Analysis
-
max time kernel
4294201s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
26-02-2022 09:03
Static task
static1
Behavioral task
behavioral1
Sample
399e3d6374d2b5bbdd173c75109f9a91d8a3cec353762a5111beb7dcac5a2792.exe
Resource
win7-20220223-en
General
-
Target
399e3d6374d2b5bbdd173c75109f9a91d8a3cec353762a5111beb7dcac5a2792.exe
-
Size
76KB
-
MD5
ab60eceae6ca85a01ea7e4f86c0b7844
-
SHA1
f4c6d084dc4c476bcc1a21b7790377537fb94538
-
SHA256
399e3d6374d2b5bbdd173c75109f9a91d8a3cec353762a5111beb7dcac5a2792
-
SHA512
f609e23b15c280e94350cd268ef420d6ae2f34af9a133731929f8d3c4a8bd7f3d31c2cc4767b8ca75977ab69e1fcc46c0507962af10703d53ce6f40211f7aeea
Malware Config
Extracted
emotet
Epoch2
185.155.20.82:80
82.223.70.24:8080
58.171.38.26:80
103.86.49.11:8080
31.31.77.83:443
92.222.216.44:8080
186.208.123.210:443
136.243.205.112:7080
60.130.173.117:80
160.16.215.66:8080
98.15.140.226:80
162.241.92.219:8080
78.186.5.109:443
87.127.197.7:8080
168.235.67.138:7080
210.56.10.58:80
60.250.78.22:443
114.145.241.208:80
104.131.11.150:443
62.75.141.82:80
193.80.169.64:80
139.130.242.43:80
87.106.139.101:8080
23.92.16.164:8080
177.230.81.0:22
41.60.200.34:80
211.63.71.72:8080
212.174.19.87:80
113.160.130.116:8443
67.235.68.222:80
62.138.26.28:8080
45.33.49.124:443
104.131.44.150:8080
120.151.135.224:80
74.208.45.104:8080
95.128.43.213:8080
37.187.72.193:8080
185.94.252.104:443
176.9.43.37:8080
78.24.219.147:8080
46.105.131.69:443
98.156.206.153:80
101.187.97.173:80
176.111.60.55:8080
46.105.131.87:80
110.145.77.103:80
37.139.21.175:8080
201.173.217.124:443
190.108.228.62:8080
62.75.187.192:8080
24.194.252.25:80
87.106.136.232:8080
95.213.236.64:8080
200.41.121.90:80
24.94.237.248:80
5.196.74.210:8080
58.177.172.160:80
5.39.91.110:7080
68.44.137.144:443
91.205.215.66:443
59.20.65.102:80
190.160.53.126:80
209.141.54.221:8080
70.48.238.90:80
195.244.215.206:80
169.239.182.217:8080
209.151.248.242:8080
178.20.74.212:80
104.236.246.93:8080
50.116.86.205:8080
93.51.50.171:8080
113.61.66.94:80
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
label.exepid process 1080 label.exe -
Drops file in System32 directory 1 IoCs
Processes:
399e3d6374d2b5bbdd173c75109f9a91d8a3cec353762a5111beb7dcac5a2792.exedescription ioc process File opened for modification C:\Windows\SysWOW64\WMVSDECD\label.exe 399e3d6374d2b5bbdd173c75109f9a91d8a3cec353762a5111beb7dcac5a2792.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
label.exepid process 1080 label.exe 1080 label.exe 1080 label.exe 1080 label.exe 1080 label.exe 1080 label.exe 1080 label.exe 1080 label.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
399e3d6374d2b5bbdd173c75109f9a91d8a3cec353762a5111beb7dcac5a2792.exepid process 1140 399e3d6374d2b5bbdd173c75109f9a91d8a3cec353762a5111beb7dcac5a2792.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
399e3d6374d2b5bbdd173c75109f9a91d8a3cec353762a5111beb7dcac5a2792.exelabel.exepid process 1140 399e3d6374d2b5bbdd173c75109f9a91d8a3cec353762a5111beb7dcac5a2792.exe 1140 399e3d6374d2b5bbdd173c75109f9a91d8a3cec353762a5111beb7dcac5a2792.exe 1080 label.exe 1080 label.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
399e3d6374d2b5bbdd173c75109f9a91d8a3cec353762a5111beb7dcac5a2792.exedescription pid process target process PID 1140 wrote to memory of 1080 1140 399e3d6374d2b5bbdd173c75109f9a91d8a3cec353762a5111beb7dcac5a2792.exe label.exe PID 1140 wrote to memory of 1080 1140 399e3d6374d2b5bbdd173c75109f9a91d8a3cec353762a5111beb7dcac5a2792.exe label.exe PID 1140 wrote to memory of 1080 1140 399e3d6374d2b5bbdd173c75109f9a91d8a3cec353762a5111beb7dcac5a2792.exe label.exe PID 1140 wrote to memory of 1080 1140 399e3d6374d2b5bbdd173c75109f9a91d8a3cec353762a5111beb7dcac5a2792.exe label.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\399e3d6374d2b5bbdd173c75109f9a91d8a3cec353762a5111beb7dcac5a2792.exe"C:\Users\Admin\AppData\Local\Temp\399e3d6374d2b5bbdd173c75109f9a91d8a3cec353762a5111beb7dcac5a2792.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WMVSDECD\label.exe"C:\Windows\SysWOW64\WMVSDECD\label.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\WMVSDECD\label.exeMD5
ab60eceae6ca85a01ea7e4f86c0b7844
SHA1f4c6d084dc4c476bcc1a21b7790377537fb94538
SHA256399e3d6374d2b5bbdd173c75109f9a91d8a3cec353762a5111beb7dcac5a2792
SHA512f609e23b15c280e94350cd268ef420d6ae2f34af9a133731929f8d3c4a8bd7f3d31c2cc4767b8ca75977ab69e1fcc46c0507962af10703d53ce6f40211f7aeea
-
memory/1080-60-0x0000000000370000-0x000000000037C000-memory.dmpFilesize
48KB
-
memory/1140-54-0x00000000002F0000-0x00000000002FC000-memory.dmpFilesize
48KB
-
memory/1140-57-0x0000000075BD1000-0x0000000075BD3000-memory.dmpFilesize
8KB
-
memory/1140-58-0x00000000002E0000-0x00000000002E9000-memory.dmpFilesize
36KB