Analysis
-
max time kernel
98s -
max time network
112s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-09-2024 21:26
Static task
static1
Behavioral task
behavioral1
Sample
768ad28c080195715c1e30a4316806a0N.exe
Resource
win7-20240903-en
General
-
Target
768ad28c080195715c1e30a4316806a0N.exe
-
Size
838KB
-
MD5
768ad28c080195715c1e30a4316806a0
-
SHA1
73f9feea60a236983e8a9430092222020579f82c
-
SHA256
107f4c8305c600962a57b1c78e7ed0fc07dc60a67709ff5d40be81f02dcb6867
-
SHA512
b4a8dac63f0b595e7aee483233e3520f97a32da3c73a54e9f280fda0e5f69ea5f94e320e810c64e52f7a0b83aa0f4133e1442b4f2e994b47d129d65428046728
-
SSDEEP
12288:LqFtrjWILWe14XIl0txcuXr5kTewflT8CY+lO76PPFPcN1qWxOfc3O:mDjWIPErbSplT8CY4tPe1pxOfc
Malware Config
Extracted
emotet
Epoch2
24.178.90.49:80
96.126.101.6:8080
5.196.108.185:8080
167.114.153.111:8080
188.219.31.12:80
184.180.181.202:80
85.105.111.166:80
174.106.122.139:80
137.59.187.107:8080
185.94.252.104:443
142.112.10.95:20
102.182.93.220:80
75.188.96.231:80
93.147.212.206:80
120.150.218.241:443
87.106.139.101:8080
78.188.106.53:443
75.139.38.211:80
46.105.131.79:8080
168.235.67.138:7080
96.245.227.43:80
172.86.188.251:8080
108.46.29.236:80
118.83.154.64:443
162.241.140.129:8080
2.58.16.89:8080
109.74.5.95:8080
110.142.236.207:80
68.252.26.78:80
190.29.166.0:80
5.39.91.110:7080
97.82.79.83:80
139.99.158.11:443
95.9.5.93:80
190.240.194.77:443
123.176.25.234:80
74.208.45.104:8080
174.45.13.118:80
103.86.49.11:8080
62.75.141.82:80
130.0.132.242:80
218.147.193.146:80
115.94.207.99:443
83.110.223.58:443
110.145.77.103:80
217.20.166.178:7080
91.146.156.228:80
71.72.196.159:80
50.91.114.38:80
87.106.136.232:8080
104.131.123.136:443
89.121.205.18:80
124.41.215.226:80
66.76.12.94:8080
208.180.207.205:80
62.171.142.179:8080
61.19.246.238:443
75.143.247.51:80
47.36.140.164:80
120.150.60.189:80
74.214.230.200:80
209.54.13.14:80
24.137.76.62:80
190.108.228.27:443
61.33.119.226:443
123.142.37.166:80
176.111.60.55:8080
172.91.208.86:80
50.35.17.13:80
113.61.66.94:80
49.3.224.99:8080
79.137.83.50:443
69.206.132.149:80
24.230.141.169:80
121.7.31.214:80
95.213.236.64:8080
162.241.242.173:8080
47.144.21.12:443
202.141.243.254:443
80.241.255.202:8080
89.216.122.92:80
71.15.245.148:8080
76.171.227.238:80
24.179.13.119:80
139.162.60.124:8080
220.245.198.194:80
91.211.88.52:7080
41.185.28.84:8080
121.124.124.40:7080
203.153.216.189:7080
94.230.70.6:80
139.59.60.244:8080
62.30.7.67:443
194.187.133.160:443
78.24.219.147:8080
50.245.107.73:443
119.59.116.21:8080
186.74.215.34:80
173.63.222.65:80
157.245.99.39:8080
76.175.162.101:80
186.70.56.94:443
155.186.9.160:80
37.139.21.175:8080
153.164.70.236:80
94.200.114.161:80
104.131.11.150:443
216.139.123.119:80
72.143.73.234:443
49.50.209.131:80
209.141.54.221:7080
98.174.164.72:80
139.162.108.71:8080
37.187.72.193:8080
194.4.58.192:7080
94.23.237.171:443
172.104.97.173:8080
Signatures
-
resource yara_rule behavioral1/memory/1724-0-0x0000000000270000-0x0000000000288000-memory.dmp emotet behavioral1/memory/1724-5-0x00000000003A0000-0x00000000003B7000-memory.dmp emotet behavioral1/memory/1724-2-0x00000000001D0000-0x00000000001E6000-memory.dmp emotet behavioral1/memory/3040-15-0x0000000000310000-0x0000000000327000-memory.dmp emotet behavioral1/memory/3040-11-0x00000000002F0000-0x0000000000308000-memory.dmp emotet -
Executes dropped EXE 1 IoCs
pid Process 3040 dfscli.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\QSVRMGMT\dfscli.exe 768ad28c080195715c1e30a4316806a0N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 768ad28c080195715c1e30a4316806a0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfscli.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3040 dfscli.exe 3040 dfscli.exe 3040 dfscli.exe 3040 dfscli.exe 3040 dfscli.exe 3040 dfscli.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1724 768ad28c080195715c1e30a4316806a0N.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1724 768ad28c080195715c1e30a4316806a0N.exe 3040 dfscli.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1724 wrote to memory of 3040 1724 768ad28c080195715c1e30a4316806a0N.exe 30 PID 1724 wrote to memory of 3040 1724 768ad28c080195715c1e30a4316806a0N.exe 30 PID 1724 wrote to memory of 3040 1724 768ad28c080195715c1e30a4316806a0N.exe 30 PID 1724 wrote to memory of 3040 1724 768ad28c080195715c1e30a4316806a0N.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\768ad28c080195715c1e30a4316806a0N.exe"C:\Users\Admin\AppData\Local\Temp\768ad28c080195715c1e30a4316806a0N.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\QSVRMGMT\dfscli.exe"C:\Windows\SysWOW64\QSVRMGMT\dfscli.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3040
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
838KB
MD5768ad28c080195715c1e30a4316806a0
SHA173f9feea60a236983e8a9430092222020579f82c
SHA256107f4c8305c600962a57b1c78e7ed0fc07dc60a67709ff5d40be81f02dcb6867
SHA512b4a8dac63f0b595e7aee483233e3520f97a32da3c73a54e9f280fda0e5f69ea5f94e320e810c64e52f7a0b83aa0f4133e1442b4f2e994b47d129d65428046728