Analysis
-
max time kernel
292s -
max time network
294s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
20-04-2021 11:01
Static task
static1
General
-
Target
demo2.exe
-
Size
572KB
-
MD5
63e7951323a58e88eb1b54fdd85b592c
-
SHA1
1a42fddedb5584d8f6a94f361fb1c0d00c14ee9b
-
SHA256
81911568cdd70019efa3d4d57c293999180989d73c41ff215e5e0c3632333fc9
-
SHA512
a1220a8f82d66df778f058295be5d6b8fad9f5ff9d710b0b373f6302d35fcfa98660d71447179efa50703dc6c05835789e20f151f3739ba71aa76bc4b2c72528
Malware Config
Extracted
Family
emotet
Botnet
Epoch2
C2
212.186.191.177:80
91.242.138.5:80
173.13.135.102:80
59.110.18.236:443
45.56.88.91:443
51.68.220.244:8080
206.81.10.215:8080
80.11.163.139:21
182.176.132.213:8090
165.227.156.155:443
118.201.230.249:80
138.201.140.110:8080
46.105.131.87:80
87.106.139.101:8080
24.45.193.161:7080
209.97.168.52:8080
190.12.119.180:443
190.147.215.53:22
191.92.209.110:7080
91.205.215.66:8080
190.211.207.11:443
186.75.241.230:80
173.212.203.26:8080
67.225.179.64:8080
31.12.67.62:7080
128.65.154.183:443
189.209.217.49:80
107.2.2.28:80
167.99.105.223:7080
12.229.155.122:80
104.236.246.93:8080
178.209.71.63:8080
212.129.24.79:8080
95.128.43.213:8080
178.210.51.222:8080
5.88.182.250:80
91.231.166.126:8080
176.31.200.130:8080
192.81.213.192:8080
103.39.131.88:80
164.68.101.171:80
201.184.105.242:443
213.179.105.214:8080
149.202.153.252:8080
47.50.251.130:80
93.147.141.5:80
37.157.194.134:443
181.57.193.14:80
45.33.49.124:443
192.241.255.77:8080
62.75.187.192:8080
31.31.77.83:443
181.143.194.138:443
144.139.247.220:80
181.31.213.158:8080
183.102.238.69:465
206.189.112.148:8080
165.228.24.197:80
59.103.164.174:80
83.136.245.190:8080
107.170.24.125:8080
50.116.86.205:8080
197.254.221.174:80
190.108.228.48:990
104.131.11.150:8080
200.71.148.138:8080
120.150.246.241:80
217.160.182.191:8080
159.65.25.128:8080
167.114.242.226:8080
190.226.44.20:21
92.222.216.44:8080
85.104.59.244:20
101.187.247.29:80
169.239.182.217:8080
104.131.44.150:8080
192.241.220.155:8080
91.73.197.90:80
190.145.67.134:8090
116.48.142.21:443
5.196.74.210:8080
87.230.19.21:8080
211.63.71.72:8080
167.71.10.37:8080
195.244.215.206:80
190.53.135.159:21
80.21.182.46:80
78.24.219.147:8080
31.172.240.91:8080
87.106.136.232:8080
rsa_pubkey.plain
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
trnsboost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat trnsboost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 31 IoCs
Processes:
trnsboost.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" trnsboost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = 00d722d2e535d701 trnsboost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecision = "0" trnsboost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\32-e2-17-db-d2-77 trnsboost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 trnsboost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix trnsboost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070028000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 trnsboost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = e06a360ee635d701 trnsboost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" trnsboost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad trnsboost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7} trnsboost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77 trnsboost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 00d722d2e535d701 trnsboost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadNetworkName = "Network" trnsboost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = e06a360ee635d701 trnsboost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000006000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070028000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 trnsboost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = 80e81034e635d701 trnsboost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 20340b5de635d701 trnsboost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000005000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070028000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 trnsboost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings trnsboost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings trnsboost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" trnsboost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070028000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 trnsboost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1" trnsboost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections trnsboost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0" trnsboost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 trnsboost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionReason = "1" trnsboost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDetectedUrl trnsboost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 80e81034e635d701 trnsboost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = 20340b5de635d701 trnsboost.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
trnsboost.exepid process 572 trnsboost.exe 572 trnsboost.exe 572 trnsboost.exe 572 trnsboost.exe 572 trnsboost.exe 572 trnsboost.exe 572 trnsboost.exe 572 trnsboost.exe 572 trnsboost.exe 572 trnsboost.exe 572 trnsboost.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
demo2.exepid process 1940 demo2.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
demo2.exedemo2.exetrnsboost.exetrnsboost.exepid process 1640 demo2.exe 1940 demo2.exe 1540 trnsboost.exe 572 trnsboost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
demo2.exetrnsboost.exedescription pid process target process PID 1640 wrote to memory of 1940 1640 demo2.exe demo2.exe PID 1640 wrote to memory of 1940 1640 demo2.exe demo2.exe PID 1640 wrote to memory of 1940 1640 demo2.exe demo2.exe PID 1640 wrote to memory of 1940 1640 demo2.exe demo2.exe PID 1540 wrote to memory of 572 1540 trnsboost.exe trnsboost.exe PID 1540 wrote to memory of 572 1540 trnsboost.exe trnsboost.exe PID 1540 wrote to memory of 572 1540 trnsboost.exe trnsboost.exe PID 1540 wrote to memory of 572 1540 trnsboost.exe trnsboost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\demo2.exe"C:\Users\Admin\AppData\Local\Temp\demo2.exe"
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\demo2.exe--b125d133
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\trnsboost.exe"C:\Windows\SysWOW64\trnsboost.exe"
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\trnsboost.exe--de0a6d6
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
00:00
00:00
Downloads
-
memory/572-77-0x0000000000000000-mapping.dmp
-
memory/1540-73-0x00000000003E0000-0x00000000003F7000-memory.dmpFilesize
92KB
-
memory/1640-59-0x00000000769B1000-0x00000000769B3000-memory.dmpFilesize
8KB
-
memory/1640-60-0x0000000000250000-0x0000000000267000-memory.dmpFilesize
92KB
-
memory/1640-66-0x00000000001B0000-0x00000000001C1000-memory.dmpFilesize
68KB
-
memory/1940-64-0x0000000000000000-mapping.dmp
-
memory/1940-67-0x00000000002D0000-0x00000000002E7000-memory.dmpFilesize
92KB