Overview

overview

7

Static

static

3

eMule0.50a...er.exe

windows11-21h2-x64

7

Resubmissions

13/12/2023, 13:21

231213-qlwknaegb3 7

13/12/2023, 13:20

231213-qlexxadcdq 3

Analysis

  • max time kernel
    102s
  • max time network
    108s
  • platform
    windows11-21h2_x64
  • resource
    win11-20231128-en
  • resource tags

    arch:x64arch:x86image:win11-20231128-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    13/12/2023, 13:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    eMule0.50a-Installer.exe

  • Size

    3.2MB

  • MD5

    a31156b8d80a68e8f4354c63e0747beb

  • SHA1

    185705e7d217132a104dc3f4ee12a72c7e8749ce

  • SHA256

    28411261cb3f27081f910190d1c7742fb805185430af10131d5b39fd2e39c832

  • SHA512

    33db65bf69a721be613316b729c06137ae4f323314b707f591b09f06f10dab2643f36742a457d04b5816e6e2aa795d78f01987ca173bd4ed0f0845279d2c96eb

  • SSDEEP

    49152:a9r/Wx+GhZdsM+1GfhXM5uOMkbKH+1Ma6h2ZoHrkQb7MOBIfn2vrPLuG:ASgsdiM26+1MaO2iRTIv2vrjp

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 26 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eMule0.50a-Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\eMule0.50a-Installer.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Modifies registry class
    PID:1160
  • C:\Program Files (x86)\eMule\emule.exe
    "C:\Program Files (x86)\eMule\emule.exe"
    1⤵
    • Executes dropped EXE
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:560

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\eMule\emule.exe
          Filesize

          5.5MB

          MD5

          f3f709c2d49dd6636f4ede5c2cae5448

          SHA1

          8e0ea03e4c38199e10a2bc12db8b2df70484111d

          SHA256

          06cdf814387f627a4bd05a0c68211f715bfa952423e8e8a462e1f47c11a4d20e

          SHA512

          7a0df912b5ddc149d770260a2e1a3f55e58ac2e9ef02883e8baa08e79261075b82955bc8e57641bb2c16983abcada2581850fafc11b92a133605127bda80513e

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nsl705E.tmp\AccessControl.dll
          Filesize

          10KB

          MD5

          055f4f9260e07fc83f71877cbb7f4fad

          SHA1

          a245131af1a182de99bd74af9ff1fab17977a72f

          SHA256

          4209588362785b690d08d15cd982b8d1c62c348767ca19114234b21d5df74ddc

          SHA512

          a8e82dc4435ed938f090f43df953ddad9b0075f16218c09890c996299420162d64b1dbfbf613af37769ae796717eec78204dc786b757e8b1d13d423d4ee82e26

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nsl705E.tmp\InstallOptions.dll
          Filesize

          14KB

          MD5

          14c212bb2fa90fe52a6424b955c86ad6

          SHA1

          9e94f8ad17ff9b6b31e5f029ee5f726e307ac8ee

          SHA256

          1854afccace3053dca2707b10609ea78a30f0ee853bdb9f251c076317ee53120

          SHA512

          d42fa579f93b98d1446daf3d0734c19838fa310ef27cd05344e25d9f86ba37a5fa1752236e5de4df7c9f414236538bd7431bffda126fb9c74fd112539de0e713

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nsl705E.tmp\LangDLL.dll
          Filesize

          5KB

          MD5

          7e856702410e5598296a9c056c273db2

          SHA1

          1711125771f4e364717079aae5e4419ac3d69a5d

          SHA256

          394d7d46b5e1ea621cfcc4f0bc8609d5ad8d42074186cddb737f3abe10874403

          SHA512

          34ae337e44a5ce9dd17e4c726977f895b90614e02df09d9db46d7e6905850b05b44a4951508c07272acc2683454c1bc949ee1f83e14592e7400bdeae2033c886

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nsl705E.tmp\System.dll
          Filesize

          10KB

          MD5

          4c0c6163b636f627e0d505deda672c90

          SHA1

          2eae4e6f00673a03ae2434f1b22dc9218e4761a8

          SHA256

          bea71368433f91e32c597db990089ecb7599879f76a64f7f3446489578b2d5fb

          SHA512

          e817ad35f0e89ecce9d73add641d9eab95de6c6c30153e594673c8e0243e738a31dfb872cc76a8d51bc513775fc1dabc9adb65019298048539d6c3aa7d33e2ef

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nsl705E.tmp\eMule_Installer_Page4User.ini
          Filesize

          378B

          MD5

          30d1c49c3ab853466df5f715742c061e

          SHA1

          51f27088246d0cee80165ba7f6b2b246ebce9c20

          SHA256

          249bf1c4408e49312b2b5adbf01d4288507e1b917d0d8f8d0ef96f53f3d789dc

          SHA512

          189fbd6c9967168485482381a0c22fa8f08680bb3d9326f28629e94e4fd78e9973cb8f4f7e1ed24d166b9a7d74b9123c1eb0b0a67bb31612a63359cabaffbbff

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nsl705E.tmp\eMule_Installer_Page4User.ini
          Filesize

          414B

          MD5

          3e7bd5eb163ed83932cd46b3263f8981

          SHA1

          4b0b2efed3c49afccfc78a1db5b3713787dbb823

          SHA256

          9812139bccabdec4e0db31cf676f3063c790c8ba27976cfac810dc100d9e0577

          SHA512

          cdeeaf665d3e698c978f99ab9c453d06fb4fba5728b5d729cbe522f1c2a76a5708d14000b8e2e625a8dbbb3bc6591e7741afb2e464e448babf6760e86a2e2781

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nsl705E.tmp\ioSpecial.ini
          Filesize

          692B

          MD5

          b73f4bf668c648dde7e3614204e96a4d

          SHA1

          b6e3534c1c30ee90b00e64cf05fdd3d7053ccb6a

          SHA256

          72d844b94323a6a2549d8ea5ee97ee36181ecadc4c642c946699a7e3d010f59a

          SHA512

          f01648b77e2f8d0d8e5439ce913ecf7cdeefc043f2afcfb3e061ad7d7316095ca5061d7710c0d208ddc69931e8fa7c41cfdf3a4f612755c0a9bb55faf40a43ce

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nsl705E.tmp\ioSpecial.ini
          Filesize

          869B

          MD5

          3a4f270fd0ae63e8868da584ade233e3

          SHA1

          68c1cdda4cadb4595d859cfbf2c094ba1193c229

          SHA256

          c14dc9131995ff0775ccb4177ea6bdf9b2765bbeaf4eac5fa325ed244c9661d0

          SHA512

          5c9525b2868aed73e661da58f204df7cc31d116b45a6963abac4f41096e0b6761fae79ad8c0e84f21446b9554bde967499d6212ffc78c1fb5053e79b16faaec8

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nsl705E.tmp\ioSpecial.ini
          Filesize

          908B

          MD5

          1f3588c55cc857e1cd271854fc6dda03

          SHA1

          b9b0c08ce6092e23e70c3fcab28bd996005427fe

          SHA256

          0b55d5150d25d11a2ac262ca19cc83d77e196c69bec810498d988167ea82b3d2

          SHA512

          2ce699a0ce390e0c3a9a5db476102a8c979f9af0ab47c428bd23b3021a0418790240ea43a59dc5f3c5bdee55eb5431bbd5bb2e6b3a15d37ce38951c7aa37eee6

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nsl705E.tmp\ioSpecial.ini
          Filesize

          718B

          MD5

          e534744ceb127446fdc648bf9d41cea8

          SHA1

          8a2b3b1880196f6eceb17f0deec28d755920e175

          SHA256

          6498a03df1e2c939c75ee2b04d79674f27336d21d0f4ac91032fe311d4cb9093

          SHA512

          418c7049e6c88374fcf807a5e411225f20fa184de8f85800f3b08190209b2dcb7944718677d5bc84f99840bbdef9e70adccf6921b309c333ed9d88605f59f903

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nsl705E.tmp\ioSpecial.ini
          Filesize

          917B

          MD5

          3d691418833cbb3d1c5cccd1d57b36e0

          SHA1

          2a96df854a12ed2fc4fb4d93e85e14e328e9fb81

          SHA256

          2128c9e6bfceb59d068515ccef270b0070079714d9c444bc5d3239e07e0be40d

          SHA512

          8cfb641682f832395f8c2256bb2f937b79d33a953304b94ac2ee35478866cc789dfa1ebb3788f6f7e97e051970de0ad9d9e6d31bdddf78b68090c45fc469598d

          Download Submit

        • C:\Users\Admin\AppData\Local\eMule\config\nodes.dat
          Filesize

          29KB

          MD5

          54800bd712e88a9124c07b80b376384f

          SHA1

          84c57c0752f55c361ab81fbf879f186cfdf4b16a

          SHA256

          7b1e446cb141e94cdec0fb746b41ad1e3e9be27d73232017e0057b3a11c9c433

          SHA512

          e8cc4d75172c6060865e61d28210fdafd1ddc8f2b639de58f6b869664efa7324adfab4a8c79a37f733298eb75ce8f36b3755e0338404bb686e26ad8abebbb6f3

          Download Submit

        • C:\Users\Admin\AppData\Local\eMule\config\preferences.ini
          Filesize

          24B

          MD5

          0ce0bf4ab463cb3b1d64466a99ffc811

          SHA1

          a92829fc0c196d678f65e62b8aa6be06243a2655

          SHA256

          7a82e48a514ea778005fd557e36c111ef801c4fa40b1583d1356811f7aec86b4

          SHA512

          d72117b6803fab2ec4320d0150608ae9fd7a8a5427fc2c1a717e208646ddf9b5e7c71f5ed1bc3113697adb184e96e7e1631cccbdcce17f0cdc70b391b78e8b03

          Download Submit

        • C:\Users\Admin\AppData\Local\eMule\config\preferences.ini
          Filesize

          41B

          MD5

          6b545ed7d3f9093f2f16c193b7b8b852

          SHA1

          b6ee0cbe4fec76294343e2e149827e30abc0bf65

          SHA256

          e43f06881bb9b09d66f7b1c224581529a0e1c4d867997f188b345346755ebbad

          SHA512

          0bc690abf142a62396fffcb64d9423e9df9705cbd04c4e00021f073feaaeed46ef94989b46dbcbe8a74bb5fbd9fdd6c5a29e95a5243663b646544175c5b8f33c

          Download Submit

        • C:\Users\Admin\AppData\Local\eMule\config\server.met
          Filesize

          389B

          MD5

          e90d2ac37dcdad552cb715a1dc279dd6

          SHA1

          fe9ac87fe5cfbd9e061dbe2918a6f679bc601905

          SHA256

          35b6bb358c094db327478310652ac5a24fc8a8c64e241f2c7948b9f6bc7149e4

          SHA512

          c043a64a245dead7a3b999ec88f8c549018b6d3eede8b66f20613424fcd3e3ad0ab753a3beb1060ceb8e3cd03e16a283f2e0397a131d0e16d1395b2fe4bb6bec

          Download Submit

        • C:\Users\Admin\AppData\Local\eMule\config\staticservers.dat
          Filesize

          284B

          MD5

          248858a6725ce0629276e7814c9b9981

          SHA1

          02e2012007fc42756d00a017635801b0e290ca45

          SHA256

          a6520b0ce2711f7d71e9b12dcf15d7ea5bc6489125057b654fd183de38f4cbf3

          SHA512

          05b9cdad4a91b6ee5cbcb5c08f9034546974b0fc0d005eedd7cabbe5c0a9e8aea0058313eb2dcc9b6e63f3adf34547979e66018c7c1b64204c87145bbe99cf28

          Download Submit