Analysis

  • max time kernel
    100s
  • max time network
    148s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    23-03-2023 17:54

General

  • Target

    de53c5ea5dee3fcc8b6a9f8a6926aa84d1434408e968205f0e8ef94250c8f3a8.vbs

  • Size

    93KB

  • MD5

    4452f951ec5390c7cd0397d659717b4d

  • SHA1

    1ddf3284b015fb3e7dba3157ba6c81511a9c9402

  • SHA256

    de53c5ea5dee3fcc8b6a9f8a6926aa84d1434408e968205f0e8ef94250c8f3a8

  • SHA512

    9f72c23a9975d1745b97a8b454695ffd6272410acb9d71ec7e1c5d479cfce6deb09aecd2f3cc49ed1c5307d0f5be788498e9c01876cbfc2b2255c38ff4b549bd

  • SSDEEP

    1536:fh7OdS2cokRMkxS8qDAHfhhBqrHBsNZqHqbuh7jGMkVh7Ufqjx3RFtDGXo6BICuQ:fh7OdS2cokRMkxS8qDAHJhorHBsNZqHB

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

213.239.212.5:443

129.232.188.93:443

103.43.75.120:443

197.242.150.244:8080

1.234.2.232:8080

110.232.117.186:8080

95.217.221.146:8080

159.89.202.34:443

159.65.88.10:8080

82.223.21.224:8080

169.57.156.166:8080

45.176.232.124:443

45.235.8.30:8080

173.212.193.249:8080

107.170.39.149:8080

119.59.103.152:8080

167.172.199.165:8080

91.207.28.33:8080

185.4.135.165:8080

104.168.155.143:8080

eck1.plain
ecs1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Blocklisted process makes network request 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\de53c5ea5dee3fcc8b6a9f8a6926aa84d1434408e968205f0e8ef94250c8f3a8.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2908
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //E:vbscript C:\Users\Admin\AppData\Local\Temp\rad585DB23B2darrad832450CF3dar.txt
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of WriteProcessMemory
      PID:4112
      • C:\Windows\System32\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" "C:\Users\Admin\AppData\Local\Temp\radAF91E107Ddar\Ml4U5RIgZ500l028HenlO.dll"
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3648
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KVjmjcoMAyAHKtmZ\LwGHPFECyGYrCrx.dll"
          4⤵
            PID:3148

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    System Information Discovery

    1
    T1082

    Query Registry

    1
    T1012

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\rad585DB23B2darrad832450CF3dar.txt
      Filesize

      63KB

      MD5

      384b4dde80c6f5394f440b6951da895b

      SHA1

      585664d227f8aac1a367e8630f15cedafd1de131

      SHA256

      bdb582b55ecd8f46bd0795e7acc9c6c2fe8f2f871f617be0804becb8ed789c50

      SHA512

      6f7f3d76e54f1cc900a914be8ea82050fda02a054f3df6c8b4bb19a3519aa8ac6098c4790d893854615b47c60e2e9b183e076a3a909c6b1cc5c1d35012d526e5

    • C:\Users\Admin\AppData\Local\Temp\rad9B87F.tmp.zip
      Filesize

      975KB

      MD5

      435e76ab435c87bb2f2511081126bfb5

      SHA1

      0c3a17d258bc352c9aeb7cbf967ae65c36961fad

      SHA256

      e9d0e1b1851c827bfec645cdcba29b6f8b2b545ce61ce34863a7506821496337

      SHA512

      4be98c78b3c4c1f5c3e9b550ba342d32d691bf4ce836032c6a449d341ce0f68aa216a3feeb3eb6acf6d089013c7bb2a8782d232b3ebd7bd8fc0f7a1b629c6834

    • C:\Users\Admin\AppData\Local\Temp\radAF91E107Ddar\Ml4U5RIgZ500l028HenlO.dll
      Filesize

      535.9MB

      MD5

      1e9268ef46de69a2323becab20ca7c8e

      SHA1

      5a3a781127ab745a321ef8b8caaffa7f96a2c323

      SHA256

      fd1fdb7faa22021501f10a006a702efe765840a52d6114a48f46dc66c166da93

      SHA512

      6d8880f060f20ae0b78f19e99e1bcab6c1fe9546623e0d3e10744b97144e2b202451a5535377cc447d2ceb8fface4652acd14b1b5adef43291933ba779d81d6c

    • \Users\Admin\AppData\Local\Temp\radAF91E107Ddar\Ml4U5RIgZ500l028HenlO.dll
      Filesize

      535.9MB

      MD5

      1e9268ef46de69a2323becab20ca7c8e

      SHA1

      5a3a781127ab745a321ef8b8caaffa7f96a2c323

      SHA256

      fd1fdb7faa22021501f10a006a702efe765840a52d6114a48f46dc66c166da93

      SHA512

      6d8880f060f20ae0b78f19e99e1bcab6c1fe9546623e0d3e10744b97144e2b202451a5535377cc447d2ceb8fface4652acd14b1b5adef43291933ba779d81d6c

    • memory/3648-145-0x0000000000730000-0x000000000078A000-memory.dmp
      Filesize

      360KB

    • memory/3648-151-0x00000000001C0000-0x00000000001C1000-memory.dmp
      Filesize

      4KB