Analysis
- max time kernel
130s - max time network
167s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
08/02/2022, 22:20
Static task
static1
Behavioral task
behavioral1
Sample
emotet_exe_e5_c1a3e4d64f92dd33eb99464df73768bb120f342d3f8be4d1c31883b28947a0f3_2022-02-08__221928.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target emotet_exe_e5_c1a3e4d64f92dd33eb99464df73768bb120f342d3f8be4d1c31883b28947a0f3_2022-02-08__221928.dll
- Size 575KB
- Sample220208-1846esffg8
- SHA256 c1a3e4d64f92dd33eb99464df73768bb120f342d3f8be4d1c31883b28947a0f3
- MD5 57227f29cdfce09238d743e95b390d6b
- SHA1 bb3f4b3f518a93e5cf557a3f164014317a123668
- SHA512 e1baadc68f0001f3256c2b20b665d58ca944eec96a84712bf4ec58bada7fefaed81b06175de501ad83c5fea85457c3b314a87869f3b4398b9292917ea5f07e26
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch5
C2
-
103.42.57.17:8080
-
93.104.208.37:8080
-
195.154.146.35:443
-
62.171.178.147:8080
-
37.59.209.141:8080
-
139.196.72.155:8080
-
37.44.244.177:8080
-
191.252.103.16:80
-
217.182.143.207:443
-
128.199.192.135:8080
-
103.41.204.169:8080
-
185.148.168.15:8080
-
168.197.250.14:80
-
78.46.73.125:443
-
194.9.172.107:8080
-
185.148.168.220:8080
-
118.98.72.86:443
-
54.37.106.167:8080
-
78.47.204.80:443
-
159.69.237.188:443
-
116.124.128.206:8080
-
59.148.253.194:443
-
85.214.67.203:8080
-
185.184.25.78:8080
-
173.203.78.138:443
-
54.37.228.122:443
-
198.199.98.78:8080
-
195.77.239.39:8080
-
210.57.209.142:8080
-
66.42.57.149:443
-
104.131.62.48:8080
-
54.38.242.185:443
-
190.90.233.66:443
-
207.148.81.119:8080
-
203.153.216.46:443
eck1.plain
ecs1.plain
Signatures
- Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4320 svchost.exe Token: SeCreatePagefilePrivilege 4320 svchost.exe Token: SeShutdownPrivilege 4320 svchost.exe Token: SeCreatePagefilePrivilege 4320 svchost.exe Token: SeShutdownPrivilege 4320 svchost.exe Token: SeCreatePagefilePrivilege 4320 svchost.exe Token: SeSecurityPrivilege 816 TiWorker.exe Token: SeRestorePrivilege 816 TiWorker.exe Token: SeBackupPrivilege 816 TiWorker.exe Token: SeBackupPrivilege 816 TiWorker.exe Token: SeRestorePrivilege 816 TiWorker.exe Token: SeSecurityPrivilege 816 TiWorker.exe Token: SeBackupPrivilege 816 TiWorker.exe Token: SeRestorePrivilege 816 TiWorker.exe Token: SeSecurityPrivilege 816 TiWorker.exe Token: SeBackupPrivilege 816 TiWorker.exe Token: SeRestorePrivilege 816 TiWorker.exe Token: SeSecurityPrivilege 816 TiWorker.exe Token: SeBackupPrivilege 816 TiWorker.exe Token: SeRestorePrivilege 816 TiWorker.exe Token: SeSecurityPrivilege 816 TiWorker.exe Token: SeBackupPrivilege 816 TiWorker.exe Token: SeRestorePrivilege 816 TiWorker.exe Token: SeSecurityPrivilege 816 TiWorker.exe Token: SeBackupPrivilege 816 TiWorker.exe Token: SeRestorePrivilege 816 TiWorker.exe Token: SeSecurityPrivilege 816 TiWorker.exe Token: SeBackupPrivilege 816 TiWorker.exe Token: SeRestorePrivilege 816 TiWorker.exe Token: SeSecurityPrivilege 816 TiWorker.exe Token: SeBackupPrivilege 816 TiWorker.exe Token: SeRestorePrivilege 816 TiWorker.exe Token: SeSecurityPrivilege 816 TiWorker.exe Token: SeBackupPrivilege 816 TiWorker.exe Token: SeRestorePrivilege 816 TiWorker.exe Token: SeSecurityPrivilege 816 TiWorker.exe Token: SeBackupPrivilege 816 TiWorker.exe Token: SeRestorePrivilege 816 TiWorker.exe Token: SeSecurityPrivilege 816 TiWorker.exe Token: SeBackupPrivilege 816 TiWorker.exe Token: SeRestorePrivilege 816 TiWorker.exe Token: SeSecurityPrivilege 816 TiWorker.exe Token: SeBackupPrivilege 816 TiWorker.exe Token: SeRestorePrivilege 816 TiWorker.exe Token: SeSecurityPrivilege 816 TiWorker.exe Token: SeBackupPrivilege 816 TiWorker.exe Token: SeRestorePrivilege 816 TiWorker.exe Token: SeSecurityPrivilege 816 TiWorker.exe Token: SeBackupPrivilege 816 TiWorker.exe Token: SeRestorePrivilege 816 TiWorker.exe Token: SeSecurityPrivilege 816 TiWorker.exe Token: SeBackupPrivilege 816 TiWorker.exe Token: SeRestorePrivilege 816 TiWorker.exe Token: SeSecurityPrivilege 816 TiWorker.exe Token: SeBackupPrivilege 816 TiWorker.exe Token: SeRestorePrivilege 816 TiWorker.exe Token: SeSecurityPrivilege 816 TiWorker.exe Token: SeBackupPrivilege 816 TiWorker.exe Token: SeRestorePrivilege 816 TiWorker.exe Token: SeSecurityPrivilege 816 TiWorker.exe Token: SeBackupPrivilege 816 TiWorker.exe Token: SeRestorePrivilege 816 TiWorker.exe Token: SeSecurityPrivilege 816 TiWorker.exe Token: SeBackupPrivilege 816 TiWorker.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3296 wrote to memory of 1532 3296 regsvr32.exe 82 PID 3296 wrote to memory of 1532 3296 regsvr32.exe 82 PID 3296 wrote to memory of 1532 3296 regsvr32.exe 82 PID 1532 wrote to memory of 4940 1532 regsvr32.exe 83 PID 1532 wrote to memory of 4940 1532 regsvr32.exe 83 PID 1532 wrote to memory of 4940 1532 regsvr32.exe 83
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c1a3e4d64f92dd33eb99464df73768bb120f342d3f8be4d1c31883b28947a0f3_2022-02-08__221928.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c1a3e4d64f92dd33eb99464df73768bb120f342d3f8be4d1c31883b28947a0f3_2022-02-08__221928.dll2⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c1a3e4d64f92dd33eb99464df73768bb120f342d3f8be4d1c31883b28947a0f3_2022-02-08__221928.dll",DllRegisterServer3⤵PID:4940
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4320
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:816