Analysis
-
max time kernel
48s -
max time network
51s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
09-02-2023 19:36
Static task
static1
General
-
Target
file.dll
-
Size
593KB
-
MD5
9b82f37e58f9bb27d2a7dd96e9e2f702
-
SHA1
d8c507b86e9843594169e4cbcccd9a35c1f97d60
-
SHA256
99dab8b3093e77419cff4a3e64045b972f1152812a69332ad88da1aaad56485e
-
SHA512
56628b14b1f015c61382520964dd9c3c68c6c012af0310d3d3e897dec25b726c1d047d2182da4f23bc7e863fe11caebdb728f4adf2b6f361004be8e46aa740c1
-
SSDEEP
12288:nsuLrr8h7qGMufOWhNkdgF8h3UHHdM/tQ3W:n5/q7qGMufdhNtF8SH9M/tQ3
Malware Config
Extracted
emotet
Epoch5
202.28.34.99:8080
80.211.107.116:8080
175.126.176.79:8080
218.38.121.17:443
139.196.72.155:8080
103.71.99.57:8080
87.106.97.83:7080
178.62.112.199:8080
64.227.55.231:8080
46.101.98.60:8080
54.37.228.122:443
128.199.217.206:443
190.145.8.4:443
209.239.112.82:8080
85.214.67.203:8080
198.199.70.22:8080
128.199.242.164:8080
178.238.225.252:8080
103.85.95.4:8080
103.126.216.86:443
104.244.79.94:443
36.67.23.59:443
37.44.244.177:8080
160.16.143.191:8080
85.25.120.45:8080
103.56.149.105:8080
210.57.209.142:8080
195.77.239.39:8080
62.171.178.147:8080
118.98.72.86:443
103.224.241.74:8080
185.148.169.10:8080
103.41.204.169:8080
186.250.48.5:443
165.22.254.236:8080
93.104.209.107:8080
139.59.80.108:8080
196.44.98.190:8080
114.79.130.68:443
115.178.55.22:80
103.254.12.236:7080
172.105.115.71:8080
174.138.33.49:7080
51.75.33.122:443
83.229.80.93:8080
78.47.204.80:443
188.165.79.151:443
202.134.4.210:7080
82.98.180.154:7080
Signatures
-
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\1601268389\3877292338.pri taskmgr.exe File created C:\Windows\rescache\_merged\4183903823\810424605.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
regsvr32.exeregsvr32.exetaskmgr.exepid process 4796 regsvr32.exe 4796 regsvr32.exe 3340 regsvr32.exe 3340 regsvr32.exe 3340 regsvr32.exe 3340 regsvr32.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 4796 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 4324 taskmgr.exe Token: SeSystemProfilePrivilege 4324 taskmgr.exe Token: SeCreateGlobalPrivilege 4324 taskmgr.exe -
Suspicious use of FindShellTrayWindow 31 IoCs
Processes:
taskmgr.exepid process 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe -
Suspicious use of SendNotifyMessage 31 IoCs
Processes:
taskmgr.exepid process 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe 4324 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
regsvr32.exedescription pid process target process PID 4796 wrote to memory of 3340 4796 regsvr32.exe regsvr32.exe PID 4796 wrote to memory of 3340 4796 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\file.dll1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\BpAxViqyvRblcl\gvBradxrWp.dll"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage