Analysis
- max time kernel
176s - max time network
199s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
08/02/2022, 00:01
Static task
static1
Behavioral task
behavioral1
Sample
emotet_exe_e5_da8cdcda15a025d65eda9e69191f2175f6e678c42390deb05952fd55a1f7d04f_2022-02-08__000051.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target emotet_exe_e5_da8cdcda15a025d65eda9e69191f2175f6e678c42390deb05952fd55a1f7d04f_2022-02-08__000051.dll
- Size 600KB
- Sample220208-aay9eabaa9
- SHA256 da8cdcda15a025d65eda9e69191f2175f6e678c42390deb05952fd55a1f7d04f
- MD5 3df51b0e2edad88ac8cc19a8721b0450
- SHA1 e53a0411f8fba49fd664b0a44c6873e5aec9a835
- SHA512 b006e1bad95e9b6dbae60952de1d26b2cdd4b604ace2d640f6ce11933254ee3a641dbc440638c19a5f1a4d1768bfc28d041626a9629072c212855fe0d3b742ba
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch5
C2
-
103.42.57.17:8080
-
93.104.208.37:8080
-
195.154.146.35:443
-
62.171.178.147:8080
-
37.59.209.141:8080
-
139.196.72.155:8080
-
37.44.244.177:8080
-
191.252.103.16:80
-
217.182.143.207:443
-
128.199.192.135:8080
-
103.41.204.169:8080
-
185.148.168.15:8080
-
168.197.250.14:80
-
78.46.73.125:443
-
194.9.172.107:8080
-
185.148.168.220:8080
-
118.98.72.86:443
-
54.37.106.167:8080
-
78.47.204.80:443
-
159.69.237.188:443
-
116.124.128.206:8080
-
59.148.253.194:443
-
85.214.67.203:8080
-
185.184.25.78:8080
-
173.203.78.138:443
-
54.37.228.122:443
-
198.199.98.78:8080
-
195.77.239.39:8080
-
210.57.209.142:8080
-
66.42.57.149:443
-
104.131.62.48:8080
-
54.38.242.185:443
-
190.90.233.66:443
-
207.148.81.119:8080
-
203.153.216.46:443
eck1.plain
ecs1.plain
Signatures
- Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe - Suspicious use of AdjustPrivilegeToken 39 IoCs
description pid Process Token: SeShutdownPrivilege 4884 svchost.exe Token: SeCreatePagefilePrivilege 4884 svchost.exe Token: SeShutdownPrivilege 4884 svchost.exe Token: SeCreatePagefilePrivilege 4884 svchost.exe Token: SeShutdownPrivilege 4884 svchost.exe Token: SeCreatePagefilePrivilege 4884 svchost.exe Token: SeSecurityPrivilege 3084 TiWorker.exe Token: SeRestorePrivilege 3084 TiWorker.exe Token: SeBackupPrivilege 3084 TiWorker.exe Token: SeBackupPrivilege 3084 TiWorker.exe Token: SeRestorePrivilege 3084 TiWorker.exe Token: SeSecurityPrivilege 3084 TiWorker.exe Token: SeBackupPrivilege 3084 TiWorker.exe Token: SeRestorePrivilege 3084 TiWorker.exe Token: SeSecurityPrivilege 3084 TiWorker.exe Token: SeBackupPrivilege 3084 TiWorker.exe Token: SeRestorePrivilege 3084 TiWorker.exe Token: SeSecurityPrivilege 3084 TiWorker.exe Token: SeBackupPrivilege 3084 TiWorker.exe Token: SeRestorePrivilege 3084 TiWorker.exe Token: SeSecurityPrivilege 3084 TiWorker.exe Token: SeBackupPrivilege 3084 TiWorker.exe Token: SeRestorePrivilege 3084 TiWorker.exe Token: SeSecurityPrivilege 3084 TiWorker.exe Token: SeBackupPrivilege 3084 TiWorker.exe Token: SeRestorePrivilege 3084 TiWorker.exe Token: SeSecurityPrivilege 3084 TiWorker.exe Token: SeBackupPrivilege 3084 TiWorker.exe Token: SeRestorePrivilege 3084 TiWorker.exe Token: SeSecurityPrivilege 3084 TiWorker.exe Token: SeBackupPrivilege 3084 TiWorker.exe Token: SeRestorePrivilege 3084 TiWorker.exe Token: SeSecurityPrivilege 3084 TiWorker.exe Token: SeBackupPrivilege 3084 TiWorker.exe Token: SeRestorePrivilege 3084 TiWorker.exe Token: SeSecurityPrivilege 3084 TiWorker.exe Token: SeBackupPrivilege 3084 TiWorker.exe Token: SeRestorePrivilege 3084 TiWorker.exe Token: SeSecurityPrivilege 3084 TiWorker.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2428 wrote to memory of 2236 2428 regsvr32.exe 85 PID 2428 wrote to memory of 2236 2428 regsvr32.exe 85 PID 2428 wrote to memory of 2236 2428 regsvr32.exe 85 PID 2236 wrote to memory of 4820 2236 regsvr32.exe 87 PID 2236 wrote to memory of 4820 2236 regsvr32.exe 87 PID 2236 wrote to memory of 4820 2236 regsvr32.exe 87
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_da8cdcda15a025d65eda9e69191f2175f6e678c42390deb05952fd55a1f7d04f_2022-02-08__000051.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_da8cdcda15a025d65eda9e69191f2175f6e678c42390deb05952fd55a1f7d04f_2022-02-08__000051.dll2⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_da8cdcda15a025d65eda9e69191f2175f6e678c42390deb05952fd55a1f7d04f_2022-02-08__000051.dll",DllRegisterServer3⤵PID:4820
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4884
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3084