53h
cmp byte ptr [eax], bh
inc esi
dec eax
xor eax, 00000038h
add byte ptr [eax], al
add byte ptr [edi+35h], cl
inc ebp
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [41464854h+esi], dh
dec eax
xor dh, byte ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xabde4	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xac000	0x694	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xaac00	0x3608
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xae000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa9fc0	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa9e64	0xaa000	65b841d7756ff5eb0059d412a75fc791	False	0.9630069508272059	data	7.963989519893741	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xac000	0x694	0x800	107e8aba4d5b19169ed84a92c692a58f	False	0.3662109375	data	3.628552056008294	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xae000	0xc	0x200	c3231fb56c6fbeedc0bc2b21e1af47cc	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xac090	0x404	data			0.4270428015564202
RT_MANIFEST	0xac4a4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 4, 2024 10:02:25.935018063 CEST	49704	443	192.168.2.7	172.67.74.152
May 4, 2024 10:02:25.935067892 CEST	443	49704	172.67.74.152	192.168.2.7
May 4, 2024 10:02:25.935137033 CEST	49704	443	192.168.2.7	172.67.74.152
May 4, 2024 10:02:25.942033052 CEST	49704	443	192.168.2.7	172.67.74.152
May 4, 2024 10:02:25.942061901 CEST	443	49704	172.67.74.152	192.168.2.7
May 4, 2024 10:02:26.275099039 CEST	443	49704	172.67.74.152	192.168.2.7
May 4, 2024 10:02:26.275299072 CEST	49704	443	192.168.2.7	172.67.74.152
May 4, 2024 10:02:26.278182030 CEST	49704	443	192.168.2.7	172.67.74.152
May 4, 2024 10:02:26.278194904 CEST	443	49704	172.67.74.152	192.168.2.7
May 4, 2024 10:02:26.278460026 CEST	443	49704	172.67.74.152	192.168.2.7
May 4, 2024 10:02:26.331433058 CEST	49704	443	192.168.2.7	172.67.74.152
May 4, 2024 10:02:26.331548929 CEST	49704	443	192.168.2.7	172.67.74.152
May 4, 2024 10:02:26.376118898 CEST	443	49704	172.67.74.152	192.168.2.7
May 4, 2024 10:02:26.638842106 CEST	443	49704	172.67.74.152	192.168.2.7
May 4, 2024 10:02:26.638901949 CEST	443	49704	172.67.74.152	192.168.2.7
May 4, 2024 10:02:26.638976097 CEST	49704	443	192.168.2.7	172.67.74.152
May 4, 2024 10:02:26.645406008 CEST	49704	443	192.168.2.7	172.67.74.152
May 4, 2024 10:02:26.816277981 CEST	49706	80	192.168.2.7	208.95.112.1
May 4, 2024 10:02:26.975822926 CEST	80	49706	208.95.112.1	192.168.2.7
May 4, 2024 10:02:26.975990057 CEST	49706	80	192.168.2.7	208.95.112.1
May 4, 2024 10:02:26.976759911 CEST	49706	80	192.168.2.7	208.95.112.1
May 4, 2024 10:02:27.137213945 CEST	80	49706	208.95.112.1	192.168.2.7
May 4, 2024 10:02:27.190833092 CEST	49706	80	192.168.2.7	208.95.112.1
May 4, 2024 10:02:28.122930050 CEST	49706	80	192.168.2.7	208.95.112.1
May 4, 2024 10:02:28.283855915 CEST	80	49706	208.95.112.1	192.168.2.7
May 4, 2024 10:02:28.284126997 CEST	49706	80	192.168.2.7	208.95.112.1
May 4, 2024 10:02:28.448976040 CEST	49708	587	192.168.2.7	89.249.49.141
May 4, 2024 10:02:28.760056973 CEST	587	49708	89.249.49.141	192.168.2.7
May 4, 2024 10:02:28.760246038 CEST	49708	587	192.168.2.7	89.249.49.141
May 4, 2024 10:02:29.084914923 CEST	587	49708	89.249.49.141	192.168.2.7
May 4, 2024 10:02:29.085089922 CEST	49708	587	192.168.2.7	89.249.49.141
May 4, 2024 10:02:29.396522045 CEST	587	49708	89.249.49.141	192.168.2.7
May 4, 2024 10:02:29.396689892 CEST	49708	587	192.168.2.7	89.249.49.141
May 4, 2024 10:02:29.708728075 CEST	587	49708	89.249.49.141	192.168.2.7
May 4, 2024 10:02:29.709253073 CEST	49708	587	192.168.2.7	89.249.49.141
May 4, 2024 10:02:30.026444912 CEST	587	49708	89.249.49.141	192.168.2.7
May 4, 2024 10:02:30.026468992 CEST	587	49708	89.249.49.141	192.168.2.7
May 4, 2024 10:02:30.026485920 CEST	587	49708	89.249.49.141	192.168.2.7
May 4, 2024 10:02:30.026530027 CEST	49708	587	192.168.2.7	89.249.49.141
May 4, 2024 10:02:30.066751957 CEST	49708	587	192.168.2.7	89.249.49.141
May 4, 2024 10:02:30.378413916 CEST	587	49708	89.249.49.141	192.168.2.7
May 4, 2024 10:02:30.398374081 CEST	49708	587	192.168.2.7	89.249.49.141
May 4, 2024 10:02:30.709716082 CEST	587	49708	89.249.49.141	192.168.2.7
May 4, 2024 10:02:30.719818115 CEST	49708	587	192.168.2.7	89.249.49.141
May 4, 2024 10:02:31.033971071 CEST	587	49708	89.249.49.141	192.168.2.7
May 4, 2024 10:02:31.081511021 CEST	49708	587	192.168.2.7	89.249.49.141
May 4, 2024 10:02:31.088912964 CEST	49708	587	192.168.2.7	89.249.49.141
May 4, 2024 10:02:31.423346043 CEST	587	49708	89.249.49.141	192.168.2.7
May 4, 2024 10:02:31.441693068 CEST	49708	587	192.168.2.7	89.249.49.141
May 4, 2024 10:02:31.753135920 CEST	587	49708	89.249.49.141	192.168.2.7
May 4, 2024 10:02:31.783740044 CEST	49708	587	192.168.2.7	89.249.49.141
May 4, 2024 10:02:32.104579926 CEST	587	49708	89.249.49.141	192.168.2.7
May 4, 2024 10:02:32.130573988 CEST	49708	587	192.168.2.7	89.249.49.141
May 4, 2024 10:02:32.441956043 CEST	587	49708	89.249.49.141	192.168.2.7
May 4, 2024 10:02:32.442991972 CEST	49708	587	192.168.2.7	89.249.49.141
May 4, 2024 10:02:32.443057060 CEST	49708	587	192.168.2.7	89.249.49.141
May 4, 2024 10:02:32.443084002 CEST	49708	587	192.168.2.7	89.249.49.141
May 4, 2024 10:02:32.443105936 CEST	49708	587	192.168.2.7	89.249.49.141
May 4, 2024 10:02:32.754302025 CEST	587	49708	89.249.49.141	192.168.2.7
May 4, 2024 10:02:32.754446983 CEST	587	49708	89.249.49.141	192.168.2.7
May 4, 2024 10:02:32.754496098 CEST	587	49708	89.249.49.141	192.168.2.7
May 4, 2024 10:02:32.754621983 CEST	587	49708	89.249.49.141	192.168.2.7
May 4, 2024 10:02:32.755598068 CEST	587	49708	89.249.49.141	192.168.2.7
May 4, 2024 10:02:32.800195932 CEST	49708	587	192.168.2.7	89.249.49.141
May 4, 2024 10:04:08.176841021 CEST	49708	587	192.168.2.7	89.249.49.141
May 4, 2024 10:04:08.490658998 CEST	587	49708	89.249.49.141	192.168.2.7
May 4, 2024 10:04:08.491254091 CEST	49708	587	192.168.2.7	89.249.49.141
May 4, 2024 10:04:24.452008963 CEST	49716	587	192.168.2.7	89.249.49.141
May 4, 2024 10:04:24.762847900 CEST	587	49716	89.249.49.141	192.168.2.7
May 4, 2024 10:04:24.762958050 CEST	49716	587	192.168.2.7	89.249.49.141
May 4, 2024 10:04:25.087064028 CEST	587	49716	89.249.49.141	192.168.2.7
May 4, 2024 10:04:25.089731932 CEST	49716	587	192.168.2.7	89.249.49.141
May 4, 2024 10:04:25.400904894 CEST	587	49716	89.249.49.141	192.168.2.7
May 4, 2024 10:04:25.401117086 CEST	49716	587	192.168.2.7	89.249.49.141
May 4, 2024 10:04:25.713072062 CEST	587	49716	89.249.49.141	192.168.2.7
May 4, 2024 10:04:25.713592052 CEST	49716	587	192.168.2.7	89.249.49.141
May 4, 2024 10:04:26.030025959 CEST	587	49716	89.249.49.141	192.168.2.7
May 4, 2024 10:04:26.030071974 CEST	587	49716	89.249.49.141	192.168.2.7
May 4, 2024 10:04:26.030080080 CEST	587	49716	89.249.49.141	192.168.2.7
May 4, 2024 10:04:26.033617020 CEST	49716	587	192.168.2.7	89.249.49.141
May 4, 2024 10:04:26.037616014 CEST	49716	587	192.168.2.7	89.249.49.141
May 4, 2024 10:04:26.348418951 CEST	587	49716	89.249.49.141	192.168.2.7
May 4, 2024 10:04:26.353590965 CEST	49716	587	192.168.2.7	89.249.49.141
May 4, 2024 10:04:26.665488958 CEST	587	49716	89.249.49.141	192.168.2.7
May 4, 2024 10:04:26.669617891 CEST	49716	587	192.168.2.7	89.249.49.141
May 4, 2024 10:04:26.981107950 CEST	587	49716	89.249.49.141	192.168.2.7
May 4, 2024 10:04:26.981458902 CEST	49716	587	192.168.2.7	89.249.49.141
May 4, 2024 10:04:27.316349983 CEST	587	49716	89.249.49.141	192.168.2.7
May 4, 2024 10:04:27.316709995 CEST	49716	587	192.168.2.7	89.249.49.141
May 4, 2024 10:04:27.627791882 CEST	587	49716	89.249.49.141	192.168.2.7
May 4, 2024 10:04:27.629770994 CEST	49716	587	192.168.2.7	89.249.49.141
May 4, 2024 10:04:27.949662924 CEST	587	49716	89.249.49.141	192.168.2.7
May 4, 2024 10:04:28.003777981 CEST	49716	587	192.168.2.7	89.249.49.141
May 4, 2024 10:04:29.296833038 CEST	49716	587	192.168.2.7	89.249.49.141
May 4, 2024 10:04:29.297736883 CEST	49716	587	192.168.2.7	89.249.49.141
May 4, 2024 10:04:29.357614994 CEST	49717	587	192.168.2.7	89.249.49.141
May 4, 2024 10:04:29.607358932 CEST	587	49716	89.249.49.141	192.168.2.7
May 4, 2024 10:04:29.607590914 CEST	49716	587	192.168.2.7	89.249.49.141
May 4, 2024 10:04:29.608057976 CEST	587	49716	89.249.49.141	192.168.2.7
May 4, 2024 10:04:29.608285904 CEST	49716	587	192.168.2.7	89.249.49.141
May 4, 2024 10:04:29.608702898 CEST	587	49716	89.249.49.141	192.168.2.7
May 4, 2024 10:04:29.608896017 CEST	49716	587	192.168.2.7	89.249.49.141
May 4, 2024 10:04:29.668023109 CEST	587	49717	89.249.49.141	192.168.2.7
May 4, 2024 10:04:29.668271065 CEST	49717	587	192.168.2.7	89.249.49.141
May 4, 2024 10:04:29.986018896 CEST	587	49717	89.249.49.141	192.168.2.7
May 4, 2024 10:04:29.986151934 CEST	49717	587	192.168.2.7	89.249.49.141
May 4, 2024 10:04:30.298592091 CEST	587	49717	89.249.49.141	192.168.2.7
May 4, 2024 10:04:30.298857927 CEST	49717	587	192.168.2.7	89.249.49.141
May 4, 2024 10:04:30.610152006 CEST	587	49717	89.249.49.141	192.168.2.7
May 4, 2024 10:04:30.659970999 CEST	49717	587	192.168.2.7	89.249.49.141

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 4, 2024 10:02:25.768403053 CEST	57564	53	192.168.2.7	1.1.1.1
May 4, 2024 10:02:25.928396940 CEST	53	57564	1.1.1.1	192.168.2.7
May 4, 2024 10:02:26.651097059 CEST	60168	53	192.168.2.7	1.1.1.1
May 4, 2024 10:02:26.815291882 CEST	53	60168	1.1.1.1	192.168.2.7
May 4, 2024 10:02:28.123749971 CEST	51821	53	192.168.2.7	1.1.1.1
May 4, 2024 10:02:28.448086977 CEST	53	51821	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 4, 2024 10:02:25.768403053 CEST	192.168.2.7	1.1.1.1	0xff19	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
May 4, 2024 10:02:26.651097059 CEST	192.168.2.7	1.1.1.1	0x3c57	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
May 4, 2024 10:02:28.123749971 CEST	192.168.2.7	1.1.1.1	0x6597	Standard query (0)	nl9.nlkoddos.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 4, 2024 10:02:25.928396940 CEST	1.1.1.1	192.168.2.7	0xff19	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
May 4, 2024 10:02:25.928396940 CEST	1.1.1.1	192.168.2.7	0xff19	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
May 4, 2024 10:02:25.928396940 CEST	1.1.1.1	192.168.2.7	0xff19	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
May 4, 2024 10:02:26.815291882 CEST	1.1.1.1	192.168.2.7	0x3c57	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
May 4, 2024 10:02:28.448086977 CEST	1.1.1.1	192.168.2.7	0x6597	No error (0)	nl9.nlkoddos.com	89.249.49.141	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49706	208.95.112.1	80	5060	C:\Users\user\Desktop\DHL_VTER000105453.exe

Timestamp	Bytes transferred	Direction	Data
May 4, 2024 10:02:26.976759911 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
May 4, 2024 10:02:27.137213945 CEST	174	IN	HTTP/1.1 200 OK Date: Sat, 04 May 2024 08:02:27 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 17 X-Rl: 43 Data Raw: 74 72 75 65 0a Data Ascii: true

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49704	172.67.74.152	443	5060	C:\Users\user\Desktop\DHL_VTER000105453.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-04 08:02:26 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-05-04 08:02:26 UTC	211	IN	HTTP/1.1 200 OK Date: Sat, 04 May 2024 08:02:26 GMT Content-Type: text/plain Content-Length: 13 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87e6f7f3e9940fd9-LAX
2024-05-04 08:02:26 UTC	13	IN	Data Raw: 38 31 2e 31 38 31 2e 35 34 2e 31 30 34 Data Ascii: 81.181.54.104

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 4, 2024 10:02:29.084914923 CEST	587	49708	89.249.49.141	192.168.2.7	220-nl9.nlkoddos.com ESMTP Exim 4.96.2 #2 Sat, 04 May 2024 10:02:28 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 4, 2024 10:02:29.085089922 CEST	49708	587	192.168.2.7	89.249.49.141	EHLO 707748
May 4, 2024 10:02:29.396522045 CEST	587	49708	89.249.49.141	192.168.2.7	250-nl9.nlkoddos.com Hello 707748 [81.181.54.104] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 4, 2024 10:02:29.396689892 CEST	49708	587	192.168.2.7	89.249.49.141	STARTTLS
May 4, 2024 10:02:29.708728075 CEST	587	49708	89.249.49.141	192.168.2.7	220 TLS go ahead
May 4, 2024 10:04:25.087064028 CEST	587	49716	89.249.49.141	192.168.2.7	220-nl9.nlkoddos.com ESMTP Exim 4.96.2 #2 Sat, 04 May 2024 10:04:24 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 4, 2024 10:04:25.089731932 CEST	49716	587	192.168.2.7	89.249.49.141	EHLO 707748
May 4, 2024 10:04:25.400904894 CEST	587	49716	89.249.49.141	192.168.2.7	250-nl9.nlkoddos.com Hello 707748 [81.181.54.104] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 4, 2024 10:04:25.401117086 CEST	49716	587	192.168.2.7	89.249.49.141	STARTTLS
May 4, 2024 10:04:25.713072062 CEST	587	49716	89.249.49.141	192.168.2.7	220 TLS go ahead
May 4, 2024 10:04:29.608057976 CEST	587	49716	89.249.49.141	192.168.2.7	421 Lost incoming connection
May 4, 2024 10:04:29.986018896 CEST	587	49717	89.249.49.141	192.168.2.7	220-nl9.nlkoddos.com ESMTP Exim 4.96.2 #2 Sat, 04 May 2024 10:04:28 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 4, 2024 10:04:29.986151934 CEST	49717	587	192.168.2.7	89.249.49.141	EHLO 707748
May 4, 2024 10:04:30.298592091 CEST	587	49717	89.249.49.141	192.168.2.7	250-nl9.nlkoddos.com Hello 707748 [81.181.54.104] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 4, 2024 10:04:30.298857927 CEST	49717	587	192.168.2.7	89.249.49.141	STARTTLS
May 4, 2024 10:04:30.610152006 CEST	587	49717	89.249.49.141	192.168.2.7	220 TLS go ahead

Target ID:	0
Start time:	10:02:23
Start date:	04/05/2024
Path:	C:\Users\user\Desktop\DHL_VTER000105453.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DHL_VTER000105453.exe"
Imagebase:	0x150000
File size:	713'224 bytes
MD5 hash:	7DEC2C3596F3081F16FB71AF0B1340EF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1233395937.0000000004F70000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1228882170.0000000002491000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1230174556.000000000366E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1230174556.000000000366E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1228882170.000000000252A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:02:24
Start date:	04/05/2024
Path:	C:\Users\user\Desktop\DHL_VTER000105453.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DHL_VTER000105453.exe"
Imagebase:	0x790000
File size:	713'224 bytes
MD5 hash:	7DEC2C3596F3081F16FB71AF0B1340EF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2455637570.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2455637570.0000000002BF5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2455637570.0000000002BF5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2455637570.0000000002C16000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2450708050.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2450708050.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	200
Total number of Limit Nodes:	16

Executed Functions

Function 04A67278 Relevance: 4.7, Strings: 2, Instructions: 2178
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

'Nq, xrefs: 04A672F9
$Nq, xrefs: 04A672D2

Memory Dump Source

Source File: 00000000.00000002.1232834243.0000000004A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID: 'Nq$$Nq
API String ID: 0-3789758286
Opcode ID: 17628ac8fa9a51fb8ed254ec04b12b22074cd7b8f1433bbdcac5f94da4c2edfa
Instruction ID: 9adddd10a515e3468c3bc3c7e9c7f41b1c63e4e2ac2820ccf3f996b50c104253
Opcode Fuzzy Hash: 17628ac8fa9a51fb8ed254ec04b12b22074cd7b8f1433bbdcac5f94da4c2edfa
Instruction Fuzzy Hash: 9433D634A11219CFDB65EB64C994A99B7B1FF8A304F5142EAD4097B3A0DB31AEC5CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04A67268 Relevance: 4.6, Strings: 2, Instructions: 2122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

'Nq, xrefs: 04A672F9
$Nq, xrefs: 04A672D2

Memory Dump Source

Source File: 00000000.00000002.1232834243.0000000004A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID: 'Nq$$Nq
API String ID: 0-3789758286
Opcode ID: fb08063bfb16c49950dde8b281f6e5bb5aa9ff3f383ca314affc1674223f108f
Instruction ID: 4f51501e12b476702a331412775c9f7fa01a4a3f7e35817373e433e68b6859b7
Opcode Fuzzy Hash: fb08063bfb16c49950dde8b281f6e5bb5aa9ff3f383ca314affc1674223f108f
Instruction Fuzzy Hash: 5133C534A11219CFDB65EB64C994A99B7B1FF8A304F5142EAD4097B3A0DB31AEC5CF40

Uniqueness

Uniqueness Score: -1.00%

Function 044E3CE0 Relevance: .7, Instructions: 651COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1231953475.00000000044E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_44e0000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 527e4c30e54ded909cf14aab7ecc06239e7a1132d8400dab7c9f73f3ed8edd22
Instruction ID: 80818d9ef01efc3afa74e525f69a58a20b8e4c0a6ab7ddb2efcd6fcd3f9294f1
Opcode Fuzzy Hash: 527e4c30e54ded909cf14aab7ecc06239e7a1132d8400dab7c9f73f3ed8edd22
Instruction Fuzzy Hash: 98328A30B012049FEB19DFAAD450BBEB7F6AF89706F14846AE5069B395CB35EC01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06A6C1E0 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233738316.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85601d7d91e921cba6f43935c922b23892d8355aa6e8b541b7769cabb40857a5
Instruction ID: c8d291400a6a0598b8c4663b9eed50cc8e81211ccb04a46e323b83359b1b3041
Opcode Fuzzy Hash: 85601d7d91e921cba6f43935c922b23892d8355aa6e8b541b7769cabb40857a5
Instruction Fuzzy Hash: FD51E474E052099FDB44DFAAD5809AEFBF6FF88310F14C166E419A7255D7309942CF90

Uniqueness

Uniqueness Score: -1.00%

Function 044E093D Relevance: 1.7, APIs: 1, Instructions: 249
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 044E0B7E

Memory Dump Source

Source File: 00000000.00000002.1231953475.00000000044E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_44e0000_DHL_VTER000105453.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 4523a489e28c46592ac3c80e58890820f2cc4d17f990a93d66f87a2b04242a2b
Instruction ID: 92ffa5b36b4cc30968ed5fb34c451f3c8ba4c273dc51d943f741d21835c6601d
Opcode Fuzzy Hash: 4523a489e28c46592ac3c80e58890820f2cc4d17f990a93d66f87a2b04242a2b
Instruction Fuzzy Hash: 43A14C71D013299FEF24CF69C8407EEBBB2FB48315F14856AD818A7244DB74A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 044E0948 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 044E0B7E

Memory Dump Source

Source File: 00000000.00000002.1231953475.00000000044E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_44e0000_DHL_VTER000105453.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: e360dcc4adad8bd8dee3953b05aa6a3efbc1e36dd7960e7346783282168351b2
Instruction ID: 46317e3a1f0454108d8ac368072d2df15acbd97f87cdb56632dea7e00b839413
Opcode Fuzzy Hash: e360dcc4adad8bd8dee3953b05aa6a3efbc1e36dd7960e7346783282168351b2
Instruction Fuzzy Hash: 69915E71D01329DFEF24CF69C8407AEBBF2BB48315F14856AD818A7244DB74A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 022DADC8 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 022DB01E

Memory Dump Source

Source File: 00000000.00000002.1228672892.00000000022D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_DHL_VTER000105453.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 929dfbcbe0abcac5bbb8be5445983c935ead95bcd99b77b1281f614b914573c1
Instruction ID: dd78c703b3b2a72c15112858dc4e0da2d9210341fb619a2be73da0a1c91581ea
Opcode Fuzzy Hash: 929dfbcbe0abcac5bbb8be5445983c935ead95bcd99b77b1281f614b914573c1
Instruction Fuzzy Hash: B5714870A10B068FD724DFAAD454B5ABBF1FF88304F00892DD48AD7A54DB75E846CB94

Uniqueness

Uniqueness Score: -1.00%

Function 022D590D Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 022D59C9

Memory Dump Source

Source File: 00000000.00000002.1228672892.00000000022D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_DHL_VTER000105453.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 5c69e115922d6e69e579ab788cbbea4ff178cdf2539034f2d26f8f4b7e0706ad
Instruction ID: 3fac23ffc7770401838d25a6a445784676e863d5fc1de712f6e563839b17064a
Opcode Fuzzy Hash: 5c69e115922d6e69e579ab788cbbea4ff178cdf2539034f2d26f8f4b7e0706ad
Instruction Fuzzy Hash: F141E371C01729CBEB24CFA5C88479DBBB1BF48314F60816AD409AB255DBB56946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 022D5A84 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1228672892.00000000022D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7e657ba810a82a5ccc9628fbb5a1c9df5f05f1e2fb5ea4b841a98d98016a482
Instruction ID: 10e2c6636183b48de121a1292dfde221b7f0fe982a481e5dc3befeab79004a95
Opcode Fuzzy Hash: a7e657ba810a82a5ccc9628fbb5a1c9df5f05f1e2fb5ea4b841a98d98016a482
Instruction Fuzzy Hash: EE31CC72C05759CFEB20CBE8C8457EDBBF1EF46314F90818AC005AB259C7B9A94ACB40

Uniqueness

Uniqueness Score: -1.00%

Function 022D44D4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 022D59C9

Memory Dump Source

Source File: 00000000.00000002.1228672892.00000000022D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_DHL_VTER000105453.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: dc7ffa427ae2f924a414be4355e0332e0d83375a5c13da4ce7dae6916456f284
Instruction ID: 9dd0ad019330fe899a345415cc67f692174970061fe738942919659bda5297e7
Opcode Fuzzy Hash: dc7ffa427ae2f924a414be4355e0332e0d83375a5c13da4ce7dae6916456f284
Instruction Fuzzy Hash: 9141F370C1072DCBEB24DFAAC844B9DBBF1BF48314F60816AD408AB255DBB56946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04A64040 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04A64101

Memory Dump Source

Source File: 00000000.00000002.1232834243.0000000004A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a60000_DHL_VTER000105453.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 3ae4e93a8069242c50b898a9d8dae429e3a165e6e7b7c9fcf206e81ce03474ad
Instruction ID: ac65cb51bd30e2a6fdffddc9e63f88b72b8881ea40eb96c868963529420b94d2
Opcode Fuzzy Hash: 3ae4e93a8069242c50b898a9d8dae429e3a165e6e7b7c9fcf206e81ce03474ad
Instruction Fuzzy Hash: F24135B8A00319DFDB14CF99C848AAABBF5FB88314F258459D519AB321D775A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 044E06B9 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 044E0750

Memory Dump Source

Source File: 00000000.00000002.1231953475.00000000044E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_44e0000_DHL_VTER000105453.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 195e99f042b5306c0149da204471e4709f25692e3f197beb31df4f267d3b7f14
Instruction ID: eaf06290cbe74af6936e0bf819f4f8ddc253b135fc68aa7ae5ad7e06bc391cbc
Opcode Fuzzy Hash: 195e99f042b5306c0149da204471e4709f25692e3f197beb31df4f267d3b7f14
Instruction Fuzzy Hash: 85213775D003598FDB20DFAAC881BEEBBF1FB48310F14852AE959A7240C778A941DF64

Uniqueness

Uniqueness Score: -1.00%

Function 044E06C0 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 044E0750

Memory Dump Source

Source File: 00000000.00000002.1231953475.00000000044E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_44e0000_DHL_VTER000105453.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 51f4aaa174a9c6f5416922c94b28dbce9b1d413e7503f4df6b4f460e54199f37
Instruction ID: 8dc8a95a7a018816d3033553e1690001e721afe7442af14bab230de3494f17ec
Opcode Fuzzy Hash: 51f4aaa174a9c6f5416922c94b28dbce9b1d413e7503f4df6b4f460e54199f37
Instruction Fuzzy Hash: C7211575D003599FDB10DFAAC881BEEBBF5FB48310F50842AE919A7240C778A951CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 044E0521 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 044E05A6

Memory Dump Source

Source File: 00000000.00000002.1231953475.00000000044E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_44e0000_DHL_VTER000105453.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 3d8c285d136be3abf40dbb993e117dfb560bae3fa38491e6fd0708b9a75d11ac
Instruction ID: 59da39de0c683b2f27b02f9500651f249cc92adc70bf386fd62e4c01b10ec048
Opcode Fuzzy Hash: 3d8c285d136be3abf40dbb993e117dfb560bae3fa38491e6fd0708b9a75d11ac
Instruction Fuzzy Hash: D3213975D003098FDB20DFAAC4857EEBBF1EB48321F54852AD959A7240CB78A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 044E07A8 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 044E0830

Memory Dump Source

Source File: 00000000.00000002.1231953475.00000000044E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_44e0000_DHL_VTER000105453.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b193295a4abafd69338568b238d601ca41d59ba43c2eca087fe58f09a4ddc2ba
Instruction ID: cb0effc4fd9213adf0b475e45a97fa743323eb7a17dfb014fa339ef9dcd14ea3
Opcode Fuzzy Hash: b193295a4abafd69338568b238d601ca41d59ba43c2eca087fe58f09a4ddc2ba
Instruction Fuzzy Hash: 40213971C003599FDB10CFAAC880BEEBBF1FF48310F54842AE959A7240C7789541DB65

Uniqueness

Uniqueness Score: -1.00%

Function 044E001A Relevance: 1.6, APIs: 1, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 044E00A2

Memory Dump Source

Source File: 00000000.00000002.1231953475.00000000044E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_44e0000_DHL_VTER000105453.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 086209f9fcf233b9c9c03a89cf61e79ad1650a0bd0ade76f7f05cf60ad80d3cd
Instruction ID: ae03288045595e9f5165baeee5714cb03f13c7b7c65fecdf0f311e1aea4b95b7
Opcode Fuzzy Hash: 086209f9fcf233b9c9c03a89cf61e79ad1650a0bd0ade76f7f05cf60ad80d3cd
Instruction Fuzzy Hash: 6D218B75C003588FDB20DFA9D8417EFBBF1EF88314F14845AC455A7250C6356506CF91

Uniqueness

Uniqueness Score: -1.00%

Function 022DBB40 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,022DD676,?,?,?,?,?), ref: 022DD737

Memory Dump Source

Source File: 00000000.00000002.1228672892.00000000022D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_DHL_VTER000105453.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4f67f4c86466b5f391def0c67f6773d4ee8d1e9bd7ea04100f1a917d82c96f8c
Instruction ID: 5acbf088872856defeb62f406e9391c501ab08ca515df7958c5031c8f9aec79c
Opcode Fuzzy Hash: 4f67f4c86466b5f391def0c67f6773d4ee8d1e9bd7ea04100f1a917d82c96f8c
Instruction Fuzzy Hash: AE21E5B5D103499FDB10CF9AD584AEEBBF4EB48310F14845AE958A3350D374A951CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 044E0528 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 044E05A6

Memory Dump Source

Source File: 00000000.00000002.1231953475.00000000044E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_44e0000_DHL_VTER000105453.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: f6c1f4387dce9456a819758fe7376602d9d595ecd0fa7d24c42b7d83f3bebc24
Instruction ID: 99228520599c70422ebed199bb6c66480e583f521ed3d1b9cb7f3c1803b0f51d
Opcode Fuzzy Hash: f6c1f4387dce9456a819758fe7376602d9d595ecd0fa7d24c42b7d83f3bebc24
Instruction Fuzzy Hash: F6213871D003098FDB20DFAAC4857AEBBF4EF48320F54842AD859A7240CB78A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 044E07B0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 044E0830

Memory Dump Source

Source File: 00000000.00000002.1231953475.00000000044E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_44e0000_DHL_VTER000105453.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 6baa59541a93c268e76b45fea3cc55e7e8043e762a623c2ac661e82c33ffa2c7
Instruction ID: 8259aef693f46e44f050da5a3bcf9621327048eb80cf322be6080f7697b1a956
Opcode Fuzzy Hash: 6baa59541a93c268e76b45fea3cc55e7e8043e762a623c2ac661e82c33ffa2c7
Instruction Fuzzy Hash: 4C212871C003599FDB10DFAAC881BEEBBF5FF48310F50842AE919A7240C779A951DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 022DD6A8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,022DD676,?,?,?,?,?), ref: 022DD737

Memory Dump Source

Source File: 00000000.00000002.1228672892.00000000022D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_DHL_VTER000105453.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5d19d689184c8ac415b0403aaec0b455eceab1cd9249bb1934b9b113e1f381f0
Instruction ID: 05827ea025752606918ece2fbef8661280fa4ff62d32d476a32a23e8c2e8e5e5
Opcode Fuzzy Hash: 5d19d689184c8ac415b0403aaec0b455eceab1cd9249bb1934b9b113e1f381f0
Instruction Fuzzy Hash: CC21E4B5D00249DFDB10CFAAD984ADEBFF5EB48310F14805AE954A7350C378A951CF64

Uniqueness

Uniqueness Score: -1.00%

Function 044E05F9 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 044E066E

Memory Dump Source

Source File: 00000000.00000002.1231953475.00000000044E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_44e0000_DHL_VTER000105453.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9a5c2dc26d8ab79aa5d076c3eb85ef8c43dd0168bd9ca5e24ea9a006d5e63492
Instruction ID: c01958f58696f927b2f1d890c94ccc99ff8f944a95c3d85c82bcb68b7ec48ca8
Opcode Fuzzy Hash: 9a5c2dc26d8ab79aa5d076c3eb85ef8c43dd0168bd9ca5e24ea9a006d5e63492
Instruction Fuzzy Hash: 671147759003498FDB20DFAAC844BEEBBF1EF88320F24851AE555A7250C775A941DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 022DA168 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,022DB099,00000800,00000000,00000000), ref: 022DB2AA

Memory Dump Source

Source File: 00000000.00000002.1228672892.00000000022D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_DHL_VTER000105453.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ced3443136a3185817d984620a358b2b4d807b6c8226626a2c9ce99579cd9c01
Instruction ID: 8fa44107825cbb148b37efd25c5c64befc0582466f25af0cda89b703b7e51838
Opcode Fuzzy Hash: ced3443136a3185817d984620a358b2b4d807b6c8226626a2c9ce99579cd9c01
Instruction Fuzzy Hash: 791117B6D103099FDB20CF9AC444B9EFBF4EB48314F11842ED515A7200C7B5A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 022DB238 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,022DB099,00000800,00000000,00000000), ref: 022DB2AA

Memory Dump Source

Source File: 00000000.00000002.1228672892.00000000022D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_DHL_VTER000105453.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: fcd5cb5449acbc826531e4a7ed21ae3a2bc6674a6d66dee1ded2cc949e57e015
Instruction ID: 36a889932a5456c4be0b3c3b5b1d93411365caea16367c6e7f5470123ff2c6b0
Opcode Fuzzy Hash: fcd5cb5449acbc826531e4a7ed21ae3a2bc6674a6d66dee1ded2cc949e57e015
Instruction Fuzzy Hash: E81117B6D002098FDB20DF9AC944BDEFBF4EB48314F11841ED415A7600C775A546CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 044E0600 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 044E066E

Memory Dump Source

Source File: 00000000.00000002.1231953475.00000000044E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_44e0000_DHL_VTER000105453.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1eeee0328537dbd9391a216eed4b471dc938048bc02899c5dc7aa9d2e7377ebf
Instruction ID: 514a187868c7cd916655a5c1df15a7b0d4edd29fe3d0a678bd5089e45f080cca
Opcode Fuzzy Hash: 1eeee0328537dbd9391a216eed4b471dc938048bc02899c5dc7aa9d2e7377ebf
Instruction Fuzzy Hash: F61117718003499FDB20DFAAC845BEEBBF5EB88320F148419E515A7250CB75A951CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 044E4D99 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,044E4C51,?,?), ref: 044E4DF8

Memory Dump Source

Source File: 00000000.00000002.1231953475.00000000044E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_44e0000_DHL_VTER000105453.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 1d76ad74e5ba39b0e375492d7bc8c3ac922bd8bf9545cfbb93d268dbad14adb5
Instruction ID: bb32a7edc1fac9a5f9237c7c30af020877f804de3a979f299d036934ed6b2e79
Opcode Fuzzy Hash: 1d76ad74e5ba39b0e375492d7bc8c3ac922bd8bf9545cfbb93d268dbad14adb5
Instruction Fuzzy Hash: F51128B58002598FDB20DF99C545BEEBBF0EB48320F24841AD559A7740C738A645CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 044E4888 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,044E4C51,?,?), ref: 044E4DF8

Memory Dump Source

Source File: 00000000.00000002.1231953475.00000000044E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_44e0000_DHL_VTER000105453.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 9ba385e0cce7038b6cd4705a7266b549bb065a3cb18fa3d6b8782eea891ecb29
Instruction ID: e1994cb1d4619ce827139a71e5feed5d12d3fe99496e04ae646cd66107531d38
Opcode Fuzzy Hash: 9ba385e0cce7038b6cd4705a7266b549bb065a3cb18fa3d6b8782eea891ecb29
Instruction Fuzzy Hash: 571166B5C003498FDB20DF9AC445BEEBBF4EB48320F10842AD959A7340D738A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 044E0040 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 044E00A2

Memory Dump Source

Source File: 00000000.00000002.1231953475.00000000044E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_44e0000_DHL_VTER000105453.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 838ed0a25c2c1bdf4263b483ea3888577c645aa092b33499de21010996a8c0c3
Instruction ID: 142d934dfdfa455f04707d36782bb76b8be533da61267186d2adf67d1d5f04d1
Opcode Fuzzy Hash: 838ed0a25c2c1bdf4263b483ea3888577c645aa092b33499de21010996a8c0c3
Instruction Fuzzy Hash: 3C115871C003488FDB20DFAAC4457AEFBF4EB88324F20841AD519A7240CB79A941CF91

Uniqueness

Uniqueness Score: -1.00%

Function 044E2C29 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 044E2C8D

Memory Dump Source

Source File: 00000000.00000002.1231953475.00000000044E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_44e0000_DHL_VTER000105453.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: b32e6167cc91bf7c751a227881e5b240579ebd47683f03369b27f73c96434eb6
Instruction ID: e73b9fdb8d80bb0d150d35b83234373d12c6a1f06aaae54809116cf520b9c522
Opcode Fuzzy Hash: b32e6167cc91bf7c751a227881e5b240579ebd47683f03369b27f73c96434eb6
Instruction Fuzzy Hash: 4F1136B98003498FDB20DF9AD945BEEBFF8FB48310F10845AD554A7200C374A545CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 022DAFB8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 022DB01E

Memory Dump Source

Source File: 00000000.00000002.1228672892.00000000022D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_DHL_VTER000105453.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d7bb395bc2d66300b91a883c87b3a6a5e8d55efc4363b1d6d17018f7d6517069
Instruction ID: 60f25a94ed996d1cc6f2e550a40e9986ff5088c80b6ee9807c60812f69b51216
Opcode Fuzzy Hash: d7bb395bc2d66300b91a883c87b3a6a5e8d55efc4363b1d6d17018f7d6517069
Instruction Fuzzy Hash: B411DFB5C003498FDB20DF9AD444B9EFBF4EB88325F11842AD829A7610D379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 044E2C30 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 044E2C8D

Memory Dump Source

Source File: 00000000.00000002.1231953475.00000000044E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_44e0000_DHL_VTER000105453.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 12aecbb203eba144edb9482c360556c2613de734a5040a57db8dcf35a42e0705
Instruction ID: e55709a8ef70ea80f54d47af850a747f5e423a89cb6ec5bf7d2722244bcd3443
Opcode Fuzzy Hash: 12aecbb203eba144edb9482c360556c2613de734a5040a57db8dcf35a42e0705
Instruction Fuzzy Hash: E211D3B58003499FDB20DF9AD945BDEBBF8FB48320F10845AD559A7250C379A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A6EDB8 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233738316.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97aff27b97d1b468ee4dffb559d51177a644c2685dcb269a2a86cf7f9d19b4cd
Instruction ID: 374df9c928e6733114664ed9656dad30b015469fc026be5ec1f5791639286424
Opcode Fuzzy Hash: 97aff27b97d1b468ee4dffb559d51177a644c2685dcb269a2a86cf7f9d19b4cd
Instruction Fuzzy Hash: BD61D478E08208DFDB48DFAAD944AADBBF6FF89300F10912AE519AB354D7715846CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06A68ED8 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233738316.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c09692dfa0053c0cc8e2e0c79fc6dc615964bbb2a16a4b0f04b9e38d931e4cd2
Instruction ID: 1642d099e6bc31b6e8f094c1b92b5d942bdb35d4f2cd3a5a95bfd7ae41f5e9cc
Opcode Fuzzy Hash: c09692dfa0053c0cc8e2e0c79fc6dc615964bbb2a16a4b0f04b9e38d931e4cd2
Instruction Fuzzy Hash: 9F51E130B043068FDB15EB7A9C845AFBBF6FFC5220715856AE415DB391EB309C068791

Uniqueness

Uniqueness Score: -1.00%

Function 06A6C4F0 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233738316.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56720d1de4628e91eb541b407fd5803bedd7243d765530f895318fe6ed7e1c1d
Instruction ID: 15d2b0aa01a7d5749c1cedd617d9b826bb4cb7c4826652b4525e51253b100de5
Opcode Fuzzy Hash: 56720d1de4628e91eb541b407fd5803bedd7243d765530f895318fe6ed7e1c1d
Instruction Fuzzy Hash: 9851E578E04219DFDB44DFAAC9409ADBBF1FB49360F10942AE856EB354D730A801CF94

Uniqueness

Uniqueness Score: -1.00%

Function 06A683F0 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233738316.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a61e63a15c76daed1e7615331512516e939d3c74e3846bd432d5a9afd0337283
Instruction ID: a91e083a67f3ca1bf2458e4999b2418778ed4d37bc9d77d22f0a1829f700680e
Opcode Fuzzy Hash: a61e63a15c76daed1e7615331512516e939d3c74e3846bd432d5a9afd0337283
Instruction Fuzzy Hash: D951F474E142089FDB45EFA9E894A9EBBF6FB89310F108025E905B7358CB749D41CF64

Uniqueness

Uniqueness Score: -1.00%

Function 06A681D8 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233738316.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15f8afbfadf55f8349e21954ababaa7797fcbcae760d273b9be35758ef817737
Instruction ID: 4b5d9e31b1fa07fcddae702c4c24a69e5edb8d6753cc7728a88490aa41c5f3b1
Opcode Fuzzy Hash: 15f8afbfadf55f8349e21954ababaa7797fcbcae760d273b9be35758ef817737
Instruction Fuzzy Hash: 1941F238E012189FDB00EFA8D484AEEBBF6FB48320F109455E914B7354D7359995CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06A67EC8 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233738316.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd0d71314857c70964dc5417f500c0873a64b60828d2191dbeabc623385750c6
Instruction ID: 625ff29432302a32b7db4f31a3fb11b38d313a9670a0e9932372d73232797230
Opcode Fuzzy Hash: dd0d71314857c70964dc5417f500c0873a64b60828d2191dbeabc623385750c6
Instruction Fuzzy Hash: 75312A74E00209AFDB05DF98E840AEEBBB5FF48310F108565E915BB354D7709A41CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0227D1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1228438707.000000000227D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0227D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_227d000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4300eca757d4c9295c791cbdcb9d899b89877dd535948c850be78fd76dbc2fab
Instruction ID: 1fca639f62e4bbcbb3fd849b7e817633f705c847d286ac1000986d6eecfc5cd4
Opcode Fuzzy Hash: 4300eca757d4c9295c791cbdcb9d899b89877dd535948c850be78fd76dbc2fab
Instruction Fuzzy Hash: 0A21F172618200DFDB05DF90D9C4B26BB65FF98310F24C5A9E8090A24BC3B6D817CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0227D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1228438707.000000000227D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0227D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_227d000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dadf1c8010678c74a8ddefc469496fb7808d46eef076ed4022b702ae4b7e9e1
Instruction ID: 6c725f5029240c3d245e9ba561fea9057f102c8b91d3e44196f423ba3d464fca
Opcode Fuzzy Hash: 3dadf1c8010678c74a8ddefc469496fb7808d46eef076ed4022b702ae4b7e9e1
Instruction Fuzzy Hash: 9E212571518241DFDB15DF54D9C0B26BF65FF88328F24C669E8090B25AC336D456CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0228D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1228497554.000000000228D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0228D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_228d000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d2c3538c86a9d2d7ad8085115114947cdcd6312c06b762617a44d6cb5e20c74
Instruction ID: 480639f6b447854a97b7fb0b32df6c3ceb9c1a5f22169c60565b23256f090dd6
Opcode Fuzzy Hash: 9d2c3538c86a9d2d7ad8085115114947cdcd6312c06b762617a44d6cb5e20c74
Instruction Fuzzy Hash: E9212275614300DFDB14EFA0D9C4B16BBA1EB84324F20C56DD84A4B3CAC376D80BCA62

Uniqueness

Uniqueness Score: -1.00%

Function 0228D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1228497554.000000000228D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0228D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_228d000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e4d7cf0d3b2e6a73eb529a571d799e77a875960445e2f95c82f3f1df5123a1
Instruction ID: 4c46d5a3151bc4a713542b5c0acf348a25d3f4099a651d87d9ce75e09eca7ff7
Opcode Fuzzy Hash: f3e4d7cf0d3b2e6a73eb529a571d799e77a875960445e2f95c82f3f1df5123a1
Instruction Fuzzy Hash: 51212571614200DFDB04EFA0D9C0B25BBA1FB84314F20C66DD8094B2DEC3B6D80ACA62

Uniqueness

Uniqueness Score: -1.00%

Function 06A67BE0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233738316.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f565853dfdcbcf09904495f9b545e46fb66f8753fa3155e11a3daa8f715304c0
Instruction ID: feae3ad1230dc9b41f428dc16c852c026d7942520501b327f81ab2170fd175c0
Opcode Fuzzy Hash: f565853dfdcbcf09904495f9b545e46fb66f8753fa3155e11a3daa8f715304c0
Instruction Fuzzy Hash: ED312774A10608EFD744DF5AE684A8DBBF5FF88300B6280D5D548AB365DB30EE91DB04

Uniqueness

Uniqueness Score: -1.00%

Function 06A69078 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233738316.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb27fbf12e6e1a2f7f3b6efeb3661856131ff88ecbe15e30ee0bea36b6a66c8b
Instruction ID: b7f9934889cc27326c3ea513ea2189c5f6a3882331c0e1e48a47710e2a9ebe37
Opcode Fuzzy Hash: eb27fbf12e6e1a2f7f3b6efeb3661856131ff88ecbe15e30ee0bea36b6a66c8b
Instruction Fuzzy Hash: 6631C0B0D013199FEB60DF9AC984B8EBBF5EF48314F258059E404BB250C7B5A845CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0228D007 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1228497554.000000000228D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0228D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_228d000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71983e0fc855712e27f204d27bea19294618ae30dfaadb0bf99f979b6ad84811
Instruction ID: 6cc7a8b634090e7345430f310af31497fbe308b9ea8a7e29a6ceae8daf114a55
Opcode Fuzzy Hash: 71983e0fc855712e27f204d27bea19294618ae30dfaadb0bf99f979b6ad84811
Instruction Fuzzy Hash: AB218E755093808FDB02DF64D990715BF71EB46314F28C5DAD8898B6A7C33AD80ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 06A69C10 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233738316.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc6468a467a3eee055afcc23977a3d57b4b6ee1b6234b4adb56ee9230e8a6add
Instruction ID: 04ffbf2fc200c9db392170cb14b449284f4eb57016e28477587dfcf6c7c39564
Opcode Fuzzy Hash: cc6468a467a3eee055afcc23977a3d57b4b6ee1b6234b4adb56ee9230e8a6add
Instruction Fuzzy Hash: 28112131F0021A8FCB54EBB998106EFBAF6AF84311B104069D505EB344EB319D01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0227D1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1228438707.000000000227D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0227D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_227d000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fa0a9b6888ab601070468a7c49be392b44274aed9e91ce62da6c30ec0883e0c
Instruction ID: c8c09a5df6f97ba0085e6906ae38a6ee090334ae3df926c467a6ca27fa6639f6
Opcode Fuzzy Hash: 6fa0a9b6888ab601070468a7c49be392b44274aed9e91ce62da6c30ec0883e0c
Instruction Fuzzy Hash: 1C219D76508240DFDB06CF50D9C4B56BF62FF84314F24C5AADC490A65AC37AD426CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06A6B310 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233738316.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2051b13df625b3d73df8c974e4e9fc3cda87f8c24ddd79d664fc499e029d1c9
Instruction ID: b65ed81f1f19d2fe7eb081a647f3477b67e024d7abd0c9d8494e32f7eb99b9bd
Opcode Fuzzy Hash: e2051b13df625b3d73df8c974e4e9fc3cda87f8c24ddd79d664fc499e029d1c9
Instruction Fuzzy Hash: FF2103B5C003499FDB20DF9AC884BDEBBF4FB48320F108429E919A7210C375A955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0227D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1228438707.000000000227D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0227D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_227d000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: f9a7a2fca49f99a1d43a644ef281a8b07d9b8e5e2814babb1a0ca0cfbee87ab9
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: 5411E676504280CFCB15CF54D5C4B16BF72FF84328F24C6A9D8490B65AC336D45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0228D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1228497554.000000000228D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0228D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_228d000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: ff290665af784f81a777a4d8f5cf6b6b8ca656dd7f1231b9b19b1006ae0b8418
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 1D11BB75544280DFDB05EF64C5C0B15BBA2FB84324F24C6ADD8494B29AC37AD41ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 06A67D78 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233738316.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 610fd1dc0e9d6eaccf361799b639f4e272f1d3ffc788e271c4efa167d57286f4
Instruction ID: 3cafb1379bf17e0a7e3a0500b9cd57623811a74089d39dbcdcf78bded762e888
Opcode Fuzzy Hash: 610fd1dc0e9d6eaccf361799b639f4e272f1d3ffc788e271c4efa167d57286f4
Instruction Fuzzy Hash: BB11D238A10608EFC740DF99F484A99BBF8FB88310F5240D1DA84A7369D734EEA0CB45

Uniqueness

Uniqueness Score: -1.00%

Function 0227D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1228438707.000000000227D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0227D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_227d000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1695868f8aff53fc5b7b222eb717911a81bedc1b2534aaf77c940e49cc61aca8
Instruction ID: 051b0b84736a1838b7428f1b981e2e37990fdc36e6e847d60c39ba4ae8a271b9
Opcode Fuzzy Hash: 1695868f8aff53fc5b7b222eb717911a81bedc1b2534aaf77c940e49cc61aca8
Instruction Fuzzy Hash: F901263102C3409BE7205EA5CDC4BA6BF98DF81235F18C56AED090F28AC7799841CBB6

Uniqueness

Uniqueness Score: -1.00%

Function 0227D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1228438707.000000000227D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0227D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_227d000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56a8cf0940c23b2ecad6843027d792258117101939008aa38290d0f272621a6e
Instruction ID: 5dfce04cf18ded47d9016a37a4be95cb67edd9541faf69892f86c61fd186547a
Opcode Fuzzy Hash: 56a8cf0940c23b2ecad6843027d792258117101939008aa38290d0f272621a6e
Instruction Fuzzy Hash: 51F0F6310083409EE7208E15CC88B62FF98EF81334F18C05AED084B286C379A840CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 06A6A260 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233738316.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf10f04cf97d6123117cb48b65fb3cc3a62970392442fb51a290d8f3f1313fd0
Instruction ID: d12efaa5471c1085ebc0f5ddbfc5ae581645c31ec8e7b7923187f702fce9d9be
Opcode Fuzzy Hash: cf10f04cf97d6123117cb48b65fb3cc3a62970392442fb51a290d8f3f1313fd0
Instruction Fuzzy Hash: E501E870C40219DFDB94DFABC4087AEBBF1BF49350F108665E925AA2A0D7754A44CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 06A6A300 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233738316.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10db46ef48bd2e4b7a515e9e2726118434786d6310103e8d17e2be840d082c59
Instruction ID: b9e306ef89c51a49b324cb58668f34584faffcefc04e08502402684078cdf36e
Opcode Fuzzy Hash: 10db46ef48bd2e4b7a515e9e2726118434786d6310103e8d17e2be840d082c59
Instruction Fuzzy Hash: C4E06D767042286F9314DBAEDC84D6BBBEEFBCC674351807AF508C7314D9319C0186A0

Uniqueness

Uniqueness Score: -1.00%

Function 06A6B6B8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233738316.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af94b5a7548347116452d1d17368967b1d345eaa139bb3d5f0eea3d589549a4e
Instruction ID: 1829c60b9cb1fc8dc8e98a7d8b9024aec494d786592b36440077b5a7ad791a0d
Opcode Fuzzy Hash: af94b5a7548347116452d1d17368967b1d345eaa139bb3d5f0eea3d589549a4e
Instruction Fuzzy Hash: 27F065726001087F9F48EF59DC41C9EBFEEEF44220F15807AF409DB224E631E9608B64

Uniqueness

Uniqueness Score: -1.00%

Function 06A68770 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233738316.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5de83b4400d195b5e86c17bfdaf760dd908379377e101a202b1d15d86ddb9b65
Instruction ID: 8b5797465ef3ea931cc2d0abaebda6b785981631e5ab06c8568753e4cd7af6c7
Opcode Fuzzy Hash: 5de83b4400d195b5e86c17bfdaf760dd908379377e101a202b1d15d86ddb9b65
Instruction Fuzzy Hash: 89E01A75908208FBCB04DF94E840AADBF79FB49310F1481A9ED0427351C7329A61EB95

Uniqueness

Uniqueness Score: -1.00%

Function 06A67E80 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233738316.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a6d283590ab5d82517e47b04ba07879c57fdc63dbf621fc5bb7bffbf6f57ae4
Instruction ID: a3d542cd384b178f2488c1e0e337b655e1399829d1b182d5cb3a4281dc5dc6ab
Opcode Fuzzy Hash: 7a6d283590ab5d82517e47b04ba07879c57fdc63dbf621fc5bb7bffbf6f57ae4
Instruction Fuzzy Hash: 83E04F39908208FBCB44EF94E8409ADBB79FB46314F10C199EC0817351D7329E55DB80

Uniqueness

Uniqueness Score: -1.00%

Function 06A6FEF8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233738316.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7d51ab433ec0ca616b338d8da1673fe385c0a3dad860f4c033c5770c0462e2f
Instruction ID: c0cf892f97fd3750e2545f1f80efc68073e70c6d3d6c4feed8aff0755c94b30c
Opcode Fuzzy Hash: d7d51ab433ec0ca616b338d8da1673fe385c0a3dad860f4c033c5770c0462e2f
Instruction Fuzzy Hash: 33E01A70E0420CEBDB58EFEDD40469DBBF5EB89301F1080A99908A7350D6785E41DF92

Uniqueness

Uniqueness Score: -1.00%

Function 06A669B0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233738316.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e3db940ddc7595ad203d4247795fa9ab175db249efb61726b8fa95f48c4ada4
Instruction ID: ebb95cbab53e03d12879cb59beeb42bc24e72bf9292440063d8d06f1f4646129
Opcode Fuzzy Hash: 4e3db940ddc7595ad203d4247795fa9ab175db249efb61726b8fa95f48c4ada4
Instruction Fuzzy Hash: 5BE0867180420CEFD740FFB1E50479D77FCDB0A205F0015A5A90D97150EA355D049796

Uniqueness

Uniqueness Score: -1.00%

Function 06A683A8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233738316.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 691225d6b9b5b1eeacca38a0f74a697fc1e40ae264cbc8ad97223c1b29f0e417
Instruction ID: 59a03e57a1e72fc8a22b3ad79722384c8a4119fc088f1d4a66443a9c7a435f53
Opcode Fuzzy Hash: 691225d6b9b5b1eeacca38a0f74a697fc1e40ae264cbc8ad97223c1b29f0e417
Instruction Fuzzy Hash: 37E08C34908208EBCB04EF94E940AACFBBCFB4A300F1091A9EC0427341D7329E52EB94

Uniqueness

Uniqueness Score: -1.00%

Function 06A67D38 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233738316.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d3b107c3f006df8efa757330cc0747b782be2edc0e3a2fa715b93943ba89507
Instruction ID: abde47600f6d0943676ca6c71f99c2737ad8582c3f73951b4c0c4f99d7f1ed76
Opcode Fuzzy Hash: 0d3b107c3f006df8efa757330cc0747b782be2edc0e3a2fa715b93943ba89507
Instruction Fuzzy Hash: 94E0C234908208EBDB04EFA4E44067CBBF8EB46308F1081ACD90917351CB31AE42DF80

Uniqueness

Uniqueness Score: -1.00%

Function 06A6E3D8 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233738316.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3072da3c3abcde304c98a64589640ce7fd8ceb0b46f40627acfe5c3c7cdb8567
Instruction ID: 1202abcf66bd372ceaa6393c21fd4f886f75b5a7ac8e4061cf50ce6ad5bdd105
Opcode Fuzzy Hash: 3072da3c3abcde304c98a64589640ce7fd8ceb0b46f40627acfe5c3c7cdb8567
Instruction Fuzzy Hash: BAC08C30000308D7D3043BA5F44C32477ACE702202F402211A309818608BB80CD9C666

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04A60040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1232834243.0000000004A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10eac5fbe841f78d50f9fd0d285c08599a54af2cec3defb22dc39d3e60758ee7
Instruction ID: 9d0f0224b08f3b3a561959df747cab763ebb15697032b08d552aa782dba382ab
Opcode Fuzzy Hash: 10eac5fbe841f78d50f9fd0d285c08599a54af2cec3defb22dc39d3e60758ee7
Instruction Fuzzy Hash: 1912C4B0509745AAD352DF25EA4C1893FA2FB8133CF924729D2612E2E5D7BC194ACFC4

Uniqueness

Uniqueness Score: -1.00%

Function 044E00F0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1231953475.00000000044E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_44e0000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc158cc108d7043d035b4956a4e2b7d7627ec72b2e5d973a5ceb412f731d5a2b
Instruction ID: 43e1d4762834131a8f475f59f3a450d8eb14ff76e638e8ed30b8872a1949f220
Opcode Fuzzy Hash: dc158cc108d7043d035b4956a4e2b7d7627ec72b2e5d973a5ceb412f731d5a2b
Instruction Fuzzy Hash: 02E11A74E002198FDB14DFA9C580AAEFBF2BF49305F24856AD415AB35AD770AD42CF60

Uniqueness

Uniqueness Score: -1.00%

Function 06A6A878 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233738316.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fe58508ff51f571939bdbc8017590a8297d77c047ac7218a95b214082f8d640
Instruction ID: f960ed3e0f255556e9968d673e48351c4598988bf4aa7d7c05d5c41cc2989dd3
Opcode Fuzzy Hash: 9fe58508ff51f571939bdbc8017590a8297d77c047ac7218a95b214082f8d640
Instruction Fuzzy Hash: BFD1F635D2075A8ADB10EBA4D850AD9B7B1FF95340F11C79AD5093B224EB706EC9CF81

Uniqueness

Uniqueness Score: -1.00%

Function 022DD424 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1228672892.00000000022D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22d0000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12fa925b710853a38988f8178f4bf38bebc890f69a5d18ee9c1d1681ef28ba41
Instruction ID: bfa02be157270fd88bb31e451b182f5479c57dc5568881c5f236836015a0af4f
Opcode Fuzzy Hash: 12fa925b710853a38988f8178f4bf38bebc890f69a5d18ee9c1d1681ef28ba41
Instruction Fuzzy Hash: 56A16C36E103158FCF05DFB4CA445DEBBB2FF84301B15856AE802AB669DB71E946CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06A60040 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233738316.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0eb878ec5dd40e7639609833d0070faa11892f7bd6cca36aec7dbb38f2be0dd
Instruction ID: 8dcf6bb3d5bd02511e76c2bae53be8150a4abd3f61ef35194b8d5702ee748831
Opcode Fuzzy Hash: e0eb878ec5dd40e7639609833d0070faa11892f7bd6cca36aec7dbb38f2be0dd
Instruction Fuzzy Hash: 0E51A2B4E016188FEB68CF2AD95479DBAF7AFC8200F14C1EAD50DA7264DB751A95CF00

Uniqueness

Uniqueness Score: -1.00%

Function 06A60007 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1233738316.0000000006A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a60000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76fcffe16a0c80970fc8980e8f801a2274356f60cee8f18007f681a5f33692c7
Instruction ID: 7881c055b5333b9e39589d77d087da06c72d043d725943ae4a84e8f5474b2b7c
Opcode Fuzzy Hash: 76fcffe16a0c80970fc8980e8f801a2274356f60cee8f18007f681a5f33692c7
Instruction Fuzzy Hash: 3341C8B1D057588FEB19CF6BCD5478ABBF3AFC9200F04C1AAC448AB165DB7509868F51

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: DHL_VTER000105453.exePID: 5060, Parent PID: 3564COMMON

Execution Graph

Execution Coverage:	11.7%
Dynamic/Decrypted Code Coverage:	96.6%
Signature Coverage:	1%
Total number of Nodes:	292
Total number of Limit Nodes:	28

Executed Functions

Function 01067EC8 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 01067F3F

Memory Dump Source

Source File: 00000003.00000002.2455171343.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1060000_DHL_VTER000105453.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: f11c435f9a2bee919f06fe37fdd7166caf0000ff9848f8d0d8f1223e8c87c917
Instruction ID: 6f52b7c7b9d1e89f9eb9295ac686bb69af67ba55e777b719acc6f8b9d207634e
Opcode Fuzzy Hash: f11c435f9a2bee919f06fe37fdd7166caf0000ff9848f8d0d8f1223e8c87c917
Instruction Fuzzy Hash: E5212871C002598FDB10CF9AD844BEEFBF4AF49310F14845AE959A3250D778A945CF65

Uniqueness

Uniqueness Score: -1.00%

Function 069C5248 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(0000000D,00000000,?,?,?,?,?,?,?,?,?,069C5890,00000000,00000000), ref: 069C5AA3

Memory Dump Source

Source File: 00000003.00000002.2461740832.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69c0000_DHL_VTER000105453.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 665c80c873559416ee024c74053b32b3e0dd3e9ae5235fa9901f6de7cb0fa7f1
Instruction ID: 547debe44b781b11471abaf33265ffca582091a29261ccd82bc1ab97e1d678d5
Opcode Fuzzy Hash: 665c80c873559416ee024c74053b32b3e0dd3e9ae5235fa9901f6de7cb0fa7f1
Instruction Fuzzy Hash: A4212775D002099FDB54DF9AC844BEEFBF5EB88320F148429E419A7250C774A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 069C3CC4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 73
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?), ref: 069C3D58

Strings

W, xrefs: 069C3CCC

Memory Dump Source

Source File: 00000003.00000002.2461740832.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69c0000_DHL_VTER000105453.jbxd

Similarity

API ID: Clipboard
String ID: W
API String ID: 220874293-655174618
Opcode ID: 952a881b0a7c9baf7cfb9d2388699270bd5c76ec93c1e6c1427d90fcb5baf033
Instruction ID: 4a1663b226123e4f7650ca71c3a71c1cd33b5f1ecbda099b9ebe385df9174d71
Opcode Fuzzy Hash: 952a881b0a7c9baf7cfb9d2388699270bd5c76ec93c1e6c1427d90fcb5baf033
Instruction Fuzzy Hash: 703131B0D01349DFEB24DFA9C984BDEBBF5AF08314F24805AE044AB294DBB46845CF61

Uniqueness

Uniqueness Score: -1.00%

Function 069EF2E8 Relevance: 1.6, APIs: 1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2461794968.00000000069E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69e0000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5211bb132049dfeed4a2f62468190a8af5ef97a80ba80b7b00d02a1a2cf090b
Instruction ID: 21791584c9257963e2ed74ffb65e190bc4a4761353731248a0f98051ac8aa846
Opcode Fuzzy Hash: b5211bb132049dfeed4a2f62468190a8af5ef97a80ba80b7b00d02a1a2cf090b
Instruction Fuzzy Hash: B641F031D043958FCB15CFA9D8006EEFBF5AF8A210F14896BD498E7741DB349846CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 069C0A25 Relevance: 1.6, APIs: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 069C0B42

Memory Dump Source

Source File: 00000003.00000002.2461740832.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69c0000_DHL_VTER000105453.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 986dfe3ca22880e072bf0a5ee45607ba3549669493daaa426e494a574f7d21d3
Instruction ID: c758f4163eea3978ba88f4d1740ef0d266c53263fdaff217c6105dd53b2cd3fa
Opcode Fuzzy Hash: 986dfe3ca22880e072bf0a5ee45607ba3549669493daaa426e494a574f7d21d3
Instruction Fuzzy Hash: C851CCB5D003499FDB14CFA9C884ADEBFB5BF88310F64852AE818AB210D771A841CF90

Uniqueness

Uniqueness Score: -1.00%

Function 069C0A30 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 069C0B42

Memory Dump Source

Source File: 00000003.00000002.2461740832.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69c0000_DHL_VTER000105453.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 67c2bb2183856989ec3cc17ff09ac34663fcd4db386879cf1da96f69e1b7c925
Instruction ID: d0f3f4a386e2fbd2fb0ec1c992e6477f5645231e39e7d7bcdd58ff93d83ffca0
Opcode Fuzzy Hash: 67c2bb2183856989ec3cc17ff09ac34663fcd4db386879cf1da96f69e1b7c925
Instruction Fuzzy Hash: 2441CCB1D00309DFDF14CFAAC884ADEBBB5BF88310F24852AE818AB210D7719941CF91

Uniqueness

Uniqueness Score: -1.00%

Function 069C1DEC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 069C3049

Memory Dump Source

Source File: 00000003.00000002.2461740832.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69c0000_DHL_VTER000105453.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 87c5c748b370b8516883c76ede4badf85a3705a028194d62e6b533aff12d404c
Instruction ID: 9dc05125da86c25f1c74792fc9d48e2819de430ba53245d8c83a8adeeb1e2eec
Opcode Fuzzy Hash: 87c5c748b370b8516883c76ede4badf85a3705a028194d62e6b533aff12d404c
Instruction Fuzzy Hash: A2414A759003498FDB54CF99C488AAABBF5FF88314F24C89DD519A7321D335A841CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 069C9509 Relevance: 1.6, APIs: 1, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32(0000004B), ref: 069C957D

Memory Dump Source

Source File: 00000003.00000002.2461740832.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69c0000_DHL_VTER000105453.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: a675148d91321c7975981ec6c706b0726ecc2ccdf532fbfa26313829e9783882
Instruction ID: 03ef0c4c64991625bd28697eb14211e3f9bc3cd61331076a8e5285dfde40f641
Opcode Fuzzy Hash: a675148d91321c7975981ec6c706b0726ecc2ccdf532fbfa26313829e9783882
Instruction Fuzzy Hash: 3131EE71C45384CFEB61DF6AD5443AA7FF8AB06360F54449EC894AB682C7389608CB62

Uniqueness

Uniqueness Score: -1.00%

Function 069C3648 Relevance: 1.6, APIs: 1, Instructions: 74
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?), ref: 069C3D58

Memory Dump Source

Source File: 00000003.00000002.2461740832.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69c0000_DHL_VTER000105453.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: cc03adc0e8e1491cd1a7d75cefe34c8bb726d6e8ebf3ac0c51102b64fe3801c6
Instruction ID: 8976ddc00f0d3cf3e67307810e7a3ba6f43a89244bc73462e97d60d576d72c0b
Opcode Fuzzy Hash: cc03adc0e8e1491cd1a7d75cefe34c8bb726d6e8ebf3ac0c51102b64fe3801c6
Instruction Fuzzy Hash: 6E31F4B0D01309DFDB54DFA9C984BDEBBF5AF48314F208459E504AB290DB746845CF95

Uniqueness

Uniqueness Score: -1.00%

Function 01067EC0 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 01067F3F

Memory Dump Source

Source File: 00000003.00000002.2455171343.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1060000_DHL_VTER000105453.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: fc25b59b4779e5556f5ce0f4e77562919d35e403b445fd9f789a6ad3d75a3412
Instruction ID: 2431aeeadac96a4a27595633cc8bd1abc4b27fafd81d9d43da5e67ad9fd0abb5
Opcode Fuzzy Hash: fc25b59b4779e5556f5ce0f4e77562919d35e403b445fd9f789a6ad3d75a3412
Instruction Fuzzy Hash: 5C213971C002598FDB10CF9AD444BEEBBF4EF49310F14845AE954A7251D7789945CF60

Uniqueness

Uniqueness Score: -1.00%

Function 069C20EA Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 069C2177

Memory Dump Source

Source File: 00000003.00000002.2461740832.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69c0000_DHL_VTER000105453.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 16158f74818b7e5f77b8a141c71c6691feba801bf943da6e6f71ef4e8cd56044
Instruction ID: 7fac95739e5f46d30a3108ec73ce2412619389096694974fbc61832ba38ac371
Opcode Fuzzy Hash: 16158f74818b7e5f77b8a141c71c6691feba801bf943da6e6f71ef4e8cd56044
Instruction Fuzzy Hash: 2621E3B5D00349AFDB10CFAAD884AEEFFF5EB48320F14841AE954A3250D375A945CF65

Uniqueness

Uniqueness Score: -1.00%

Function 069C20F0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 069C2177

Memory Dump Source

Source File: 00000003.00000002.2461740832.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69c0000_DHL_VTER000105453.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 417ea18cf4d7de27a091578f25f1d2ec5b8548694ba70ecb1f0995613a6a5f54
Instruction ID: 362fdd52ad45aafe326fb7580b4d94ca1e97254cd70807e1e98012ed4cef1032
Opcode Fuzzy Hash: 417ea18cf4d7de27a091578f25f1d2ec5b8548694ba70ecb1f0995613a6a5f54
Instruction Fuzzy Hash: A121E4B5D003499FDB10CFAAD884ADEFBF8EB48320F14841AE954A3350D375A945CF65

Uniqueness

Uniqueness Score: -1.00%

Function 069C5A26 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(0000000D,00000000,?,?,?,?,?,?,?,?,?,069C5890,00000000,00000000), ref: 069C5AA3

Memory Dump Source

Source File: 00000003.00000002.2461740832.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69c0000_DHL_VTER000105453.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: c71fa00bbe0f33773cf48b35ba6950f2d011b99485774a8058df4075d30eb1ae
Instruction ID: ccc090473a067711fe8d61416231c5dc32dcc1625c7155b11ba69376ea54f32a
Opcode Fuzzy Hash: c71fa00bbe0f33773cf48b35ba6950f2d011b99485774a8058df4075d30eb1ae
Instruction Fuzzy Hash: 65211575D002099FDB14DF9AC844BEEFBF5EB88320F10842AE459A7250C774A941CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 069CBB04 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,00000000,?,069CC829,00000800), ref: 069CC8BA

Memory Dump Source

Source File: 00000003.00000002.2461740832.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69c0000_DHL_VTER000105453.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 37035e8c18fb300b07034f409d273679c424550fb77bd6e0e5d42d4a9267f108
Instruction ID: 9176de35ea023279dcebcf582bd9bd46f0ee33bccd63a24ae3a17bba76498e4e
Opcode Fuzzy Hash: 37035e8c18fb300b07034f409d273679c424550fb77bd6e0e5d42d4a9267f108
Instruction Fuzzy Hash: AA11C2B6D00349DFDB20DF9AC844A9EFBF4EB48320F10842ED559A7640C775A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 069EE9D4 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,069EF33A), ref: 069EF427

Memory Dump Source

Source File: 00000003.00000002.2461794968.00000000069E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69e0000_DHL_VTER000105453.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: e49caf0883015b5768dae494c7796e15f7b29098781cd862540f66954c426698
Instruction ID: ed7c296bde7fefbd80407e2e08dec77ccd387ce8d8e01c2ab0e148ca19a822eb
Opcode Fuzzy Hash: e49caf0883015b5768dae494c7796e15f7b29098781cd862540f66954c426698
Instruction Fuzzy Hash: 761144B1C0065A9BDB10DF9AC844BEEFBF4EB48320F10852AD918A7340D378A905CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 069C32B8 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,069C3295), ref: 069C331F

Memory Dump Source

Source File: 00000003.00000002.2461740832.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69c0000_DHL_VTER000105453.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 1a382f45763c5eed2e9da0c061201680db343d67001abe269e59c4d2b90047f9
Instruction ID: ca84acd886b8e411182bf631a3da52a94025eeab4b2f0ea8902b892a85011f8e
Opcode Fuzzy Hash: 1a382f45763c5eed2e9da0c061201680db343d67001abe269e59c4d2b90047f9
Instruction Fuzzy Hash: 6C1132B5D002498FDB20DF9AD844BDEFBF8EB48324F20841AD968A3640C735A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 069CC848 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,00000000,?,069CC829,00000800), ref: 069CC8BA

Memory Dump Source

Source File: 00000003.00000002.2461740832.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69c0000_DHL_VTER000105453.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5fb493faef57cb73e9a74d6994d3c46b45a0b548af0ada249541c3eb907afc8d
Instruction ID: d9dd3cbce0655e348e142e557ccaf826c3189171a741168d3dc0c07fbe7980d3
Opcode Fuzzy Hash: 5fb493faef57cb73e9a74d6994d3c46b45a0b548af0ada249541c3eb907afc8d
Instruction Fuzzy Hash: 5D1103B6C0034A8FDB20CF9AC944B9EFBF5AB48320F14842ED959A7640C375A546CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 069EF3B8 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,069EF33A), ref: 069EF427

Memory Dump Source

Source File: 00000003.00000002.2461794968.00000000069E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69e0000_DHL_VTER000105453.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: c53220c126ca8df41982e9d4dddd49a5e5f9eabcb451adc77fbe5eec7dc9426d
Instruction ID: f495a216cea5b0c41dbd1fc05e4e2f2228c1b584fd35925d14e10ea7cafdb931
Opcode Fuzzy Hash: c53220c126ca8df41982e9d4dddd49a5e5f9eabcb451adc77fbe5eec7dc9426d
Instruction Fuzzy Hash: 861147B1C0025A8FDB10CFAAD544BDEFBF4EF48310F15856AD458A7240D3389905CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0106F308 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0106F376

Memory Dump Source

Source File: 00000003.00000002.2455171343.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1060000_DHL_VTER000105453.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 385ba23333c6ed84b855eaf00c4c0ec19125dab7e723e68146328edaf102e506
Instruction ID: 31fedb14b3402bd13b73ebcb52e6548c27c5813b7dcef17ba291921ad50ed57e
Opcode Fuzzy Hash: 385ba23333c6ed84b855eaf00c4c0ec19125dab7e723e68146328edaf102e506
Instruction Fuzzy Hash: 361104B5C002498FDB20DF9AD444ADEFFF4EF88310F14855AD4A9A7610C375A546CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0106DCDC Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0106F376

Memory Dump Source

Source File: 00000003.00000002.2455171343.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1060000_DHL_VTER000105453.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 6ee9db5177790215063e452b840834a8978092f94e346433993fb2ceb6534b3a
Instruction ID: 058aef309f7397f868aaf862ebaf6049b232bb1201ab3c184c66e85b86fd7dbb
Opcode Fuzzy Hash: 6ee9db5177790215063e452b840834a8978092f94e346433993fb2ceb6534b3a
Instruction Fuzzy Hash: DA1134B5C003498FDB10DF9AD444B9EFBF8EB48310F10846AD568B7210C375A505CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 069C3B80 Relevance: 1.5, APIs: 1, Instructions: 47comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 069C3BDD

Memory Dump Source

Source File: 00000003.00000002.2461740832.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69c0000_DHL_VTER000105453.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 398c51ce1ebd395694c5481da5b11f48aaa991f62c07762b86af7fdfb78514ea
Instruction ID: 86774e13367400b14ef4467e6cc15ea44738014771b87ff283e2d43b8b79b9a7
Opcode Fuzzy Hash: 398c51ce1ebd395694c5481da5b11f48aaa991f62c07762b86af7fdfb78514ea
Instruction Fuzzy Hash: C81133B5C003498FDB20DF9AC845BDEFBF8EB48320F208819D598A7200C378A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 069C1E8C Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 069C3BDD

Memory Dump Source

Source File: 00000003.00000002.2461740832.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69c0000_DHL_VTER000105453.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 971589fbc126034deb91ce2873b86d6e34f8c7e37b00d3257bc8463162c8d1f5
Instruction ID: cde2713bd836d98d55c9c5b2267c16c635e8777686305a5863d6438ce11e22e5
Opcode Fuzzy Hash: 971589fbc126034deb91ce2873b86d6e34f8c7e37b00d3257bc8463162c8d1f5
Instruction Fuzzy Hash: 391145B5C007498FDB20DF9AD445B9EFBF4EB48320F208419D519A3300C378A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 069C1E44 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,069C3295), ref: 069C331F

Memory Dump Source

Source File: 00000003.00000002.2461740832.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69c0000_DHL_VTER000105453.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: ed9a09c68ee5e7681b0dcbba230752ad42945db30c4dff0d83fa76b11e7b6c3b
Instruction ID: 6fbeee42810cc79ddc0641bf31d296cffd22471a0b3d9015b47f2d16de132334
Opcode Fuzzy Hash: ed9a09c68ee5e7681b0dcbba230752ad42945db30c4dff0d83fa76b11e7b6c3b
Instruction Fuzzy Hash: 541110B08003498FDB20DF9AD845BDEBBF4EB48320F208419D519A3240C775A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 069C334C Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,069C3295), ref: 069C331F

Memory Dump Source

Source File: 00000003.00000002.2461740832.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69c0000_DHL_VTER000105453.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 935e977fbf126b2aadd60c0eef8620f92ed4cc37ec073bff5ef72fb95f92cc16
Instruction ID: 162f8a02e00c1f488ba53aa992d03ff507584e35bbdee9ce615337cbfcfc4ae4
Opcode Fuzzy Hash: 935e977fbf126b2aadd60c0eef8620f92ed4cc37ec073bff5ef72fb95f92cc16
Instruction Fuzzy Hash: 31F0F6B2C043818EDB618B95D8053DDBFF0DB45325F54C48EC15997651D3395109CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0101D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454639796.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_101d000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35d028dbde4e3b48e49127c3554edeb3edddddad7ae75eff895d47c304687f94
Instruction ID: 90587bc543beadecfc15ab777da4e030399640a2153736132ba463b862bb6072
Opcode Fuzzy Hash: 35d028dbde4e3b48e49127c3554edeb3edddddad7ae75eff895d47c304687f94
Instruction Fuzzy Hash: 3D2128715042049FDB16DF64D9C8B16BBA1FB84314F20C6ADE9890F246C73AD847CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0101D20C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454639796.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_101d000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e49907fe4b1c636ce20b5d9c29e23902032e9b415e2bb3dc8ef5655382881df
Instruction ID: 888ea5b24bdb23aac2f253be8f5def69b5af3f461655c11a6dcacb6329a0d532
Opcode Fuzzy Hash: 4e49907fe4b1c636ce20b5d9c29e23902032e9b415e2bb3dc8ef5655382881df
Instruction Fuzzy Hash: 9D214671604244DFDB11DF94D8C8B6ABBA5FB94334F20C6ADD8890B24AC37ED406CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0101D3BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454639796.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_101d000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d24959587a2ceb7f85e13bc655948e0accd0d22931d7e57728d7ae7e42987b3d
Instruction ID: 745e1d88ccaf758b876a2087035068bb215d54a141d9de3a0286018557b57696
Opcode Fuzzy Hash: d24959587a2ceb7f85e13bc655948e0accd0d22931d7e57728d7ae7e42987b3d
Instruction Fuzzy Hash: C4213775644300DFDB05DF54D5C8B56BBA1FB84314F20C5ADD8890F28AC73AE446CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0101D207 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454639796.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_101d000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf2aa0ac69dbfc9ab00947b0048f034b327edea99ed69b312f674443a93577a4
Instruction ID: c251d3fbfa2c8f11467a39f5c714311c22924a894352450104cf3630f9bd9e72
Opcode Fuzzy Hash: bf2aa0ac69dbfc9ab00947b0048f034b327edea99ed69b312f674443a93577a4
Instruction Fuzzy Hash: 7311B275504284CFDB12CF54D5C4B55FFA2FB84324F24C6AAD8894B656C33AD406CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0101D3B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454639796.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_101d000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: ad656ae1c57a09ab81fd75263a02a80d62a230ab7a5c925bba567cbe9380e415
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 6C11D075544240CFCB06CF54D5C4B55BFA2FB44314F24C6ADD8894B256C33AE40ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 0101D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454639796.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_101d000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: cda24cf085172f2e9ec35266101a9c80975c5cad08de89907aa7704580f15144
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: ED11D075504244DFCB16CF54C5C4B15BFA2FB44314F24C6ADE8894B256C33AD44ACF51

Uniqueness

Uniqueness Score: -1.00%

Function 0100D8C5 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454547398.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100d000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e2f8cc7b2f74c00fabfc84971cd387503080bef3a8f4f7cd5da466701151385
Instruction ID: 247b183242bc5931ae3c0ab0e37c9b9355e4e36f037fc9993c47abd25c78f2b4
Opcode Fuzzy Hash: 9e2f8cc7b2f74c00fabfc84971cd387503080bef3a8f4f7cd5da466701151385
Instruction Fuzzy Hash: A501F731004344AAF7624A99DC84B2ABFD8DF45225F04C46AED880A2C2C2789841CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0100D8C4 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454547398.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_100d000_DHL_VTER000105453.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2bf9dc2ecec26534af67a7484bc65b068f321023672aa98b17ba98101dfc5ca
Instruction ID: 885161841703b613bdd3c40e394d17aa7b026708719a7038bd6447b0648157e0
Opcode Fuzzy Hash: a2bf9dc2ecec26534af67a7484bc65b068f321023672aa98b17ba98101dfc5ca
Instruction Fuzzy Hash: 38F06271404344AEFB518E5ADC84B66FFD8EB45734F18C59AED884A2C7C2799844CBB1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DHL_VTER000105453.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHL_VTER000105453.exe.log

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
DHL_VTER000105453.exe

Function 04A67278 Relevance: 4.7, Strings: 2, Instructions: 2178
COMMON

Function 04A67268 Relevance: 4.6, Strings: 2, Instructions: 2122
COMMON

Function 044E093D Relevance: 1.7, APIs: 1, Instructions: 249
processCOMMON

Function 044E0948 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 022DADC8 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Function 022D590D Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Function 022D5A84 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 022D44D4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 04A64040 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Function 044E06B9 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Function 044E06C0 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 044E0521 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Function 044E07A8 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Function 044E001A Relevance: 1.6, APIs: 1, Instructions: 65
threadCOMMON

Function 022DBB40 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre