Overview

overview

7

Static

static

3

eMule0.50a...er.exe

windows11-21h2-x64

7

Resubmissions

13/12/2023, 13:21

231213-qlwknaegb3 7

13/12/2023, 13:20

231213-qlexxadcdq 3

Analysis

  • max time kernel
    102s
  • max time network
    108s
  • platform
    windows11-21h2_x64
  • resource
    win11-20231128-en
  • resource tags

    arch:x64arch:x86image:win11-20231128-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    13/12/2023, 13:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eMule0.50a-Installer.exe

  • Size

    3.2MB

  • MD5

    a31156b8d80a68e8f4354c63e0747beb

  • SHA1

    185705e7d217132a104dc3f4ee12a72c7e8749ce

  • SHA256

    28411261cb3f27081f910190d1c7742fb805185430af10131d5b39fd2e39c832

  • SHA512

    33db65bf69a721be613316b729c06137ae4f323314b707f591b09f06f10dab2643f36742a457d04b5816e6e2aa795d78f01987ca173bd4ed0f0845279d2c96eb

  • SSDEEP

    49152:a9r/Wx+GhZdsM+1GfhXM5uOMkbKH+1Ma6h2ZoHrkQb7MOBIfn2vrPLuG:ASgsdiM26+1MaO2iRTIv2vrjp

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 26 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eMule0.50a-Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\eMule0.50a-Installer.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Modifies registry class
    PID:1160
  • C:\Program Files (x86)\eMule\emule.exe
    "C:\Program Files (x86)\eMule\emule.exe"
    1⤵
    • Executes dropped EXE
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:560

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\eMule\emule.exe
    Filesize

    5.5MB

    MD5

    f3f709c2d49dd6636f4ede5c2cae5448

    SHA1

    8e0ea03e4c38199e10a2bc12db8b2df70484111d

    SHA256

    06cdf814387f627a4bd05a0c68211f715bfa952423e8e8a462e1f47c11a4d20e

    SHA512

    7a0df912b5ddc149d770260a2e1a3f55e58ac2e9ef02883e8baa08e79261075b82955bc8e57641bb2c16983abcada2581850fafc11b92a133605127bda80513e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsl705E.tmp\AccessControl.dll
    Filesize

    10KB

    MD5

    055f4f9260e07fc83f71877cbb7f4fad

    SHA1

    a245131af1a182de99bd74af9ff1fab17977a72f

    SHA256

    4209588362785b690d08d15cd982b8d1c62c348767ca19114234b21d5df74ddc

    SHA512

    a8e82dc4435ed938f090f43df953ddad9b0075f16218c09890c996299420162d64b1dbfbf613af37769ae796717eec78204dc786b757e8b1d13d423d4ee82e26

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsl705E.tmp\InstallOptions.dll
    Filesize

    14KB

    MD5

    14c212bb2fa90fe52a6424b955c86ad6

    SHA1

    9e94f8ad17ff9b6b31e5f029ee5f726e307ac8ee

    SHA256

    1854afccace3053dca2707b10609ea78a30f0ee853bdb9f251c076317ee53120

    SHA512

    d42fa579f93b98d1446daf3d0734c19838fa310ef27cd05344e25d9f86ba37a5fa1752236e5de4df7c9f414236538bd7431bffda126fb9c74fd112539de0e713

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsl705E.tmp\LangDLL.dll
    Filesize

    5KB

    MD5

    7e856702410e5598296a9c056c273db2

    SHA1

    1711125771f4e364717079aae5e4419ac3d69a5d

    SHA256

    394d7d46b5e1ea621cfcc4f0bc8609d5ad8d42074186cddb737f3abe10874403

    SHA512

    34ae337e44a5ce9dd17e4c726977f895b90614e02df09d9db46d7e6905850b05b44a4951508c07272acc2683454c1bc949ee1f83e14592e7400bdeae2033c886

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsl705E.tmp\System.dll
    Filesize

    10KB

    MD5

    4c0c6163b636f627e0d505deda672c90

    SHA1

    2eae4e6f00673a03ae2434f1b22dc9218e4761a8

    SHA256

    bea71368433f91e32c597db990089ecb7599879f76a64f7f3446489578b2d5fb

    SHA512

    e817ad35f0e89ecce9d73add641d9eab95de6c6c30153e594673c8e0243e738a31dfb872cc76a8d51bc513775fc1dabc9adb65019298048539d6c3aa7d33e2ef

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsl705E.tmp\eMule_Installer_Page4User.ini
    Filesize

    378B

    MD5

    30d1c49c3ab853466df5f715742c061e

    SHA1

    51f27088246d0cee80165ba7f6b2b246ebce9c20

    SHA256

    249bf1c4408e49312b2b5adbf01d4288507e1b917d0d8f8d0ef96f53f3d789dc

    SHA512

    189fbd6c9967168485482381a0c22fa8f08680bb3d9326f28629e94e4fd78e9973cb8f4f7e1ed24d166b9a7d74b9123c1eb0b0a67bb31612a63359cabaffbbff

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsl705E.tmp\eMule_Installer_Page4User.ini
    Filesize

    414B

    MD5

    3e7bd5eb163ed83932cd46b3263f8981

    SHA1

    4b0b2efed3c49afccfc78a1db5b3713787dbb823

    SHA256

    9812139bccabdec4e0db31cf676f3063c790c8ba27976cfac810dc100d9e0577

    SHA512

    cdeeaf665d3e698c978f99ab9c453d06fb4fba5728b5d729cbe522f1c2a76a5708d14000b8e2e625a8dbbb3bc6591e7741afb2e464e448babf6760e86a2e2781

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsl705E.tmp\ioSpecial.ini
    Filesize

    692B

    MD5

    b73f4bf668c648dde7e3614204e96a4d

    SHA1

    b6e3534c1c30ee90b00e64cf05fdd3d7053ccb6a

    SHA256

    72d844b94323a6a2549d8ea5ee97ee36181ecadc4c642c946699a7e3d010f59a

    SHA512

    f01648b77e2f8d0d8e5439ce913ecf7cdeefc043f2afcfb3e061ad7d7316095ca5061d7710c0d208ddc69931e8fa7c41cfdf3a4f612755c0a9bb55faf40a43ce

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsl705E.tmp\ioSpecial.ini
    Filesize

    869B

    MD5

    3a4f270fd0ae63e8868da584ade233e3

    SHA1

    68c1cdda4cadb4595d859cfbf2c094ba1193c229

    SHA256

    c14dc9131995ff0775ccb4177ea6bdf9b2765bbeaf4eac5fa325ed244c9661d0

    SHA512

    5c9525b2868aed73e661da58f204df7cc31d116b45a6963abac4f41096e0b6761fae79ad8c0e84f21446b9554bde967499d6212ffc78c1fb5053e79b16faaec8

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsl705E.tmp\ioSpecial.ini
    Filesize

    908B

    MD5

    1f3588c55cc857e1cd271854fc6dda03

    SHA1

    b9b0c08ce6092e23e70c3fcab28bd996005427fe

    SHA256

    0b55d5150d25d11a2ac262ca19cc83d77e196c69bec810498d988167ea82b3d2

    SHA512

    2ce699a0ce390e0c3a9a5db476102a8c979f9af0ab47c428bd23b3021a0418790240ea43a59dc5f3c5bdee55eb5431bbd5bb2e6b3a15d37ce38951c7aa37eee6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsl705E.tmp\ioSpecial.ini
    Filesize

    718B

    MD5

    e534744ceb127446fdc648bf9d41cea8

    SHA1

    8a2b3b1880196f6eceb17f0deec28d755920e175

    SHA256

    6498a03df1e2c939c75ee2b04d79674f27336d21d0f4ac91032fe311d4cb9093

    SHA512

    418c7049e6c88374fcf807a5e411225f20fa184de8f85800f3b08190209b2dcb7944718677d5bc84f99840bbdef9e70adccf6921b309c333ed9d88605f59f903

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsl705E.tmp\ioSpecial.ini
    Filesize

    917B

    MD5

    3d691418833cbb3d1c5cccd1d57b36e0

    SHA1

    2a96df854a12ed2fc4fb4d93e85e14e328e9fb81

    SHA256

    2128c9e6bfceb59d068515ccef270b0070079714d9c444bc5d3239e07e0be40d

    SHA512

    8cfb641682f832395f8c2256bb2f937b79d33a953304b94ac2ee35478866cc789dfa1ebb3788f6f7e97e051970de0ad9d9e6d31bdddf78b68090c45fc469598d

    Download Submit

  • C:\Users\Admin\AppData\Local\eMule\config\nodes.dat
    Filesize

    29KB

    MD5

    54800bd712e88a9124c07b80b376384f

    SHA1

    84c57c0752f55c361ab81fbf879f186cfdf4b16a

    SHA256

    7b1e446cb141e94cdec0fb746b41ad1e3e9be27d73232017e0057b3a11c9c433

    SHA512

    e8cc4d75172c6060865e61d28210fdafd1ddc8f2b639de58f6b869664efa7324adfab4a8c79a37f733298eb75ce8f36b3755e0338404bb686e26ad8abebbb6f3

    Download Submit

  • C:\Users\Admin\AppData\Local\eMule\config\preferences.ini
    Filesize

    24B

    MD5

    0ce0bf4ab463cb3b1d64466a99ffc811

    SHA1

    a92829fc0c196d678f65e62b8aa6be06243a2655

    SHA256

    7a82e48a514ea778005fd557e36c111ef801c4fa40b1583d1356811f7aec86b4

    SHA512

    d72117b6803fab2ec4320d0150608ae9fd7a8a5427fc2c1a717e208646ddf9b5e7c71f5ed1bc3113697adb184e96e7e1631cccbdcce17f0cdc70b391b78e8b03

    Download Submit

  • C:\Users\Admin\AppData\Local\eMule\config\preferences.ini
    Filesize

    41B

    MD5

    6b545ed7d3f9093f2f16c193b7b8b852

    SHA1

    b6ee0cbe4fec76294343e2e149827e30abc0bf65

    SHA256

    e43f06881bb9b09d66f7b1c224581529a0e1c4d867997f188b345346755ebbad

    SHA512

    0bc690abf142a62396fffcb64d9423e9df9705cbd04c4e00021f073feaaeed46ef94989b46dbcbe8a74bb5fbd9fdd6c5a29e95a5243663b646544175c5b8f33c

    Download Submit

  • C:\Users\Admin\AppData\Local\eMule\config\server.met
    Filesize

    389B

    MD5

    e90d2ac37dcdad552cb715a1dc279dd6

    SHA1

    fe9ac87fe5cfbd9e061dbe2918a6f679bc601905

    SHA256

    35b6bb358c094db327478310652ac5a24fc8a8c64e241f2c7948b9f6bc7149e4

    SHA512

    c043a64a245dead7a3b999ec88f8c549018b6d3eede8b66f20613424fcd3e3ad0ab753a3beb1060ceb8e3cd03e16a283f2e0397a131d0e16d1395b2fe4bb6bec

    Download Submit

  • C:\Users\Admin\AppData\Local\eMule\config\staticservers.dat
    Filesize

    284B

    MD5

    248858a6725ce0629276e7814c9b9981

    SHA1

    02e2012007fc42756d00a017635801b0e290ca45

    SHA256

    a6520b0ce2711f7d71e9b12dcf15d7ea5bc6489125057b654fd183de38f4cbf3

    SHA512

    05b9cdad4a91b6ee5cbcb5c08f9034546974b0fc0d005eedd7cabbe5c0a9e8aea0058313eb2dcc9b6e63f3adf34547979e66018c7c1b64204c87145bbe99cf28

    Download Submit