358c5b31c3352bfb0ec8b488e11e943ef70594b00acc16ee53c3af4729fedc49

General
Target

358c5b31c3352bfb0ec8b488e11e943ef70594b00acc16ee53c3af4729fedc49.dll

Filesize

653KB

Completed

25-11-2021 16:45

Score
10/10
MD5

74254a37cb8132aa5ec0aa2ddd471981

SHA1

e52f52eff2d88fc126084875255c52c8282e50e2

SHA256

358c5b31c3352bfb0ec8b488e11e943ef70594b00acc16ee53c3af4729fedc49

Malware Config

Extracted

Family emotet
Botnet Epoch5
C2

51.178.61.60:443

168.197.250.14:80

45.79.33.48:8080

196.44.98.190:8080

177.72.80.14:7080

51.210.242.234:8080

185.148.169.10:8080

142.4.219.173:8080

78.47.204.80:443

78.46.73.125:443

37.44.244.177:8080

37.59.209.141:8080

191.252.103.16:80

54.38.242.185:443

85.214.67.203:8080

54.37.228.122:443

207.148.81.119:8080

195.77.239.39:8080

66.42.57.149:443

195.154.146.35:443

eck1.plain
ecs1.plain
Signatures 13

Filter: none

Discovery
Persistence
  • Emotet

    Description

    Emotet is a trojan that is primarily spread through spam emails.

  • Registers COM server for autorun

    TTPs

    Registry Run Keys / Startup Folder
  • suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)

    Description

    suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)

    Tags

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    Description

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    Tags

  • Blocklisted process makes network request
    rundll32.exe

    Reported IOCs

    flowpidprocess
    183240rundll32.exe
  • Drops file in System32 directory
    rundll32.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Windows\SysWOW64\Ewlrsexdkiu\bszfbtpomt.lbzrundll32.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Modifies data under HKEY_USERS
    OfficeC2RClient.exe

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\EcsOfficeC2RClient.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorunOfficeC2RClient.exe
    Set value (int)\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"OfficeC2RClient.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\CommonOfficeC2RClient.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadataOfficeC2RClient.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exeOfficeC2RClient.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\OverridesOfficeC2RClient.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\OverridesOfficeC2RClient.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitorOfficeC2RClient.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0OfficeC2RClient.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\ExperimentationOfficeC2RClient.exe
    Key deleted\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitorOfficeC2RClient.exe
    Key deleted\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exeOfficeC2RClient.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorunOfficeC2RClient.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\OverridesOfficeC2RClient.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorunOfficeC2RClient.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextDataOfficeC2RClient.exe
    Set value (int)\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"OfficeC2RClient.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetryOfficeC2RClient.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,17110988,7153487,39965824,17962391,17962392,3702920,3462423,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"OfficeC2RClient.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,941 10,1329 15,941 15,941 6,1329 100,1329 6"OfficeC2RClient.exe
  • Modifies registry class
    FileSyncConfig.exe

    Reported IOCs

    descriptioniocprocess
    Key deleted\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InstanceFileSyncConfig.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32\ = "%systemroot%\\SysWow64\\shell32.dll"FileSyncConfig.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolderFileSyncConfig.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ = "OneDrive"FileSyncConfig.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32FileSyncConfig.exe
    Key deleted\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INSTANCE\INITPROPERTYBAGFileSyncConfig.exe
    Key deleted\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InstanceFileSyncConfig.exe
    Key deleted\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INPROCSERVER32FileSyncConfig.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32\ = "%systemroot%\\system32\\shell32.dll"FileSyncConfig.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolderFileSyncConfig.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\Attributes = "17"FileSyncConfig.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\TargetKnownFolder = "{a52bba46-e9e1-435f-b3d9-28daa648c0f6}"FileSyncConfig.exe
    Key deleted\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INPROCSERVER32FileSyncConfig.exe
    Key deleted\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DEFAULTICONFileSyncConfig.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\Attributes = "4034920525"FileSyncConfig.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\TargetKnownFolder = "{a52bba46-e9e1-435f-b3d9-28daa648c0f6}"FileSyncConfig.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIconFileSyncConfig.exe
    Key deleted\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}FileSyncConfig.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe,0"FileSyncConfig.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\CLSID = "{0E5AAE11-A475-4c5b-AB00-C66DE400274E}"FileSyncConfig.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBagFileSyncConfig.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\Attributes = "4034920525"FileSyncConfig.exe
    Key deleted\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}FileSyncConfig.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIconFileSyncConfig.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InstanceFileSyncConfig.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SortOrderIndex = "66"FileSyncConfig.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\FolderValueFlags = "40"FileSyncConfig.exe
    Key deleted\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INSTANCE\INITPROPERTYBAGFileSyncConfig.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ = "OneDrive"FileSyncConfig.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\System.IsPinnedToNameSpaceTree = "1"FileSyncConfig.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}FileSyncConfig.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe,0"FileSyncConfig.exe
    Key deleted\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SHELLFOLDERFileSyncConfig.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}FileSyncConfig.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\FolderValueFlags = "40"FileSyncConfig.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\CLSID = "{0E5AAE11-A475-4c5b-AB00-C66DE400274E}"FileSyncConfig.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SortOrderIndex = "66"FileSyncConfig.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32FileSyncConfig.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InstanceFileSyncConfig.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\Attributes = "17"FileSyncConfig.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\System.IsPinnedToNameSpaceTree = "1"FileSyncConfig.exe
    Key deleted\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DEFAULTICONFileSyncConfig.exe
    Key deleted\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SHELLFOLDERFileSyncConfig.exe
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBagFileSyncConfig.exe
  • Suspicious behavior: EnumeratesProcesses
    rundll32.exe

    Reported IOCs

    pidprocess
    3240rundll32.exe
    3240rundll32.exe
  • Suspicious behavior: RenamesItself
    rundll32.exe

    Reported IOCs

    pidprocess
    4188rundll32.exe
  • Suspicious use of SetWindowsHookEx
    OfficeC2RClient.exe

    Reported IOCs

    pidprocess
    2280OfficeC2RClient.exe
  • Suspicious use of WriteProcessMemory
    rundll32.exerundll32.exerundll32.exerundll32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4448 wrote to memory of 45404448rundll32.exerundll32.exe
    PID 4448 wrote to memory of 45404448rundll32.exerundll32.exe
    PID 4448 wrote to memory of 45404448rundll32.exerundll32.exe
    PID 4540 wrote to memory of 41884540rundll32.exerundll32.exe
    PID 4540 wrote to memory of 41884540rundll32.exerundll32.exe
    PID 4540 wrote to memory of 41884540rundll32.exerundll32.exe
    PID 4188 wrote to memory of 3604188rundll32.exerundll32.exe
    PID 4188 wrote to memory of 3604188rundll32.exerundll32.exe
    PID 4188 wrote to memory of 3604188rundll32.exerundll32.exe
    PID 360 wrote to memory of 3240360rundll32.exerundll32.exe
    PID 360 wrote to memory of 3240360rundll32.exerundll32.exe
    PID 360 wrote to memory of 3240360rundll32.exerundll32.exe
Processes 7
  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\358c5b31c3352bfb0ec8b488e11e943ef70594b00acc16ee53c3af4729fedc49.dll,#1
    Suspicious use of WriteProcessMemory
    PID:4448
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\358c5b31c3352bfb0ec8b488e11e943ef70594b00acc16ee53c3af4729fedc49.dll,#1
      Suspicious use of WriteProcessMemory
      PID:4540
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\358c5b31c3352bfb0ec8b488e11e943ef70594b00acc16ee53c3af4729fedc49.dll",Control_RunDLL
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        PID:4188
        • C:\Windows\SysWOW64\rundll32.exe
          C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Ewlrsexdkiu\bszfbtpomt.lbz",rCdImYOEWqSU
          Suspicious use of WriteProcessMemory
          PID:360
          • C:\Windows\SysWOW64\rundll32.exe
            C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Ewlrsexdkiu\bszfbtpomt.lbz",Control_RunDLL
            Blocklisted process makes network request
            Suspicious behavior: EnumeratesProcesses
            PID:3240
  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
    "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"
    Modifies registry class
    PID:4240
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False
    Modifies data under HKEY_USERS
    Suspicious use of SetWindowsHookEx
    PID:2280
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • memory/360-140-0x0000000000F10000-0x0000000000F38000-memory.dmp

                      • memory/360-138-0x0000000000000000-mapping.dmp

                      • memory/3240-161-0x0000000004DC0000-0x0000000004DE8000-memory.dmp

                      • memory/3240-152-0x0000000004B20000-0x0000000004B48000-memory.dmp

                      • memory/3240-149-0x00000000044B0000-0x00000000044D8000-memory.dmp

                      • memory/3240-146-0x0000000000EE0000-0x0000000000F08000-memory.dmp

                      • memory/3240-145-0x0000000000000000-mapping.dmp

                      • memory/3240-158-0x0000000004CE0000-0x0000000004D08000-memory.dmp

                      • memory/3240-155-0x0000000004C00000-0x0000000004C28000-memory.dmp

                      • memory/4188-139-0x0000000004FB0000-0x0000000004FD8000-memory.dmp

                      • memory/4188-135-0x0000000004E50000-0x0000000004E78000-memory.dmp

                      • memory/4188-132-0x0000000004DF0000-0x0000000004E18000-memory.dmp

                      • memory/4188-129-0x0000000004C70000-0x0000000004C98000-memory.dmp

                      • memory/4188-126-0x0000000004710000-0x0000000004738000-memory.dmp

                      • memory/4188-123-0x0000000000F20000-0x0000000000F48000-memory.dmp

                      • memory/4188-122-0x0000000000000000-mapping.dmp

                      • memory/4540-119-0x0000000004800000-0x0000000004828000-memory.dmp

                      • memory/4540-118-0x0000000000000000-mapping.dmp