Overview
overview
10Static
static
32887140.exe
windows7-x64
102887140.exe
windows10-2004-x64
32887140.exe
android-9-x86
2887140.exe
android-10-x64
2887140.exe
android-11-x64
2887140.exe
macos-10.15-amd64
2887140.exe
ubuntu-18.04-amd64
2887140.exe
debian-9-armhf
2887140.exe
debian-9-mips
2887140.exe
debian-9-mipsel
Analysis
-
max time kernel
898s -
max time network
904s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
12-01-2025 13:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2887140.exe
Resource
win7-20241010-en
windows7-x64
9 signatures
900 seconds
Behavioral task
behavioral2
Sample
2887140.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
900 seconds
Behavioral task
behavioral3
Sample
2887140.exe
Resource
android-x86-arm-20240624-en
android-9-x86
0 signatures
900 seconds
Behavioral task
behavioral4
Sample
2887140.exe
Resource
android-x64-20240624-en
android-10-x64
0 signatures
900 seconds
Behavioral task
behavioral5
Sample
2887140.exe
Resource
android-x64-arm64-20240624-en
android-11-x64
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
2887140.exe
Resource
macos-20241101-en
macos-10.15-amd64
0 signatures
900 seconds
Behavioral task
behavioral7
Sample
2887140.exe
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
0 signatures
900 seconds
Behavioral task
behavioral8
Sample
2887140.exe
Resource
debian9-armhf-20240729-en
debian-9-armhf
0 signatures
900 seconds
Behavioral task
behavioral9
Sample
2887140.exe
Resource
debian9-mipsbe-20240729-en
debian-9-mips
0 signatures
900 seconds
Behavioral task
behavioral10
Sample
2887140.exe
Resource
debian9-mipsel-20240226-en
debian-9-mipsel
0 signatures
900 seconds
General
-
Target
2887140.exe
-
Size
144KB
-
MD5
fead887648bddd70a05cf7a7090411dd
-
SHA1
250c0de3dc100d265ae495f045a2c47dad3520e9
-
SHA256
dfaf75da62d0561d171217fe893bd818a72ebfccd9d7e7f4c046f5b3ca44794e
-
SHA512
e1f15de084a78bf27a1c62b5d0d31fabd10be13983dca05962c40ea1e8b3f7bb617e92f44a78048d3484d16f5d4b9e42bc8c5a4b02fda0e0f5eb69368149920a
-
SSDEEP
3072:buY0LMcTrgw6mo4bnGkbUyh/h39iN/Ko8LdKpZbZo:SY0IkImZUyh/h3MOc
Malware Config
Signatures
-
Emotet family
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat controlhexa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2887140.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language controlhexa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language controlhexa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2887140.exe -
Modifies data under HKEY_USERS 40 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B399D80D-B323-4625-BCC4-AA785318AF66}\WpadDecisionTime = 30a5aca9f664db01 controlhexa.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-86-e9-9c-c5-4e\WpadDecisionTime = 10aed70cf864db01 controlhexa.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B399D80D-B323-4625-BCC4-AA785318AF66}\WpadDecisionTime = 30644c58f864db01 controlhexa.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" controlhexa.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 controlhexa.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B399D80D-B323-4625-BCC4-AA785318AF66}\WpadDecisionTime = f0ffd32af764db01 controlhexa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B399D80D-B323-4625-BCC4-AA785318AF66}\62-86-e9-9c-c5-4e controlhexa.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-86-e9-9c-c5-4e\WpadDecisionTime = 30a5aca9f664db01 controlhexa.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000006000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0082000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 controlhexa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings controlhexa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad controlhexa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-86-e9-9c-c5-4e controlhexa.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-86-e9-9c-c5-4e\WpadDetectedUrl controlhexa.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-86-e9-9c-c5-4e\WpadDecisionTime = f0f762c1f764db01 controlhexa.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B399D80D-B323-4625-BCC4-AA785318AF66}\WpadDecisionTime = 906de2a3f864db01 controlhexa.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0082000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 controlhexa.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B399D80D-B323-4625-BCC4-AA785318AF66}\WpadNetworkName = "Network 3" controlhexa.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-86-e9-9c-c5-4e\WpadDecisionTime = f0ffd32af764db01 controlhexa.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000008000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0082000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 controlhexa.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000009000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0082000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 controlhexa.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-86-e9-9c-c5-4e\WpadDecisionReason = "1" controlhexa.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0082000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 controlhexa.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-86-e9-9c-c5-4e\WpadDecisionTime = 90f63ddff664db01 controlhexa.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 460000000a000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0082000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 controlhexa.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings controlhexa.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 controlhexa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections controlhexa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B399D80D-B323-4625-BCC4-AA785318AF66} controlhexa.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B399D80D-B323-4625-BCC4-AA785318AF66}\WpadDecisionReason = "1" controlhexa.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B399D80D-B323-4625-BCC4-AA785318AF66}\WpadDecision = "0" controlhexa.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-86-e9-9c-c5-4e\WpadDecision = "0" controlhexa.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B399D80D-B323-4625-BCC4-AA785318AF66}\WpadDecisionTime = 90f63ddff664db01 controlhexa.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000005000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0082000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 controlhexa.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B399D80D-B323-4625-BCC4-AA785318AF66}\WpadDecisionTime = 901a1976f764db01 controlhexa.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-86-e9-9c-c5-4e\WpadDecisionTime = 901a1976f764db01 controlhexa.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000007000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0082000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 controlhexa.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B399D80D-B323-4625-BCC4-AA785318AF66}\WpadDecisionTime = f0f762c1f764db01 controlhexa.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B399D80D-B323-4625-BCC4-AA785318AF66}\WpadDecisionTime = 10aed70cf864db01 controlhexa.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-86-e9-9c-c5-4e\WpadDecisionTime = 30644c58f864db01 controlhexa.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-86-e9-9c-c5-4e\WpadDecisionTime = 906de2a3f864db01 controlhexa.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 2152 2887140.exe 1888 2887140.exe 2904 controlhexa.exe 2136 controlhexa.exe 2136 controlhexa.exe 2136 controlhexa.exe 2136 controlhexa.exe 2136 controlhexa.exe 2136 controlhexa.exe 2136 controlhexa.exe 2136 controlhexa.exe 2136 controlhexa.exe 2136 controlhexa.exe 2136 controlhexa.exe 2136 controlhexa.exe 2136 controlhexa.exe 2136 controlhexa.exe 2136 controlhexa.exe 2136 controlhexa.exe 2136 controlhexa.exe 2136 controlhexa.exe 2136 controlhexa.exe 2136 controlhexa.exe 2136 controlhexa.exe 2136 controlhexa.exe 2136 controlhexa.exe 2136 controlhexa.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1888 2887140.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2152 wrote to memory of 1888 2152 2887140.exe 30 PID 2152 wrote to memory of 1888 2152 2887140.exe 30 PID 2152 wrote to memory of 1888 2152 2887140.exe 30 PID 2152 wrote to memory of 1888 2152 2887140.exe 30 PID 2904 wrote to memory of 2136 2904 controlhexa.exe 32 PID 2904 wrote to memory of 2136 2904 controlhexa.exe 32 PID 2904 wrote to memory of 2136 2904 controlhexa.exe 32 PID 2904 wrote to memory of 2136 2904 controlhexa.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\2887140.exeC:\Users\Admin\AppData\Local\Temp\2887140.exe cmd /c %SIGILL% "SIGTERM|DELETE|SIGKILL"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\2887140.exe"C:\Users\Admin\AppData\Local\Temp\2887140.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:1888
-
-
C:\Windows\SysWOW64\controlhexa.exe"C:\Windows\SysWOW64\controlhexa.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\controlhexa.exe"C:\Windows\SysWOW64\controlhexa.exe"2⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2136
-