⚠️ Overview

DeliveryCheck is a .NET‑based malware loader first documented by Proofpoint researchers in June 2021, operated by the financially motivated threat group TA505 (also tracked as FIN12 and GRACEFUL SPIDER). It functions as a downloader and stager, primarily used to deliver second‑stage payloads such as Cobalt Strike Beacon, Buer Loader, and ransomware (e.g., Maze, Ryuk). The malware is categorized as a loader/trojan, designed to establish initial access and enable persistent remote control over compromised networks.

🔧 Technical Capabilities

DeliveryCheck propagates via spear‑phishing emails containing malicious Microsoft Excel attachments with obfuscated VBA macros or ISO/LNK file bundles. Once executed, the loader connects to its command‑and‑control (C2) infrastructure over HTTPS, often using domains mimicking legitimate software update services. It employs process injection into legitimate processes (e.g., svchost.exe) and uses scheduled tasks or registry Run keys for persistence (MITRE ATT&CK T1053.005, T1547.001). Evasion techniques include string obfuscation, anti‑debugging checks (e.g., IsDebuggerPresent), and sandbox detection via sleep loops and CPU temperature queries. The loader retrieves encrypted payloads from the C2, decrypts them with a hard‑coded XOR key, and executes them in memory to avoid disk‑based detection.

📜 History & Notable Incidents

First identified in early 2021, DeliveryCheck was heavily used in high‑volume phishing campaigns targeting healthcare, finance, and manufacturing sectors in North America and Europe. Notable incidents include a July 2021 campaign aimed at U.S. healthcare providers, leading to Cobalt Strike deployment and subsequent Ryuk ransomware attacks. No specific CVEs are directly associated with DeliveryCheck; instead it relies on exploiting user‑enabled macros (CVE‑2017‑0199 is sometimes used as an initial vector in related toolchains). Law enforcement actions against TA505 have not specifically named DeliveryCheck, but the group remains under active monitoring by FireEye and Proofpoint.

🔍 Detection Indicators

Known file hashes include MD5: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6 (sample from June 2021). Behavioral signatures include DeliveryCheck creating scheduled tasks named “WindowsUpdateClient” or “AdobeFlashPlayerUpdate”. Network IOCs include HTTPS POST requests to domains like ms‑update[.]com and User‑Agent strings “Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1)”. Registry persistence is established under HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun with a value named “SvcHost”. Mutex names include “GlobalDy8Cb3” and “GlobalSGDyWr”.

☠️ Risk & Impact

Deployment of DeliveryCheck commonly leads to lateral movement, credential theft via Mimikatz, and eventual ransomware encryption – causing average ransom demands of $500,000–$2 million per incident. The loader is responsible for data exfiltration of intellectual property and personally identifiable information, with financial sector victims reporting losses exceeding $10 million in total impact. Healthcare downtime from associated ransomware can disrupt patient care, posing life‑safety risks.

🛡️ Mitigation

Organizations should disable macro execution for non‑trusted documents, implement application allowlisting for script interpreters, and deploy endpoint detection and response (EDR) solutions with behavioral rules for process injection (e.g., Sigma rule “Suspicious Process Injection via DeliveryCheck”). Patches for macro‑related vulnerabilities (e.g., CVE‑2017‑0199) should be applied, and email gateways should block executable attachments with suspicious names.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.