Analysis
-
max time kernel
29s -
max time network
144s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
20-04-2021 18:26
Static task
static1
Behavioral task
behavioral1
Sample
dvbpurge.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
dvbpurge.exe
-
Size
357KB
-
MD5
2408f6020b4b93a433b3440f9966a906
-
SHA1
9ab9bd4e926bb3c20c6862d4f91c55c1541fcf90
-
SHA256
016ebc2084ea3bac72069e97b250bf2ea5cc74afda9179eb289b84f031d4f707
-
SHA512
c6f46ab8611bc2d2bf5d3e1aad3cd94ed50d7e1371ba8a0fd6e7a051e689efc505a8ced2b147989599fc29bb9568d7372e1360265ff57260ae5420f6b5e8bda3
Malware Config
Extracted
Family
emotet
Botnet
LEA
C2
80.158.53.167:80
80.158.62.194:443
80.158.59.174:8080
80.158.43.136:80
80.158.3.161:443
80.158.51.209:8080
80.158.35.51:80
80.158.63.78:443
rsa_pubkey.plain
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
timeoutmexico.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat timeoutmexico.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
timeoutmexico.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings timeoutmexico.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" timeoutmexico.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad timeoutmexico.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecision = "0" timeoutmexico.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1" timeoutmexico.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0" timeoutmexico.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" timeoutmexico.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 timeoutmexico.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77 timeoutmexico.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix timeoutmexico.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings timeoutmexico.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07000e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 timeoutmexico.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7} timeoutmexico.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = 5082f2392536d701 timeoutmexico.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadNetworkName = "Network" timeoutmexico.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\32-e2-17-db-d2-77 timeoutmexico.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 5082f2392536d701 timeoutmexico.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections timeoutmexico.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 timeoutmexico.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" timeoutmexico.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionReason = "1" timeoutmexico.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
dvbpurge.exedvbpurge.exetimeoutmexico.exetimeoutmexico.exepid process 484 dvbpurge.exe 1824 dvbpurge.exe 524 timeoutmexico.exe 560 timeoutmexico.exe 560 timeoutmexico.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
dvbpurge.exepid process 1824 dvbpurge.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
dvbpurge.exetimeoutmexico.exedescription pid process target process PID 484 wrote to memory of 1824 484 dvbpurge.exe dvbpurge.exe PID 484 wrote to memory of 1824 484 dvbpurge.exe dvbpurge.exe PID 484 wrote to memory of 1824 484 dvbpurge.exe dvbpurge.exe PID 484 wrote to memory of 1824 484 dvbpurge.exe dvbpurge.exe PID 524 wrote to memory of 560 524 timeoutmexico.exe timeoutmexico.exe PID 524 wrote to memory of 560 524 timeoutmexico.exe timeoutmexico.exe PID 524 wrote to memory of 560 524 timeoutmexico.exe timeoutmexico.exe PID 524 wrote to memory of 560 524 timeoutmexico.exe timeoutmexico.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dvbpurge.exe"C:\Users\Admin\AppData\Local\Temp\dvbpurge.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dvbpurge.exe--7a7b875f2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\timeoutmexico.exe"C:\Windows\SysWOW64\timeoutmexico.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeoutmexico.exe--b84f37ec2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/484-59-0x0000000000270000-0x0000000000286000-memory.dmpFilesize
88KB
-
memory/484-68-0x0000000000260000-0x0000000000270000-memory.dmpFilesize
64KB
-
memory/524-71-0x00000000001C0000-0x00000000001D6000-memory.dmpFilesize
88KB
-
memory/560-75-0x0000000000000000-mapping.dmp
-
memory/560-76-0x00000000003C0000-0x00000000003D6000-memory.dmpFilesize
88KB
-
memory/1824-63-0x0000000000000000-mapping.dmp
-
memory/1824-64-0x00000000005F0000-0x0000000000606000-memory.dmpFilesize
88KB
-
memory/1824-70-0x0000000075AD1000-0x0000000075AD3000-memory.dmpFilesize
8KB