Analysis
-
max time kernel
119s -
max time network
137s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
20-04-2021 18:26
Static task
static1
Behavioral task
behavioral1
Sample
dvbpurge.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
dvbpurge.exe
-
Size
357KB
-
MD5
2408f6020b4b93a433b3440f9966a906
-
SHA1
9ab9bd4e926bb3c20c6862d4f91c55c1541fcf90
-
SHA256
016ebc2084ea3bac72069e97b250bf2ea5cc74afda9179eb289b84f031d4f707
-
SHA512
c6f46ab8611bc2d2bf5d3e1aad3cd94ed50d7e1371ba8a0fd6e7a051e689efc505a8ced2b147989599fc29bb9568d7372e1360265ff57260ae5420f6b5e8bda3
Malware Config
Extracted
Family
emotet
Botnet
LEA
C2
80.158.53.167:80
80.158.62.194:443
80.158.59.174:8080
80.158.43.136:80
80.158.3.161:443
80.158.51.209:8080
80.158.35.51:80
80.158.63.78:443
rsa_pubkey.plain
Signatures
-
Drops file in System32 directory 5 IoCs
Processes:
shlpduck.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat shlpduck.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 shlpduck.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE shlpduck.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies shlpduck.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 shlpduck.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 3 IoCs
Processes:
shlpduck.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix shlpduck.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" shlpduck.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" shlpduck.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
dvbpurge.exedvbpurge.exeshlpduck.exeshlpduck.exepid process 2116 dvbpurge.exe 2116 dvbpurge.exe 2168 dvbpurge.exe 2168 dvbpurge.exe 2728 shlpduck.exe 2728 shlpduck.exe 3548 shlpduck.exe 3548 shlpduck.exe 3548 shlpduck.exe 3548 shlpduck.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
dvbpurge.exepid process 2168 dvbpurge.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
dvbpurge.exeshlpduck.exedescription pid process target process PID 2116 wrote to memory of 2168 2116 dvbpurge.exe dvbpurge.exe PID 2116 wrote to memory of 2168 2116 dvbpurge.exe dvbpurge.exe PID 2116 wrote to memory of 2168 2116 dvbpurge.exe dvbpurge.exe PID 2728 wrote to memory of 3548 2728 shlpduck.exe shlpduck.exe PID 2728 wrote to memory of 3548 2728 shlpduck.exe shlpduck.exe PID 2728 wrote to memory of 3548 2728 shlpduck.exe shlpduck.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dvbpurge.exe"C:\Users\Admin\AppData\Local\Temp\dvbpurge.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dvbpurge.exe--7a7b875f2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\shlpduck.exe"C:\Windows\SysWOW64\shlpduck.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\shlpduck.exe--aec40da42⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2116-114-0x00000000008F0000-0x0000000000906000-memory.dmpFilesize
88KB
-
memory/2116-116-0x00000000001D0000-0x00000000001E0000-memory.dmpFilesize
64KB
-
memory/2168-119-0x0000000000000000-mapping.dmp
-
memory/2168-120-0x00000000005B0000-0x00000000005C6000-memory.dmpFilesize
88KB
-
memory/2728-126-0x0000000000510000-0x0000000000526000-memory.dmpFilesize
88KB
-
memory/2728-134-0x00000000004B0000-0x000000000055E000-memory.dmpFilesize
696KB
-
memory/3548-129-0x0000000000000000-mapping.dmp
-
memory/3548-130-0x0000000000900000-0x0000000000916000-memory.dmpFilesize
88KB