Resubmissions
28-02-2024 13:41
240228-qy6amach8x 1028-02-2024 13:20
240228-qlb61sce56 1028-02-2024 09:25
240228-ld2pgsgc23 10Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-02-2024 09:25
Static task
static1
Behavioral task
behavioral1
Sample
230717-qwxkpscc39.exe
Resource
win7-20240221-en
General
-
Target
230717-qwxkpscc39.exe
-
Size
384KB
-
MD5
f3f48c57c38bff2ddd220f20569e1ee6
-
SHA1
0421127f1bcca91a6ab2a570a47f8159101b751a
-
SHA256
b1cad1540ecb290088252635f8e130022eed7486eb128c0ca3d676945d60a9fc
-
SHA512
4e6432ef57936317341b7b81ec433100d37bf46e84513e4fb495a2f820201af54d4f24f19e04d1f80aa03fd6662a1740303929ec2741b771523fb18ce87ed545
-
SSDEEP
3072:iYyIxN7LMWf+GPBLi21ocO2jytUkU4uDQUiysA+30Sor6KH7j0m43ayYZt:GIx5MKQUJkqDDj+xW6KH7IuN
Malware Config
Extracted
emotet
Epoch3
190.117.206.153:443
203.99.187.137:443
200.55.168.82:20
70.32.94.58:8080
213.138.100.98:8080
144.76.62.10:8080
203.99.188.203:990
201.196.15.79:990
203.99.182.135:443
176.58.93.123:80
192.241.220.183:8080
94.177.253.126:80
181.47.235.26:993
216.75.37.196:8080
95.216.207.86:7080
78.109.34.178:443
113.52.135.33:7080
216.70.88.55:8080
138.197.140.163:8080
181.113.229.139:990
83.169.33.157:8080
212.112.113.235:80
143.95.101.72:8080
190.13.146.47:443
178.249.187.150:7080
157.7.164.178:8081
5.189.148.98:8080
51.38.134.203:8080
93.78.205.196:443
91.109.5.28:8080
173.249.157.58:8080
186.10.16.244:53
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3044 4300 WerFault.exe 90 -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2508 230717-qwxkpscc39.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 880 wrote to memory of 2508 880 230717-qwxkpscc39.exe 89 PID 880 wrote to memory of 2508 880 230717-qwxkpscc39.exe 89 PID 880 wrote to memory of 2508 880 230717-qwxkpscc39.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\230717-qwxkpscc39.exe"C:\Users\Admin\AppData\Local\Temp\230717-qwxkpscc39.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\230717-qwxkpscc39.exe--ce8248252⤵
- Suspicious behavior: RenamesItself
PID:2508
-
-
C:\Windows\SysWOW64\keydeflicense.exe"C:\Windows\SysWOW64\keydeflicense.exe"1⤵PID:4300
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 2642⤵
- Program crash
PID:3044
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4300 -ip 43001⤵PID:2788