Analysis

  • max time kernel
    418s
  • max time network
    423s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28-03-2024 09:32

General

  • Target

    0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe

  • Size

    490KB

  • MD5

    f4d1470af3a7d82560b38558b132d468

  • SHA1

    0c45cf4e32116eae8d73b52c140f5d91a19ee8ea

  • SHA256

    6fa0dd6002d4b4e7ebabefc7f4f90f36fc53069e0cf4e845f683fb087d476e90

  • SHA512

    1f45093e1509d86ab03ee2c6f15a6dbc3ed4f41cac3c8faf5ae66445b787b58bf9e69d047d7ead3d1d22284d351fbb739a7a7eb73180f746f3d4f621859206c8

  • SSDEEP

    12288:x1n6BAlECcMIR4WlptZ2uOIR4bi6/Myw52BLhDG5Fq:x16SbcMMlpLLOS

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

190.117.206.153:443

203.99.187.137:443

200.55.168.82:20

70.32.94.58:8080

213.138.100.98:8080

144.76.62.10:8080

203.99.188.203:990

201.196.15.79:990

203.99.182.135:443

176.58.93.123:80

192.241.220.183:8080

94.177.253.126:80

181.47.235.26:993

216.75.37.196:8080

95.216.207.86:7080

78.109.34.178:443

113.52.135.33:7080

216.70.88.55:8080

138.197.140.163:8080

181.113.229.139:990

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
  • Modifies data under HKEY_USERS 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
    "C:\Users\Admin\AppData\Local\Temp\0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Users\Admin\AppData\Local\Temp\0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
      --b91fe435
      2⤵
      • Modifies registry class
      • Suspicious behavior: RenamesItself
      • Suspicious use of SetWindowsHookEx
      PID:2588
  • C:\Windows\SysWOW64\pencrypto.exe
    "C:\Windows\SysWOW64\pencrypto.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2528
    • C:\Windows\SysWOW64\pencrypto.exe
      --44f3e170
      2⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2584
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:788
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://tmp/
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1184
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1184 CREDAT:275457 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2804
    • C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe"
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1788
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:2264
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        1⤵
          PID:2356

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1788-40-0x0000000002660000-0x00000000026E0000-memory.dmp

          Filesize

          512KB

        • memory/1788-47-0x0000000002660000-0x00000000026E0000-memory.dmp

          Filesize

          512KB

        • memory/1788-36-0x0000000001ED0000-0x0000000001ED8000-memory.dmp

          Filesize

          32KB

        • memory/1788-48-0x0000000002660000-0x00000000026E0000-memory.dmp

          Filesize

          512KB

        • memory/1788-41-0x0000000002660000-0x00000000026E0000-memory.dmp

          Filesize

          512KB

        • memory/1788-35-0x000000001B350000-0x000000001B632000-memory.dmp

          Filesize

          2.9MB

        • memory/1788-38-0x0000000002660000-0x00000000026E0000-memory.dmp

          Filesize

          512KB

        • memory/1788-46-0x0000000002660000-0x00000000026E0000-memory.dmp

          Filesize

          512KB

        • memory/1788-50-0x000007FEF4850000-0x000007FEF51ED000-memory.dmp

          Filesize

          9.6MB

        • memory/1788-45-0x000007FEF4850000-0x000007FEF51ED000-memory.dmp

          Filesize

          9.6MB

        • memory/1788-37-0x000007FEF4850000-0x000007FEF51ED000-memory.dmp

          Filesize

          9.6MB

        • memory/1788-39-0x000007FEF4850000-0x000007FEF51ED000-memory.dmp

          Filesize

          9.6MB

        • memory/1788-42-0x0000000002660000-0x00000000026E0000-memory.dmp

          Filesize

          512KB

        • memory/1788-43-0x000007FEF4850000-0x000007FEF51ED000-memory.dmp

          Filesize

          9.6MB

        • memory/1788-44-0x0000000002660000-0x00000000026E0000-memory.dmp

          Filesize

          512KB

        • memory/2248-1-0x0000000000320000-0x0000000000330000-memory.dmp

          Filesize

          64KB

        • memory/2248-0-0x0000000000360000-0x0000000000376000-memory.dmp

          Filesize

          88KB

        • memory/2528-11-0x0000000000490000-0x00000000004A6000-memory.dmp

          Filesize

          88KB

        • memory/2584-16-0x00000000003B0000-0x00000000003C6000-memory.dmp

          Filesize

          88KB

        • memory/2588-6-0x0000000000280000-0x0000000000296000-memory.dmp

          Filesize

          88KB