Analysis
-
max time kernel
167s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
08-02-2022 20:57
Static task
static1
Behavioral task
behavioral1
Sample
6235cb76131d1a50d16318e26dadd995cd2aee85c8eb5b0173cc8241c9d4a3a5.exe
Resource
win7-en-20211208
General
-
Target
6235cb76131d1a50d16318e26dadd995cd2aee85c8eb5b0173cc8241c9d4a3a5.exe
-
Size
360KB
-
MD5
2e448142cc14b1c73a1430b8dab9911d
-
SHA1
89165208fb24a37bd8d0e6cf0d9213e91b3bf887
-
SHA256
6235cb76131d1a50d16318e26dadd995cd2aee85c8eb5b0173cc8241c9d4a3a5
-
SHA512
58735b8f437796b99a5d8eb5244f55314342442e2e1ff89ea3b36402ed0494ed50438901c18fee413659a6b84dd19c2c39fabdd86e759a491460dad6ddb55db8
Malware Config
Extracted
emotet
Epoch2
96.252.116.33:80
110.145.11.73:80
185.201.9.197:8080
64.207.182.168:8080
51.89.36.180:443
208.74.26.234:80
89.216.122.92:80
190.164.104.62:80
62.75.141.82:80
94.230.70.6:80
37.187.72.193:8080
72.186.136.247:443
138.68.87.218:443
120.150.60.189:80
24.69.65.8:8080
110.142.236.207:80
74.208.45.104:8080
113.61.66.94:80
74.128.121.17:80
110.145.101.66:443
2.58.16.89:8080
115.94.207.99:443
123.176.25.234:80
184.180.181.202:80
167.114.153.111:8080
155.186.9.160:80
209.141.54.221:7080
187.161.206.24:80
79.137.83.50:443
47.146.39.147:80
91.211.88.52:7080
152.170.205.73:80
41.185.28.84:8080
119.59.116.21:8080
110.145.77.103:80
50.91.114.38:80
168.235.67.138:7080
181.165.68.127:80
74.40.205.197:443
109.74.5.95:8080
120.150.218.241:443
103.86.49.11:8080
62.171.142.179:8080
37.139.21.175:8080
108.21.72.56:443
174.118.202.24:443
173.63.222.65:80
142.112.10.95:20
202.134.4.211:8080
75.143.247.51:80
100.37.240.62:80
190.29.166.0:80
202.141.243.254:443
157.245.99.39:8080
67.10.155.92:80
200.116.145.225:443
50.245.107.73:443
190.146.92.48:80
5.39.91.110:7080
139.59.60.244:8080
49.50.209.131:80
112.185.64.233:80
190.240.194.77:443
94.23.237.171:443
80.227.52.78:80
173.173.254.105:80
188.219.31.12:80
74.75.104.224:80
87.106.139.101:8080
172.86.188.251:8080
121.124.124.40:7080
61.19.246.238:443
194.4.58.192:7080
220.245.198.194:80
24.179.13.119:80
74.135.120.91:80
46.105.131.79:8080
62.30.7.67:443
202.134.4.216:8080
95.213.236.64:8080
85.105.111.166:80
24.178.90.49:80
203.153.216.189:7080
76.27.179.47:80
190.162.215.233:80
137.59.187.107:8080
161.0.153.60:80
139.162.60.124:8080
139.99.158.11:443
217.20.166.178:7080
190.108.228.27:443
95.9.5.93:80
51.89.199.141:8080
12.184.217.101:80
118.83.154.64:443
134.209.144.106:443
78.24.219.147:8080
5.2.212.254:80
172.125.40.123:80
194.190.67.75:80
172.105.13.66:443
109.116.245.80:80
99.247.33.186:80
185.94.252.104:443
104.131.11.150:443
24.101.229.82:80
172.104.97.173:8080
172.91.208.86:80
176.111.60.55:8080
76.175.162.101:80
186.74.215.34:80
47.36.140.164:80
201.241.127.190:80
98.150.169.135:80
Signatures
-
Emotet Payload 3 IoCs
Detects Emotet payload in memory.
Processes:
resource yara_rule behavioral2/memory/648-130-0x0000000000560000-0x0000000000572000-memory.dmp emotet behavioral2/memory/648-133-0x0000000002270000-0x0000000002280000-memory.dmp emotet behavioral2/memory/648-135-0x00000000004C0000-0x00000000004CF000-memory.dmp emotet -
Drops file in System32 directory 1 IoCs
Processes:
6235cb76131d1a50d16318e26dadd995cd2aee85c8eb5b0173cc8241c9d4a3a5.exedescription ioc process File opened for modification C:\Windows\SysWOW64\NetCfgNotifyObjectHost\KBDSORA.exe 6235cb76131d1a50d16318e26dadd995cd2aee85c8eb5b0173cc8241c9d4a3a5.exe -
Drops file in Windows directory 2 IoCs
Processes:
6235cb76131d1a50d16318e26dadd995cd2aee85c8eb5b0173cc8241c9d4a3a5.exesvchost.exedescription ioc process File opened for modification C:\Windows\notepad.exe 6235cb76131d1a50d16318e26dadd995cd2aee85c8eb5b0173cc8241c9d4a3a5.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 45 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4024" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "2.164501" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132890229285902548" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
6235cb76131d1a50d16318e26dadd995cd2aee85c8eb5b0173cc8241c9d4a3a5.exepid process 648 6235cb76131d1a50d16318e26dadd995cd2aee85c8eb5b0173cc8241c9d4a3a5.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
6235cb76131d1a50d16318e26dadd995cd2aee85c8eb5b0173cc8241c9d4a3a5.exepid process 648 6235cb76131d1a50d16318e26dadd995cd2aee85c8eb5b0173cc8241c9d4a3a5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6235cb76131d1a50d16318e26dadd995cd2aee85c8eb5b0173cc8241c9d4a3a5.exe"C:\Users\Admin\AppData\Local\Temp\6235cb76131d1a50d16318e26dadd995cd2aee85c8eb5b0173cc8241c9d4a3a5.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS