Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
11-07-2022 09:04
Static task
static1
Behavioral task
behavioral1
Sample
187a117c79f7da7350737d0a1f4733dcbb01769f.exe
Resource
win7-20220414-en
General
-
Target
187a117c79f7da7350737d0a1f4733dcbb01769f.exe
-
Size
528KB
-
MD5
91069647824563dce4341d42eab3f536
-
SHA1
187a117c79f7da7350737d0a1f4733dcbb01769f
-
SHA256
6b7ebd5fb9b2a26568d63d9ae3fe9b35ea2ea50e030a24a6b49b0e95ba291729
-
SHA512
ced73f6fae5094540074ecc5578a7a1c5c6483b98e345548b4d85a66a6db2091bd25a77ecf15f719038ecf0afbe6405bc97f6c01d464ec73fb281c00ed2dc95a
Malware Config
Extracted
emotet
Epoch1
186.92.11.143:8080
200.30.227.135:80
178.249.187.151:8080
81.169.140.14:443
94.177.183.28:8080
89.188.124.145:443
185.86.148.222:8080
82.196.15.205:8080
77.245.101.134:8080
217.199.160.224:8080
76.69.29.42:80
181.59.253.20:21
46.28.111.142:7080
149.62.173.247:8080
200.58.83.179:80
190.230.60.129:80
181.36.42.205:443
190.97.30.167:990
46.29.183.211:8080
87.106.77.40:7080
212.71.237.140:8080
151.80.142.33:80
185.187.198.10:8080
190.146.131.105:8080
5.196.35.138:7080
119.59.124.163:8080
190.10.194.42:8080
183.82.97.25:80
79.127.57.43:80
203.25.159.3:8080
69.163.33.84:8080
45.79.95.107:443
178.79.163.131:8080
46.41.151.103:8080
91.204.163.19:8090
62.75.160.178:8080
200.113.106.18:80
46.101.212.195:8080
144.139.158.155:80
50.28.51.143:8080
200.58.171.51:80
190.230.60.129:8080
91.205.215.57:7080
80.85.87.122:8080
14.160.93.230:80
62.75.143.100:7080
200.57.102.71:8443
94.183.71.206:7080
138.68.106.4:7080
79.143.182.254:8080
46.163.144.228:80
79.129.0.173:8080
68.183.170.114:8080
86.42.166.147:80
190.104.253.234:990
190.85.152.186:8080
170.84.133.72:7080
201.163.74.202:443
159.203.204.126:8080
186.68.141.218:80
51.15.8.192:8080
186.1.41.111:443
109.169.86.13:8080
181.16.17.210:443
119.159.150.176:443
181.135.153.203:443
139.5.237.27:443
91.83.93.124:7080
187.193.89.61:50000
77.55.211.77:8080
181.44.166.242:80
186.23.132.93:990
181.51.251.236:443
68.183.190.199:8080
104.131.58.132:8080
186.0.95.172:80
190.1.37.125:443
190.38.14.52:80
Signatures
-
suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M2
suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M2
-
suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M3
suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M3
-
suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M4
suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M4
-
Drops file in System32 directory 1 IoCs
Processes:
iellrus.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat iellrus.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
iellrus.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00a8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 iellrus.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A2CCC9B5-A479-408A-ADB6-6DA9A1AE41DE}\WpadDecisionReason = "1" iellrus.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-10-a0-71-21-12\WpadDecisionTime = 40ce4d0a1695d801 iellrus.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 iellrus.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad iellrus.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" iellrus.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings iellrus.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A2CCC9B5-A479-408A-ADB6-6DA9A1AE41DE} iellrus.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A2CCC9B5-A479-408A-ADB6-6DA9A1AE41DE}\WpadDecisionTime = 40ce4d0a1695d801 iellrus.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A2CCC9B5-A479-408A-ADB6-6DA9A1AE41DE}\7a-10-a0-71-21-12 iellrus.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-10-a0-71-21-12\WpadDecisionReason = "1" iellrus.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections iellrus.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 iellrus.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" iellrus.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A2CCC9B5-A479-408A-ADB6-6DA9A1AE41DE}\WpadNetworkName = "Network 3" iellrus.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-10-a0-71-21-12\WpadDecision = "0" iellrus.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix iellrus.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" iellrus.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-10-a0-71-21-12 iellrus.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings iellrus.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A2CCC9B5-A479-408A-ADB6-6DA9A1AE41DE}\WpadDecision = "0" iellrus.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
iellrus.exepid process 844 iellrus.exe 844 iellrus.exe 844 iellrus.exe 844 iellrus.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
187a117c79f7da7350737d0a1f4733dcbb01769f.exepid process 1888 187a117c79f7da7350737d0a1f4733dcbb01769f.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
187a117c79f7da7350737d0a1f4733dcbb01769f.exe187a117c79f7da7350737d0a1f4733dcbb01769f.exeiellrus.exeiellrus.exepid process 1084 187a117c79f7da7350737d0a1f4733dcbb01769f.exe 1084 187a117c79f7da7350737d0a1f4733dcbb01769f.exe 1888 187a117c79f7da7350737d0a1f4733dcbb01769f.exe 1888 187a117c79f7da7350737d0a1f4733dcbb01769f.exe 1360 iellrus.exe 1360 iellrus.exe 844 iellrus.exe 844 iellrus.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
187a117c79f7da7350737d0a1f4733dcbb01769f.exeiellrus.exedescription pid process target process PID 1084 wrote to memory of 1888 1084 187a117c79f7da7350737d0a1f4733dcbb01769f.exe 187a117c79f7da7350737d0a1f4733dcbb01769f.exe PID 1084 wrote to memory of 1888 1084 187a117c79f7da7350737d0a1f4733dcbb01769f.exe 187a117c79f7da7350737d0a1f4733dcbb01769f.exe PID 1084 wrote to memory of 1888 1084 187a117c79f7da7350737d0a1f4733dcbb01769f.exe 187a117c79f7da7350737d0a1f4733dcbb01769f.exe PID 1084 wrote to memory of 1888 1084 187a117c79f7da7350737d0a1f4733dcbb01769f.exe 187a117c79f7da7350737d0a1f4733dcbb01769f.exe PID 1360 wrote to memory of 844 1360 iellrus.exe iellrus.exe PID 1360 wrote to memory of 844 1360 iellrus.exe iellrus.exe PID 1360 wrote to memory of 844 1360 iellrus.exe iellrus.exe PID 1360 wrote to memory of 844 1360 iellrus.exe iellrus.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\187a117c79f7da7350737d0a1f4733dcbb01769f.exe"C:\Users\Admin\AppData\Local\Temp\187a117c79f7da7350737d0a1f4733dcbb01769f.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\187a117c79f7da7350737d0a1f4733dcbb01769f.exe--34c90f662⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\iellrus.exe"C:\Windows\SysWOW64\iellrus.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\iellrus.exe--68e352a2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/844-74-0x0000000000000000-mapping.dmp
-
memory/844-76-0x0000000000910000-0x0000000000926000-memory.dmpFilesize
88KB
-
memory/1084-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmpFilesize
8KB
-
memory/1084-55-0x0000000000260000-0x0000000000276000-memory.dmpFilesize
88KB
-
memory/1084-61-0x0000000000250000-0x0000000000260000-memory.dmpFilesize
64KB
-
memory/1360-69-0x0000000000980000-0x0000000000996000-memory.dmpFilesize
88KB
-
memory/1888-60-0x0000000000000000-mapping.dmp
-
memory/1888-63-0x0000000000280000-0x0000000000296000-memory.dmpFilesize
88KB