Analysis
- max time kernel
134s - max time network
143s - platform
windows7_x64 - resource
win7 - submitted
25/10/2020, 08:11
Static task
static1
Behavioral task
behavioral1
Sample
390d5d5b85d20102bdac0544073c4475.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
390d5d5b85d20102bdac0544073c4475.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target 390d5d5b85d20102bdac0544073c4475.exe
- Size 65KB
- Sample201025-td3a5ebql6
- SHA256 152fd28bdefe2d56b7a43c2d3c12284bdfe2bd229c671a633d76a342c955a2e3
- MD5 390d5d5b85d20102bdac0544073c4475
- SHA1 dc9b49c3ff2db65a941f13b8d44ccb301fd05974
- SHA512 5299e2862c501587a74226a5a82f6de5baa6d5d1cbd435cf90848befe33dd1245d6419e2ac418fcdf4737e98af84f942abd638cc5a0a625b33f56bafdf5d76ce
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
emotet
C2
-
187.131.163.89:7080
-
85.104.121.33:8443
-
124.150.175.133:80
-
198.57.217.170:8080
-
45.56.122.75:80
-
138.197.140.163:8080
-
157.7.164.178:8081
-
181.36.42.205:443
-
212.112.113.235:80
-
185.45.24.254:7080
-
144.76.62.10:8080
-
201.196.15.79:990
-
94.177.253.126:80
-
113.52.135.33:7080
-
189.218.243.150:443
-
190.217.1.149:80
-
190.55.39.215:80
-
187.143.219.242:8080
-
186.146.110.108:8080
-
42.190.4.92:443
-
152.170.220.95:80
-
172.104.70.207:8080
-
181.198.203.45:443
-
190.113.146.128:8080
-
192.241.220.183:8080
-
186.84.173.153:80
-
190.228.212.165:50000
-
181.61.143.177:80
-
5.189.148.98:8080
-
176.58.93.123:80
-
190.117.206.153:443
-
189.166.13.109:80
-
216.70.88.55:8080
-
186.109.91.136:80
-
190.96.118.15:443
-
75.154.163.1:8090
-
91.109.5.28:8080
-
51.38.134.203:8080
-
138.186.179.235:8080
-
216.75.37.196:8080
-
70.45.30.28:80
-
178.249.187.150:7080
-
189.147.96.184:443
-
143.95.101.72:8080
-
83.169.33.157:8080
-
189.132.130.111:8080
-
139.162.185.116:443
-
96.20.84.254:7080
-
181.47.235.26:993
-
154.120.227.206:8080
-
200.55.168.82:20
-
162.241.134.130:8080
-
190.16.101.10:80
-
211.229.116.130:80
-
181.197.2.80:443
-
200.90.86.170:8080
-
187.188.166.192:80
-
60.52.64.122:80
-
70.32.94.58:8080
-
110.36.234.146:80
-
190.13.146.47:443
-
203.99.188.11:443
-
95.216.207.86:7080
-
23.253.207.142:8080
rsa_pubkey.plain
Signatures
- Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat diagrammmc.exe - Modifies data under HKEY_USERS 25 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections diagrammmc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" diagrammmc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CD804939-B585-4E66-B21C-8858901809C3}\WpadDecision = "0" diagrammmc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CD804939-B585-4E66-B21C-8858901809C3}\32-e2-17-db-d2-77 diagrammmc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = a07320bcabaad601 diagrammmc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings diagrammmc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" diagrammmc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 diagrammmc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad diagrammmc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CD804939-B585-4E66-B21C-8858901809C3}\WpadDecisionTime = 609ac47cabaad601 diagrammmc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1" diagrammmc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 609ac47cabaad601 diagrammmc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 diagrammmc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix diagrammmc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" diagrammmc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070022000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 diagrammmc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CD804939-B585-4E66-B21C-8858901809C3}\WpadDecisionTime = a07320bcabaad601 diagrammmc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDetectedUrl diagrammmc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings diagrammmc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070022000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 diagrammmc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CD804939-B585-4E66-B21C-8858901809C3} diagrammmc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CD804939-B585-4E66-B21C-8858901809C3}\WpadDecisionReason = "1" diagrammmc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CD804939-B585-4E66-B21C-8858901809C3}\WpadNetworkName = "Network" diagrammmc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77 diagrammmc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0" diagrammmc.exe - Suspicious behavior: EmotetMutantsSpam 2 IoCs
pid Process 1552 390d5d5b85d20102bdac0544073c4475.exe 2020 diagrammmc.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2020 diagrammmc.exe 2020 diagrammmc.exe 2020 diagrammmc.exe 2020 diagrammmc.exe 2020 diagrammmc.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 1552 390d5d5b85d20102bdac0544073c4475.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1488 wrote to memory of 1552 1488 390d5d5b85d20102bdac0544073c4475.exe 24 PID 1488 wrote to memory of 1552 1488 390d5d5b85d20102bdac0544073c4475.exe 24 PID 1488 wrote to memory of 1552 1488 390d5d5b85d20102bdac0544073c4475.exe 24 PID 1488 wrote to memory of 1552 1488 390d5d5b85d20102bdac0544073c4475.exe 24 PID 1980 wrote to memory of 2020 1980 diagrammmc.exe 30 PID 1980 wrote to memory of 2020 1980 diagrammmc.exe 30 PID 1980 wrote to memory of 2020 1980 diagrammmc.exe 30 PID 1980 wrote to memory of 2020 1980 diagrammmc.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\390d5d5b85d20102bdac0544073c4475.exe"C:\Users\Admin\AppData\Local\Temp\390d5d5b85d20102bdac0544073c4475.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\390d5d5b85d20102bdac0544073c4475.exe--104a60e62⤵
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: RenamesItself
PID:1552
-
-
C:\Windows\SysWOW64\diagrammmc.exe"C:\Windows\SysWOW64\diagrammmc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\diagrammmc.exe--ea1c8d422⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: EnumeratesProcesses
PID:2020
-