551f839c003dca5274c75533466d881879969a4a3af1c9ffe55dfdbb77d16a79

General
Target

551f839c003dca5274c75533466d881879969a4a3af1c9ffe55dfdbb77d16a79.dll

Filesize

653KB

Completed

25-11-2021 16:52

Score
10/10
MD5

2d01cf345c07fa7da99e973db89d3fbd

SHA1

af9545dbe286a1cf05be0a8da97200f49d6faf31

SHA256

551f839c003dca5274c75533466d881879969a4a3af1c9ffe55dfdbb77d16a79

Malware Config

Extracted

Family emotet
Botnet Epoch5
C2

51.178.61.60:443

168.197.250.14:80

45.79.33.48:8080

196.44.98.190:8080

177.72.80.14:7080

51.210.242.234:8080

185.148.169.10:8080

142.4.219.173:8080

78.47.204.80:443

78.46.73.125:443

37.44.244.177:8080

37.59.209.141:8080

191.252.103.16:80

54.38.242.185:443

85.214.67.203:8080

54.37.228.122:443

207.148.81.119:8080

195.77.239.39:8080

66.42.57.149:443

195.154.146.35:443
eck1.plain
ecs1.plain
Signatures 11

Filter: none

Discovery
Persistence
  • Emotet

    Description

    Emotet is a trojan that is primarily spread through spam emails.

    Tags

  • Registers COM server for autorun

    Tags

    TTPs

    Registry Run Keys / Startup Folder
  • suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)

    Description

    suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)

    Tags

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    Description

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    Tags

  • Blocklisted process makes network request
    rundll32.exe

    Reported IOCs

    flowpidprocess
    194080rundll32.exe
  • Drops file in System32 directory
    rundll32.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Windows\SysWOW64\Cxksqmzbzgcfto\pymg.srurundll32.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Modifies registry class
    FileSyncConfig.exe

    Reported IOCs

    descriptioniocprocess
    Key deleted\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INPROCSERVER32FileSyncConfig.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIconFileSyncConfig.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InstanceFileSyncConfig.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\TargetKnownFolder = "{a52bba46-e9e1-435f-b3d9-28daa648c0f6}"FileSyncConfig.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}FileSyncConfig.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe,0"FileSyncConfig.exe
    Key deleted\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INPROCSERVER32FileSyncConfig.exe
    Key deleted\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SHELLFOLDERFileSyncConfig.exe
    Key deleted\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}FileSyncConfig.exe
    Key deleted\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DEFAULTICONFileSyncConfig.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\System.IsPinnedToNameSpaceTree = "1"FileSyncConfig.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe,0"FileSyncConfig.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolderFileSyncConfig.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\Attributes = "4034920525"FileSyncConfig.exe
    Key deleted\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INSTANCE\INITPROPERTYBAGFileSyncConfig.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIconFileSyncConfig.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ = "OneDrive"FileSyncConfig.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SortOrderIndex = "66"FileSyncConfig.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32\ = "%systemroot%\\SysWow64\\shell32.dll"FileSyncConfig.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SortOrderIndex = "66"FileSyncConfig.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\CLSID = "{0E5AAE11-A475-4c5b-AB00-C66DE400274E}"FileSyncConfig.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\TargetKnownFolder = "{a52bba46-e9e1-435f-b3d9-28daa648c0f6}"FileSyncConfig.exe
    Key deleted\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InstanceFileSyncConfig.exe
    Key deleted\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INSTANCE\INITPROPERTYBAGFileSyncConfig.exe
    Key deleted\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SHELLFOLDERFileSyncConfig.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}FileSyncConfig.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBagFileSyncConfig.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\Attributes = "4034920525"FileSyncConfig.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32FileSyncConfig.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InstanceFileSyncConfig.exe
    Key deleted\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InstanceFileSyncConfig.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBagFileSyncConfig.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32FileSyncConfig.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\CLSID = "{0E5AAE11-A475-4c5b-AB00-C66DE400274E}"FileSyncConfig.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\Attributes = "17"FileSyncConfig.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolderFileSyncConfig.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\FolderValueFlags = "40"FileSyncConfig.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\System.IsPinnedToNameSpaceTree = "1"FileSyncConfig.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32\ = "%systemroot%\\system32\\shell32.dll"FileSyncConfig.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ = "OneDrive"FileSyncConfig.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\FolderValueFlags = "40"FileSyncConfig.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\Attributes = "17"FileSyncConfig.exe
    Key deleted\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DEFAULTICONFileSyncConfig.exe
    Key deleted\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}FileSyncConfig.exe
  • Suspicious behavior: EnumeratesProcesses
    rundll32.exe

    Reported IOCs

    pidprocess
    4080rundll32.exe
    4080rundll32.exe
  • Suspicious behavior: RenamesItself
    rundll32.exe

    Reported IOCs

    pidprocess
    4676rundll32.exe
  • Suspicious use of WriteProcessMemory
    rundll32.exerundll32.exerundll32.exerundll32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4508 wrote to memory of 44844508rundll32.exerundll32.exe
    PID 4508 wrote to memory of 44844508rundll32.exerundll32.exe
    PID 4508 wrote to memory of 44844508rundll32.exerundll32.exe
    PID 4484 wrote to memory of 46764484rundll32.exerundll32.exe
    PID 4484 wrote to memory of 46764484rundll32.exerundll32.exe
    PID 4484 wrote to memory of 46764484rundll32.exerundll32.exe
    PID 4676 wrote to memory of 30844676rundll32.exerundll32.exe
    PID 4676 wrote to memory of 30844676rundll32.exerundll32.exe
    PID 4676 wrote to memory of 30844676rundll32.exerundll32.exe
    PID 3084 wrote to memory of 40803084rundll32.exerundll32.exe
    PID 3084 wrote to memory of 40803084rundll32.exerundll32.exe
    PID 3084 wrote to memory of 40803084rundll32.exerundll32.exe
Processes 6
  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\551f839c003dca5274c75533466d881879969a4a3af1c9ffe55dfdbb77d16a79.dll,#1
    Suspicious use of WriteProcessMemory
    PID:4508
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\551f839c003dca5274c75533466d881879969a4a3af1c9ffe55dfdbb77d16a79.dll,#1
      Suspicious use of WriteProcessMemory
      PID:4484
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\551f839c003dca5274c75533466d881879969a4a3af1c9ffe55dfdbb77d16a79.dll",Control_RunDLL
        Drops file in System32 directory
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        PID:4676
        • C:\Windows\SysWOW64\rundll32.exe
          C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Cxksqmzbzgcfto\pymg.sru",XqojJfHu
          Suspicious use of WriteProcessMemory
          PID:3084
          • C:\Windows\SysWOW64\rundll32.exe
            C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Cxksqmzbzgcfto\pymg.sru",Control_RunDLL
            Blocklisted process makes network request
            Suspicious behavior: EnumeratesProcesses
            PID:4080
  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
    "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"
    Modifies registry class
    PID:1104
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads

                      • memory/3084-135-0x0000000000000000-mapping.dmp

                        Download

                      • memory/3084-139-0x00000000011D0000-0x00000000011F8000-memory.dmp

                        Download

                      • memory/4080-142-0x0000000000000000-mapping.dmp

                        Download

                      • memory/4080-143-0x0000000000AD0000-0x0000000000AF8000-memory.dmp

                        Download

                      • memory/4080-155-0x0000000004E30000-0x0000000004E58000-memory.dmp

                        Download

                      • memory/4080-149-0x0000000004C70000-0x0000000004C98000-memory.dmp

                        Download

                      • memory/4080-146-0x0000000004A70000-0x0000000004A98000-memory.dmp

                        Download

                      • memory/4080-158-0x0000000004F10000-0x0000000004F38000-memory.dmp

                        Download

                      • memory/4080-161-0x0000000004FF0000-0x0000000005018000-memory.dmp

                        Download

                      • memory/4080-152-0x0000000004D50000-0x0000000004D78000-memory.dmp

                        Download

                      • memory/4484-116-0x0000000000D40000-0x0000000000D68000-memory.dmp

                        Download

                      • memory/4484-115-0x0000000000000000-mapping.dmp

                        Download

                      • memory/4676-132-0x0000000004CC0000-0x0000000004CE8000-memory.dmp

                        Download

                      • memory/4676-129-0x0000000004C60000-0x0000000004C88000-memory.dmp

                        Download

                      • memory/4676-126-0x0000000004AA0000-0x0000000004AC8000-memory.dmp

                        Download

                      • memory/4676-123-0x0000000001110000-0x0000000001138000-memory.dmp

                        Download

                      • memory/4676-120-0x0000000000F80000-0x0000000000FA8000-memory.dmp

                        Download

                      • memory/4676-119-0x0000000000000000-mapping.dmp

                        Download

                      • memory/4676-137-0x0000000004E20000-0x0000000004E48000-memory.dmp

                        Download