Analysis
-
max time kernel
156s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-06-2022 22:39
Static task
static1
Behavioral task
behavioral1
Sample
37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe
Resource
win10v2004-20220414-en
General
-
Target
37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe
-
Size
316KB
-
MD5
40a96c42e50077f03f9873a696427b0c
-
SHA1
5932ee55845edbeb10c7bc612b88eb2f1c7316cd
-
SHA256
37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb
-
SHA512
45883c375d9384a99065db8e33778647e31ca7c16baee5f46ef859baf21954b72b7e100ef96adaf3e581cff8a60ee0d91ebe98b364ef9ad7eb3bf0d6efc64b84
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\e476yexdjs.exe" 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\e476yexdjs.exe" 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe -
suricata: ET MALWARE Possible Emotet DGA NXDOMAIN Responses
suricata: ET MALWARE Possible Emotet DGA NXDOMAIN Responses
-
Disables RegEdit via registry modification 1 IoCs
Processes:
37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe -
Disables Task Manager via registry modification
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ZT5B0cUB-7Ln8-ERbk-bYZw-GfsEiQpHSoxF} 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ZT5B0cUB-7Ln8-ERbk-bYZw-GfsEiQpHSoxF}\Vp8VykqmSuJMWPi = "\"C:\\Users\\Admin\\AppData\\Roaming\\e476yexdjs.exe\" /ActiveX" 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe -
Processes:
resource yara_rule behavioral2/memory/2660-133-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/2660-134-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/2660-135-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/2660-136-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/2660-137-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/2660-138-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/2660-142-0x0000000000400000-0x000000000049A000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exepid process 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Vp8VykqmSuJMWPi = "C:\\Users\\Admin\\AppData\\Roaming\\e476yexdjs.exe" 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Vp8VykqmSuJMWPi = "C:\\Users\\Admin\\AppData\\Roaming\\e476yexdjs.exe" 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe -
Processes:
37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe -
Modifies WinLogon 2 TTPs 1 IoCs
Processes:
37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exedescription pid process target process PID 736 set thread context of 2660 736 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exepid process 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe -
Suspicious use of FindShellTrayWindow 11 IoCs
Processes:
37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exepid process 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exepid process 736 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 2660 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exedescription pid process target process PID 736 wrote to memory of 2660 736 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe PID 736 wrote to memory of 2660 736 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe PID 736 wrote to memory of 2660 736 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe PID 736 wrote to memory of 2660 736 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe PID 736 wrote to memory of 2660 736 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe PID 736 wrote to memory of 2660 736 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe PID 736 wrote to memory of 2660 736 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe PID 736 wrote to memory of 2660 736 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe 37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe"C:\Users\Admin\AppData\Local\Temp\37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exeC:\Users\Admin\AppData\Local\Temp\37a3c510bf94138e9cc983c691fdfaf22a8de1bbac3cf718a7e522649cdf88fb.exe2⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Modifies Installed Components in the registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\dwlGina3.dllFilesize
93KB
MD51173123287198dce1eb831f04e28352c
SHA139d650f4297c990a7ffaa7dc3b6d0ef903c9bd14
SHA25665d4582e135c774d9c827ae08de8b77f199ee934f13d1a0537df4f5d18f590ba
SHA512e9fdb6e808b0f3ed850fb364d48609a9726fd41ad138594fc04f8d48d5672aec3aaa76af236f07c4263c053dc539f99009e74491adb03c885190dcce78f0cede
-
C:\Users\Admin\AppData\Local\Temp\dwlGina3.dllFilesize
93KB
MD51173123287198dce1eb831f04e28352c
SHA139d650f4297c990a7ffaa7dc3b6d0ef903c9bd14
SHA25665d4582e135c774d9c827ae08de8b77f199ee934f13d1a0537df4f5d18f590ba
SHA512e9fdb6e808b0f3ed850fb364d48609a9726fd41ad138594fc04f8d48d5672aec3aaa76af236f07c4263c053dc539f99009e74491adb03c885190dcce78f0cede
-
memory/2660-132-0x0000000000000000-mapping.dmp
-
memory/2660-133-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/2660-134-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/2660-135-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/2660-136-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/2660-137-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/2660-138-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/2660-141-0x0000000000B90000-0x0000000000BAC000-memory.dmpFilesize
112KB
-
memory/2660-142-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB