Analysis
- max time kernel
157s - max time network
171s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
08/02/2022, 19:07
Static task
static1
Behavioral task
behavioral1
Sample
emotet_exe_e5_df60ca8fb8e3fa0fc2eb56f6d8ee45b5f15beadc5c1ba50bc695c189a2f7576e_2022-02-08__190605.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target emotet_exe_e5_df60ca8fb8e3fa0fc2eb56f6d8ee45b5f15beadc5c1ba50bc695c189a2f7576e_2022-02-08__190605.dll
- Size 360KB
- Sample220208-xsna7adeb3
- SHA256 df60ca8fb8e3fa0fc2eb56f6d8ee45b5f15beadc5c1ba50bc695c189a2f7576e
- MD5 17ddeb7c5cfa5464e004b75aff65f9a1
- SHA1 0044f73ce56fc68ddc1111e59e14747129fae685
- SHA512 1c53a4d3f29058c4f27c0515e3758ecfd8eb038b6627e0dd02bf26289d69f72888e92073acd94ac7d904d9789b9c205a175b25ec7ce04d39e229027acd6665c7
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch5
C2
-
198.199.126.144:443
-
103.42.57.17:8080
-
195.154.146.35:443
-
104.131.62.48:8080
-
116.124.128.206:8080
-
54.38.242.185:443
-
217.182.143.207:443
-
66.42.57.149:443
-
185.148.168.220:8080
-
37.44.244.177:8080
-
78.47.204.80:443
-
173.203.78.138:443
-
190.90.233.66:443
-
203.153.216.46:443
-
54.37.106.167:8080
-
194.9.172.107:8080
-
168.197.250.14:80
-
185.184.25.78:8080
-
191.252.103.16:80
-
159.69.237.188:443
-
85.214.67.203:8080
-
78.46.73.125:443
-
59.148.253.194:443
-
118.98.72.86:443
-
62.171.178.147:8080
-
195.77.239.39:8080
-
185.148.168.15:8080
-
139.196.72.155:8080
-
54.37.228.122:443
-
37.59.209.141:8080
-
198.199.98.78:8080
-
93.104.208.37:8080
-
103.41.204.169:8080
-
128.199.192.135:8080
-
210.57.209.142:8080
-
207.148.81.119:8080
eck1.plain
ecs1.plain
Signatures
- Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4828 svchost.exe Token: SeCreatePagefilePrivilege 4828 svchost.exe Token: SeShutdownPrivilege 4828 svchost.exe Token: SeCreatePagefilePrivilege 4828 svchost.exe Token: SeShutdownPrivilege 4828 svchost.exe Token: SeCreatePagefilePrivilege 4828 svchost.exe Token: SeSecurityPrivilege 1528 TiWorker.exe Token: SeRestorePrivilege 1528 TiWorker.exe Token: SeBackupPrivilege 1528 TiWorker.exe Token: SeBackupPrivilege 1528 TiWorker.exe Token: SeRestorePrivilege 1528 TiWorker.exe Token: SeSecurityPrivilege 1528 TiWorker.exe Token: SeBackupPrivilege 1528 TiWorker.exe Token: SeRestorePrivilege 1528 TiWorker.exe Token: SeSecurityPrivilege 1528 TiWorker.exe Token: SeBackupPrivilege 1528 TiWorker.exe Token: SeRestorePrivilege 1528 TiWorker.exe Token: SeSecurityPrivilege 1528 TiWorker.exe Token: SeBackupPrivilege 1528 TiWorker.exe Token: SeRestorePrivilege 1528 TiWorker.exe Token: SeSecurityPrivilege 1528 TiWorker.exe Token: SeBackupPrivilege 1528 TiWorker.exe Token: SeRestorePrivilege 1528 TiWorker.exe Token: SeSecurityPrivilege 1528 TiWorker.exe Token: SeBackupPrivilege 1528 TiWorker.exe Token: SeRestorePrivilege 1528 TiWorker.exe Token: SeSecurityPrivilege 1528 TiWorker.exe Token: SeBackupPrivilege 1528 TiWorker.exe Token: SeRestorePrivilege 1528 TiWorker.exe Token: SeSecurityPrivilege 1528 TiWorker.exe Token: SeBackupPrivilege 1528 TiWorker.exe Token: SeRestorePrivilege 1528 TiWorker.exe Token: SeSecurityPrivilege 1528 TiWorker.exe Token: SeBackupPrivilege 1528 TiWorker.exe Token: SeRestorePrivilege 1528 TiWorker.exe Token: SeSecurityPrivilege 1528 TiWorker.exe Token: SeBackupPrivilege 1528 TiWorker.exe Token: SeRestorePrivilege 1528 TiWorker.exe Token: SeSecurityPrivilege 1528 TiWorker.exe Token: SeBackupPrivilege 1528 TiWorker.exe Token: SeRestorePrivilege 1528 TiWorker.exe Token: SeSecurityPrivilege 1528 TiWorker.exe Token: SeBackupPrivilege 1528 TiWorker.exe Token: SeRestorePrivilege 1528 TiWorker.exe Token: SeSecurityPrivilege 1528 TiWorker.exe Token: SeBackupPrivilege 1528 TiWorker.exe Token: SeRestorePrivilege 1528 TiWorker.exe Token: SeSecurityPrivilege 1528 TiWorker.exe Token: SeBackupPrivilege 1528 TiWorker.exe Token: SeRestorePrivilege 1528 TiWorker.exe Token: SeSecurityPrivilege 1528 TiWorker.exe Token: SeBackupPrivilege 1528 TiWorker.exe Token: SeRestorePrivilege 1528 TiWorker.exe Token: SeSecurityPrivilege 1528 TiWorker.exe Token: SeBackupPrivilege 1528 TiWorker.exe Token: SeRestorePrivilege 1528 TiWorker.exe Token: SeSecurityPrivilege 1528 TiWorker.exe Token: SeBackupPrivilege 1528 TiWorker.exe Token: SeRestorePrivilege 1528 TiWorker.exe Token: SeSecurityPrivilege 1528 TiWorker.exe Token: SeBackupPrivilege 1528 TiWorker.exe Token: SeRestorePrivilege 1528 TiWorker.exe Token: SeSecurityPrivilege 1528 TiWorker.exe Token: SeBackupPrivilege 1528 TiWorker.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 444 wrote to memory of 4840 444 regsvr32.exe 85 PID 444 wrote to memory of 4840 444 regsvr32.exe 85 PID 444 wrote to memory of 4840 444 regsvr32.exe 85 PID 4840 wrote to memory of 4792 4840 regsvr32.exe 87 PID 4840 wrote to memory of 4792 4840 regsvr32.exe 87 PID 4840 wrote to memory of 4792 4840 regsvr32.exe 87
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_df60ca8fb8e3fa0fc2eb56f6d8ee45b5f15beadc5c1ba50bc695c189a2f7576e_2022-02-08__190605.dll1⤵
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_df60ca8fb8e3fa0fc2eb56f6d8ee45b5f15beadc5c1ba50bc695c189a2f7576e_2022-02-08__190605.dll2⤵
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_df60ca8fb8e3fa0fc2eb56f6d8ee45b5f15beadc5c1ba50bc695c189a2f7576e_2022-02-08__190605.dll",DllRegisterServer3⤵PID:4792
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4828
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1528