Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08-07-2022 20:26
Behavioral task
behavioral1
Sample
403ffc45012019acdb891d071e1ad5a23beac91ea6335048cb0484b38662858c.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
403ffc45012019acdb891d071e1ad5a23beac91ea6335048cb0484b38662858c.exe
Resource
win10v2004-20220414-en
General
-
Target
403ffc45012019acdb891d071e1ad5a23beac91ea6335048cb0484b38662858c.exe
-
Size
474KB
-
MD5
3f8241a5bc324829e73d61b60acac585
-
SHA1
64c29545cb2a567133540b1c2e88ebd5deeaf827
-
SHA256
403ffc45012019acdb891d071e1ad5a23beac91ea6335048cb0484b38662858c
-
SHA512
bd67ab3c8d937398c3cfd91ca11821a2b48d667949c5e799b69fd618d1cb0abe01e97f3fee1321611d60c8071bae462a65316de6f515d646a5712ca42d5504f8
Malware Config
Extracted
emotet
Epoch2
124.240.198.66:80
186.75.241.230:80
181.143.194.138:443
45.79.188.67:8080
77.237.248.136:8080
185.142.236.163:443
63.142.253.122:8080
178.254.6.27:7080
190.211.207.11:443
78.188.105.159:21
182.176.106.43:995
178.79.161.166:443
206.189.98.125:8080
87.230.19.21:8080
80.11.163.139:443
101.187.237.217:20
190.18.146.70:80
86.98.25.30:53
92.222.125.16:7080
186.4.172.5:443
169.239.182.217:8080
189.209.217.49:80
104.236.246.93:8080
190.228.72.244:53
88.247.163.44:80
45.123.3.54:443
91.205.215.66:8080
190.106.97.230:443
199.19.237.192:80
186.4.172.5:20
94.205.247.10:80
104.131.11.150:8080
144.139.247.220:80
119.15.153.237:80
173.212.203.26:8080
136.243.177.26:8080
5.196.74.210:8080
85.104.59.244:20
190.186.203.55:80
187.144.189.58:50000
78.24.219.147:8080
186.4.172.5:8080
46.105.131.87:80
149.167.86.174:990
222.214.218.192:8080
88.156.97.210:80
185.94.252.13:443
190.226.44.20:21
217.145.83.44:80
80.11.163.139:21
138.201.140.110:8080
190.53.135.159:21
31.172.240.91:8080
92.222.216.44:8080
87.106.139.101:8080
159.65.25.128:8080
31.12.67.62:7080
211.63.71.72:8080
179.32.19.219:22
92.233.128.13:143
87.106.136.232:8080
182.176.132.213:8090
37.157.194.134:443
181.143.53.227:21
188.166.253.46:8080
41.220.119.246:80
95.128.43.213:8080
103.97.95.218:143
201.251.43.69:8080
190.108.228.48:990
149.202.153.252:8080
24.51.106.145:21
182.76.6.2:8080
85.106.1.166:50000
62.75.187.192:8080
142.44.162.209:8080
45.33.49.124:443
27.147.163.188:8080
217.160.182.191:8080
212.71.234.16:8080
83.136.245.190:8080
47.41.213.2:22
103.255.150.84:80
200.71.148.138:8080
190.145.67.134:8090
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
tenanttenant.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat tenanttenant.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
tenanttenant.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-3d-2f-73-16-36 tenanttenant.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-3d-2f-73-16-36\WpadDecision = "0" tenanttenant.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" tenanttenant.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings tenanttenant.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad tenanttenant.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6D6029F8-E96C-44DF-8D85-CFA520C9AF43}\WpadNetworkName = "Network 3" tenanttenant.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6D6029F8-E96C-44DF-8D85-CFA520C9AF43} tenanttenant.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6D6029F8-E96C-44DF-8D85-CFA520C9AF43}\WpadDecision = "0" tenanttenant.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6D6029F8-E96C-44DF-8D85-CFA520C9AF43}\d2-3d-2f-73-16-36 tenanttenant.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-3d-2f-73-16-36\WpadDecisionReason = "1" tenanttenant.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections tenanttenant.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 tenanttenant.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" tenanttenant.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 tenanttenant.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-3d-2f-73-16-36\WpadDecisionTime = 209b99d63e93d801 tenanttenant.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix tenanttenant.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" tenanttenant.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6D6029F8-E96C-44DF-8D85-CFA520C9AF43}\WpadDecisionReason = "1" tenanttenant.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings tenanttenant.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0067000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 tenanttenant.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6D6029F8-E96C-44DF-8D85-CFA520C9AF43}\WpadDecisionTime = 209b99d63e93d801 tenanttenant.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
tenanttenant.exepid process 744 tenanttenant.exe 744 tenanttenant.exe 744 tenanttenant.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
403ffc45012019acdb891d071e1ad5a23beac91ea6335048cb0484b38662858c.exepid process 888 403ffc45012019acdb891d071e1ad5a23beac91ea6335048cb0484b38662858c.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 1244 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1244 AUDIODG.EXE Token: 33 1244 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1244 AUDIODG.EXE -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
403ffc45012019acdb891d071e1ad5a23beac91ea6335048cb0484b38662858c.exe403ffc45012019acdb891d071e1ad5a23beac91ea6335048cb0484b38662858c.exetenanttenant.exetenanttenant.exepid process 1860 403ffc45012019acdb891d071e1ad5a23beac91ea6335048cb0484b38662858c.exe 888 403ffc45012019acdb891d071e1ad5a23beac91ea6335048cb0484b38662858c.exe 896 tenanttenant.exe 744 tenanttenant.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
403ffc45012019acdb891d071e1ad5a23beac91ea6335048cb0484b38662858c.exetenanttenant.exedescription pid process target process PID 1860 wrote to memory of 888 1860 403ffc45012019acdb891d071e1ad5a23beac91ea6335048cb0484b38662858c.exe 403ffc45012019acdb891d071e1ad5a23beac91ea6335048cb0484b38662858c.exe PID 1860 wrote to memory of 888 1860 403ffc45012019acdb891d071e1ad5a23beac91ea6335048cb0484b38662858c.exe 403ffc45012019acdb891d071e1ad5a23beac91ea6335048cb0484b38662858c.exe PID 1860 wrote to memory of 888 1860 403ffc45012019acdb891d071e1ad5a23beac91ea6335048cb0484b38662858c.exe 403ffc45012019acdb891d071e1ad5a23beac91ea6335048cb0484b38662858c.exe PID 1860 wrote to memory of 888 1860 403ffc45012019acdb891d071e1ad5a23beac91ea6335048cb0484b38662858c.exe 403ffc45012019acdb891d071e1ad5a23beac91ea6335048cb0484b38662858c.exe PID 896 wrote to memory of 744 896 tenanttenant.exe tenanttenant.exe PID 896 wrote to memory of 744 896 tenanttenant.exe tenanttenant.exe PID 896 wrote to memory of 744 896 tenanttenant.exe tenanttenant.exe PID 896 wrote to memory of 744 896 tenanttenant.exe tenanttenant.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\403ffc45012019acdb891d071e1ad5a23beac91ea6335048cb0484b38662858c.exe"C:\Users\Admin\AppData\Local\Temp\403ffc45012019acdb891d071e1ad5a23beac91ea6335048cb0484b38662858c.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\403ffc45012019acdb891d071e1ad5a23beac91ea6335048cb0484b38662858c.exe--687c3b742⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5481⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\tenanttenant.exe"C:\Windows\SysWOW64\tenanttenant.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tenanttenant.exe--7b4783e62⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/744-63-0x0000000000000000-mapping.dmp
-
memory/888-55-0x0000000000000000-mapping.dmp
-
memory/888-59-0x0000000000500000-0x0000000000515000-memory.dmpFilesize
84KB
-
memory/888-61-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/888-64-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1860-54-0x0000000075E41000-0x0000000075E43000-memory.dmpFilesize
8KB
-
memory/1860-57-0x0000000000350000-0x0000000000365000-memory.dmpFilesize
84KB
-
memory/1860-58-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1860-60-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB