Resubmissions

13-09-2023 20:47

230913-zk1mnahe68 10

13-09-2023 19:55

230913-ym9snsef2y 10

13-09-2023 19:49

230913-yjtbhshc66 3

Analysis

  • max time kernel
    261s
  • max time network
    267s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-09-2023 19:55

General

  • Target

    press to unblock document.vbs

  • Size

    89KB

  • MD5

    7559f0ff4f7e58ed031fe0b4438f4c57

  • SHA1

    e2225573a8877c057319e10029fd85b0a51375a8

  • SHA256

    73527befbcc1ec6716003fc875d578c40e3dfe619349ff288008bab33c90e5d2

  • SHA512

    252d0a52c3b7bca5ea56a14c7ad1e27967b03e3dccfc3b8d79b8e1c474ed625937719af314e74f62583c708b45b937091e8fae7f1e40e56bf261d0f839f94e4a

  • SSDEEP

    384:6/EHPbchpdLrwUkRI8K5mAX3E53EnoUyd4989GgFWfYyLxgaHxixxOD/n3FiSf+y:6/EKr9ka8yZrgGayLpbng5s6n96

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

213.239.212.5:443

129.232.188.93:443

103.43.75.120:443

197.242.150.244:8080

1.234.2.232:8080

110.232.117.186:8080

95.217.221.146:8080

159.89.202.34:443

159.65.88.10:8080

82.223.21.224:8080

169.57.156.166:8080

45.176.232.124:443

45.235.8.30:8080

173.212.193.249:8080

107.170.39.149:8080

119.59.103.152:8080

167.172.199.165:8080

91.207.28.33:8080

185.4.135.165:8080

104.168.155.143:8080

eck1.plain
ecs1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Blocklisted process makes network request 9 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Script User-Agent 7 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\press to unblock document.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3196
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //E:vbscript C:\Users\Admin\AppData\Local\Temp\rad601C71CDBdarrad057B1EDD8dar.txt
      2⤵
      • Blocklisted process makes network request
      • Checks computer location settings
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:1948
      • C:\Windows\System32\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" "C:\Users\Admin\AppData\Local\Temp\rad8719E7C72dar\I7BUGMOAp1mnW79z5M0bLi0WI5oFMy2wIqc.dll"
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5060
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe "C:\Windows\system32\TnCJj\WiumwgJJ.dll"
          4⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:3912

Network

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\rad1A41B.tmp.zip
    Filesize

    958KB

    MD5

    cde1a4983674221e32035465ff72c577

    SHA1

    b25512e978cd4b0f700f655caff2923a4c77fdba

    SHA256

    b030f4ef75c8ef13e944f87ec7b700799b5f2906f4f3cb262c0fb1daa3b41865

    SHA512

    47fc2200061cbd576f324534ab61f67bb32518372fecd370f0bfaab114adc3bdf7cafccbc34f724c59f77ad2d046985ff049903692104ca58289c4ec4e978d26

  • C:\Users\Admin\AppData\Local\Temp\rad601C71CDBdarrad057B1EDD8dar.txt
    Filesize

    61KB

    MD5

    958eb4fa0bfca295216cd6027977fcb8

    SHA1

    0bc88fb4229a73152b2c33750dd5b5be52fcf287

    SHA256

    9b32ca5d8a34ae2351bc68500fb6929468c42d0ddda53fba5676410beab6d498

    SHA512

    4e4e2d84ce82eaa222180e86a2feaa7fdb19108d227ca922c69d30e30ef1ed463c41d540c25f604edd04be86f8490ae8570d2b67a97e0f9f45d048954d32787f

  • C:\Users\Admin\AppData\Local\Temp\rad8719E7C72dar\I7BUGMOAp1mnW79z5M0bLi0WI5oFMy2wIqc.dll
    Filesize

    518.9MB

    MD5

    8d4ae113a4228abb787118fa7f080f07

    SHA1

    06484d09a45370765db7eec6a2998551215806f2

    SHA256

    5418335875ee09905dc49a03b4b38dbfa70c5902ec022814d45ec028be3b2975

    SHA512

    0944be85227173360689b18cc6bc58b7cc7017bba6291ad1ea696ecbc95f9d829d2e43e545ae9ecbb62159145f2e589bf463e553e1341fbc2d98cacdb6dde116

  • C:\Users\Admin\AppData\Local\Temp\rad8719E7C72dar\I7BUGMOAp1mnW79z5M0bLi0WI5oFMy2wIqc.dll
    Filesize

    518.9MB

    MD5

    8d4ae113a4228abb787118fa7f080f07

    SHA1

    06484d09a45370765db7eec6a2998551215806f2

    SHA256

    5418335875ee09905dc49a03b4b38dbfa70c5902ec022814d45ec028be3b2975

    SHA512

    0944be85227173360689b18cc6bc58b7cc7017bba6291ad1ea696ecbc95f9d829d2e43e545ae9ecbb62159145f2e589bf463e553e1341fbc2d98cacdb6dde116

  • C:\Windows\System32\TnCJj\WiumwgJJ.dll
    Filesize

    518.9MB

    MD5

    8d4ae113a4228abb787118fa7f080f07

    SHA1

    06484d09a45370765db7eec6a2998551215806f2

    SHA256

    5418335875ee09905dc49a03b4b38dbfa70c5902ec022814d45ec028be3b2975

    SHA512

    0944be85227173360689b18cc6bc58b7cc7017bba6291ad1ea696ecbc95f9d829d2e43e545ae9ecbb62159145f2e589bf463e553e1341fbc2d98cacdb6dde116

  • memory/5060-29-0x0000000001EB0000-0x0000000001EB1000-memory.dmp
    Filesize

    4KB

  • memory/5060-30-0x0000000002000000-0x000000000205A000-memory.dmp
    Filesize

    360KB