Analysis
- max time kernel
140s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
13/02/2022, 16:22
Static task
static1
Behavioral task
behavioral1
Sample
emotet_exe_e5_8dede87659c49ec6da7aa94ece589146a66f45758e65e58d201504db1eacc01b_2022-02-13__162144.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target emotet_exe_e5_8dede87659c49ec6da7aa94ece589146a66f45758e65e58d201504db1eacc01b_2022-02-13__162144.dll
- Size 547KB
- Sample220213-tt8rqsddbr
- SHA256 8dede87659c49ec6da7aa94ece589146a66f45758e65e58d201504db1eacc01b
- MD5 4945e728f65ad00f649d3e6ff4fe6c08
- SHA1 7d9d95091ec1ba61c5e00fad35d88c4856dcf46c
- SHA512 4b5e54a815c0013d294dc3731c574cdbe5dd7d6e281393bde7eabb0b68a96ec390e312476ea2f8161c2d784c110ba5dfbce06bb5f02217d044ff6cedbb402a3c
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch5
C2
-
198.199.126.144:443
-
103.42.57.17:8080
-
195.154.146.35:443
-
104.131.62.48:8080
-
116.124.128.206:8080
-
54.38.242.185:443
-
217.182.143.207:443
-
66.42.57.149:443
-
185.148.168.220:8080
-
37.44.244.177:8080
-
78.47.204.80:443
-
173.203.78.138:443
-
190.90.233.66:443
-
203.153.216.46:443
-
54.37.106.167:8080
-
194.9.172.107:8080
-
168.197.250.14:80
-
185.184.25.78:8080
-
191.252.103.16:80
-
159.69.237.188:443
-
85.214.67.203:8080
-
78.46.73.125:443
-
59.148.253.194:443
-
118.98.72.86:443
-
62.171.178.147:8080
-
195.77.239.39:8080
-
185.148.168.15:8080
-
139.196.72.155:8080
-
54.37.228.122:443
-
37.59.209.141:8080
-
198.199.98.78:8080
-
93.104.208.37:8080
-
103.41.204.169:8080
-
128.199.192.135:8080
-
210.57.209.142:8080
-
207.148.81.119:8080
eck1.plain
ecs1.plain
Signatures
- Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2552 svchost.exe Token: SeCreatePagefilePrivilege 2552 svchost.exe Token: SeShutdownPrivilege 2552 svchost.exe Token: SeCreatePagefilePrivilege 2552 svchost.exe Token: SeShutdownPrivilege 2552 svchost.exe Token: SeCreatePagefilePrivilege 2552 svchost.exe Token: SeSecurityPrivilege 5088 TiWorker.exe Token: SeRestorePrivilege 5088 TiWorker.exe Token: SeBackupPrivilege 5088 TiWorker.exe Token: SeBackupPrivilege 5088 TiWorker.exe Token: SeRestorePrivilege 5088 TiWorker.exe Token: SeSecurityPrivilege 5088 TiWorker.exe Token: SeBackupPrivilege 5088 TiWorker.exe Token: SeRestorePrivilege 5088 TiWorker.exe Token: SeSecurityPrivilege 5088 TiWorker.exe Token: SeBackupPrivilege 5088 TiWorker.exe Token: SeRestorePrivilege 5088 TiWorker.exe Token: SeSecurityPrivilege 5088 TiWorker.exe Token: SeBackupPrivilege 5088 TiWorker.exe Token: SeRestorePrivilege 5088 TiWorker.exe Token: SeSecurityPrivilege 5088 TiWorker.exe Token: SeBackupPrivilege 5088 TiWorker.exe Token: SeRestorePrivilege 5088 TiWorker.exe Token: SeSecurityPrivilege 5088 TiWorker.exe Token: SeBackupPrivilege 5088 TiWorker.exe Token: SeRestorePrivilege 5088 TiWorker.exe Token: SeSecurityPrivilege 5088 TiWorker.exe Token: SeBackupPrivilege 5088 TiWorker.exe Token: SeRestorePrivilege 5088 TiWorker.exe Token: SeSecurityPrivilege 5088 TiWorker.exe Token: SeBackupPrivilege 5088 TiWorker.exe Token: SeRestorePrivilege 5088 TiWorker.exe Token: SeSecurityPrivilege 5088 TiWorker.exe Token: SeBackupPrivilege 5088 TiWorker.exe Token: SeRestorePrivilege 5088 TiWorker.exe Token: SeSecurityPrivilege 5088 TiWorker.exe Token: SeBackupPrivilege 5088 TiWorker.exe Token: SeRestorePrivilege 5088 TiWorker.exe Token: SeSecurityPrivilege 5088 TiWorker.exe Token: SeBackupPrivilege 5088 TiWorker.exe Token: SeRestorePrivilege 5088 TiWorker.exe Token: SeSecurityPrivilege 5088 TiWorker.exe Token: SeBackupPrivilege 5088 TiWorker.exe Token: SeRestorePrivilege 5088 TiWorker.exe Token: SeSecurityPrivilege 5088 TiWorker.exe Token: SeBackupPrivilege 5088 TiWorker.exe Token: SeRestorePrivilege 5088 TiWorker.exe Token: SeSecurityPrivilege 5088 TiWorker.exe Token: SeBackupPrivilege 5088 TiWorker.exe Token: SeRestorePrivilege 5088 TiWorker.exe Token: SeSecurityPrivilege 5088 TiWorker.exe Token: SeBackupPrivilege 5088 TiWorker.exe Token: SeRestorePrivilege 5088 TiWorker.exe Token: SeSecurityPrivilege 5088 TiWorker.exe Token: SeBackupPrivilege 5088 TiWorker.exe Token: SeRestorePrivilege 5088 TiWorker.exe Token: SeSecurityPrivilege 5088 TiWorker.exe Token: SeBackupPrivilege 5088 TiWorker.exe Token: SeRestorePrivilege 5088 TiWorker.exe Token: SeSecurityPrivilege 5088 TiWorker.exe Token: SeBackupPrivilege 5088 TiWorker.exe Token: SeRestorePrivilege 5088 TiWorker.exe Token: SeSecurityPrivilege 5088 TiWorker.exe Token: SeBackupPrivilege 5088 TiWorker.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2424 wrote to memory of 1664 2424 regsvr32.exe 84 PID 2424 wrote to memory of 1664 2424 regsvr32.exe 84 PID 2424 wrote to memory of 1664 2424 regsvr32.exe 84 PID 1664 wrote to memory of 2604 1664 regsvr32.exe 85 PID 1664 wrote to memory of 2604 1664 regsvr32.exe 85 PID 1664 wrote to memory of 2604 1664 regsvr32.exe 85
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_8dede87659c49ec6da7aa94ece589146a66f45758e65e58d201504db1eacc01b_2022-02-13__162144.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_8dede87659c49ec6da7aa94ece589146a66f45758e65e58d201504db1eacc01b_2022-02-13__162144.dll2⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_8dede87659c49ec6da7aa94ece589146a66f45758e65e58d201504db1eacc01b_2022-02-13__162144.dll",DllRegisterServer3⤵PID:2604
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2552
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5088