Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://samples.vx-u...

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    https://samples.vx-underground.org/Samples/Bazaar%20Collection/Downloadable%20Releases/Bazaar.2020.08.7z

  • Sample

    240424-wcm5taeb8z

Score
10/10
emotetnanocoreostapremcosepoch1epoch2epoch3july-logsbankerdownloaderevasionkeyloggerpersistenceratspywarestealertrojanupx

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

107.185.211.16:80

96.8.113.4:8080

153.126.210.205:7080

47.146.117.214:80

104.131.44.150:8080

169.239.182.217:8080

95.179.229.244:8080

209.182.216.177:443

209.141.54.221:8080

5.196.74.210:8080

72.12.127.184:443

104.131.11.150:443

200.55.243.138:8080

116.203.32.252:8080

142.105.151.124:443

81.2.235.111:8080

74.120.55.163:80

167.86.90.214:8080

87.106.139.101:8080

37.139.21.175:8080
rsa_pubkey.plain

Extracted

Family

remcos

Botnet

JULY-LOGS

C2

alhabib4rec.freeddns.org:2404

alhabib4rec.ddns.net:2404

alhabib4rec.duckdns.org:2404
Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-5YOI67

  • screenshot_crypt

    false

  • screenshot_flag

    true

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Extracted

Family

emotet

Botnet

Epoch1

C2

174.100.27.229:80

209.126.6.222:8080

5.153.250.14:8080

192.241.146.84:8080

95.9.180.128:80

77.55.211.77:8080

85.105.140.135:443

45.33.77.42:8080

77.90.136.129:8080

94.176.234.118:443

190.163.31.26:80

190.6.193.152:8080

190.181.235.46:80

81.198.69.61:80

188.2.217.94:80

114.109.179.60:80

83.169.21.32:7080

137.74.106.111:7080

212.231.60.98:80

170.81.48.2:80
rsa_pubkey.plain

Extracted

Family

emotet

Botnet

Epoch3

C2

162.249.220.190:80

85.25.207.108:8080

178.128.14.92:8080

181.113.229.139:443

118.70.15.19:8080

143.95.101.72:8080

139.99.157.213:8080

201.235.10.215:80

181.137.229.1:80

5.79.70.250:8080

107.161.30.122:8080

157.7.164.178:8081

87.106.231.60:8080

202.5.47.71:80

172.105.78.244:8080

177.94.227.143:80

173.94.215.84:80

181.126.54.234:80

217.199.160.224:8080

198.57.203.63:8080
rsa_pubkey.plain

Extracted

Family

nanocore

Version

1.2.2.0

C2

acokoye85.hopto.org:7600

185.140.53.15:7600
Mutex

e607a71c-ff71-46a0-b3d3-16215c82e9fd

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    185.140.53.15

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2020-05-29T14:58:33.250638636Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    7600

  • default_group

    Default

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    e607a71c-ff71-46a0-b3d3-16215c82e9fd

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    acokoye85.hopto.org

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Targets

    • Target

      https://samples.vx-underground.org/Samples/Bazaar%20Collection/Downloadable%20Releases/Bazaar.2020.08.7z

    Score
    10/10
    emotetnanocoreostapremcosepoch1epoch2epoch3july-logsbankerdownloaderevasionkeyloggerpersistenceratspywarestealertrojanupx

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • NanoCore

      NanoCore is a remote access tool (RAT) with a variety of capabilities.

      keyloggertrojanstealerspywarenanocore

    • Ostap JavaScript downloader

      Ostap is a JavaScript downloader that's been active since 2016. It's used to deliver several families, inluding TrickBot

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • ostap

      Ostap is a JS downloader, used to deliver other families.

      downloaderostap

    • Emotet payload

      Detects Emotet payload in memory.

      trojanbanker

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks