Analysis Report 0HvIGwMmBV

ID:	376928
Product:	CloudBasic
Start time:	23:29:55
Start date:	27.03.2021
Sample:	0HvIGwMmBV
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	ecbc4b40dcfec4ed1b2647b217da0441
SHA1:	e08eb07c69d8fc8e75927597767288a21d6ed7f6
SHA256:	878d5137e0c9a072c83c596b4e80f2aa52a8580ef214e5ba0d59daa5036a92f8
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Network\Downloader\edb.log	data	E7EFECD50AA9A83F3D3C7E9ACCDDD359	37350B1F4AFE62BDF55850C24C441CCA4629C1B9	4A83CB9AE054EC303A5E1949663DFE927B6421326F436FD3F65DF8076DBE706E
C:\ProgramData\Microsoft\Network\Downloader\qmgr.db	Extensible storage engine DataBase, version 0x620, checksum 0xae08ab15, page size 16384, DirtyShutdown, Windows version 10.0	45A7D361E6BE966EF00C50179C87DFD1	0D8B0BD02382DECDFD87FFF6EC8C11E703DC9033	DA147CF1EA2A9634B512C6895D932FC3B0D088B98595A9E9F62DD05351C4714C
C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm	data	08B59EC1426E11E3862C1059C7F1DA73	5C4B310E095883DA058EB75633E481EE9CBEBC77	1C44305B9E765CB1683F106EDF427C4A705D2AE1674F478D6348734E21D40E4E
C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl	data	D868DDA20565EC23332BF2B948D4CE61	FF776135F2E480A6BE50F1421B4AA724968F173E	F0101E5A2961BE8D3A00478A9FD88A9D7025C17F68284A03F9875201CD43FCD7
C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl	data	4182208113025B9D88AE9581BB0E64BA	288AE4CA303EF47E6BBA968E9D9AE13CF5F09399	7E88776A2D20B0A3673BA6C3E85481160B17F3FBD91FA7F8BEFA0E9150E421B7
C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl	data	534C2DF42E6D380E8712EAA2313F4139	682E336DDCEAB02FA24E85727CBBEBAD6590E222	F79893052DD34962F4E2FDE673C77611B7C2D07BE123A8BFD858C1169627E15F
C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	ASCII text, with no line terminators	DCA83F08D448911A14C22EBCACC5AD57	91270525521B7FE0D986DB19747F47D34B6318AD	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log	data	51040ECA59767C6B8AE098750B7D937E	6A84B450A6C8E04DD34EBC4CB9B2B2F256175E2D	28F5D161F4ADEE51F46EC4966F9A0033EC4C7D51394C906C7808DDE98636D5D3

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: 0HvIGwMmBV.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: 0HvIGwMmBV.exe	Virustotal: Detection: 83%			Perma Link
Source: 0HvIGwMmBV.exe	ReversingLabs: Detection: 96%

Machine Learning detection for sample

Source: 0HvIGwMmBV.exe

Joe Sandbox ML: detected

Compliance:

Uses 32bit PE files

Source: 0HvIGwMmBV.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 0HvIGwMmBV.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.3:49720 -> 193.169.54.12:8080
Source: global traffic	TCP traffic: 192.168.2.3:49729 -> 173.230.145.224:8080

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 193.169.54.12 193.169.54.12
Source: Joe Sandbox View	IP Address: 173.230.145.224 173.230.145.224
Source: Joe Sandbox View	IP Address: 173.230.145.224 173.230.145.224

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: POST / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 79.172.249.82:443Content-Length: 436Connection: Keep-AliveCache-Control: no-cacheData Raw: 55 ff 81 f4 3c 3e db 1c c7 ff 05 5a a4 b7 5b 07 2e 23 72 5c d4 c8 58 ec 10 36 28 11 ae 73 c1 bb 42 39 6a 0a 82 93 bd cc c1 28 e0 a7 96 e0 9f 76 ba 44 a1 c0 f0 73 87 32 d2 ba c9 da 8f 42 d9 77 a2 c6 5f c0 0b a0 17 c2 90 96 3f 20 06 b5 09 84 3a 8d 03 78 29 48 64 51 0f dd ef a4 ce 32 7f 10 f9 ac 6e fc a2 85 7e 64 b6 1e a6 35 e2 64 c6 7e 7e c1 8b 97 83 89 2f 35 3c af 8e 40 d1 a8 55 fe 68 d2 6d 14 f4 a6 21 99 c7 a3 8d 9d f1 2b e7 59 fe 32 13 6d de 56 d5 a9 7e 73 ff 2d 6a 16 77 90 4e 93 0b 8a de 85 32 19 f0 84 fb fe a3 ed 8e 05 b7 77 6a 81 6b 60 59 30 4e 89 ee 96 19 99 83 00 6a a5 ac d5 cb e8 1d 82 c1 ae d2 30 61 d7 b8 82 6f 43 c1 d6 33 6e 47 9f 3a 93 ad a8 5a df 17 21 79 b4 a7 69 c5 7f b4 80 61 1c 88 fa 3a df 3c 67 f9 26 8d 83 43 e3 bb 00 02 48 f0 86 07 e7 3e c0 d6 d4 35 c0 00 28 c3 f2 7c 70 38 f2 d1 95 c2 32 cc 4c 67 f7 a3 57 7d c6 03 7d 7b 71 03 5c 15 be d6 ab 07 da d5 ed 9a 41 07 d3 8c 28 21 3b 6a 1a f7 4c 58 7b 0a 87 b3 0e 28 54 38 6a 06 93 ef db 32 e2 25 ff b4 5c ee c5 27 99 39 c7 0a c7 60 2b 24 a4 9e ce 7c 19 f6 30 5f 74 6d 94 3c 98 05 e9 be 78 5e bd c8 51 03 b8 c0 a6 6c 54 aa b0 83 c6 f9 77 ee f7 10 40 e3 f8 6e 63 07 e4 3f c0 71 b4 4d 73 e0 e5 c8 db 2c 66 b7 af 00 6e 88 40 8d 68 0b 71 a4 a8 4b 12 ea f3 6a 5e 8b 1f 21 ec f8 54 e0 28 9a dc 3f 54 81 e6 b6 e2 26 9d 96 31 a1 70 dd 1a 23 6f Data Ascii: U<>Z[.#r\X6(sB9j(vDs2Bw_? :x)HdQ2n~d5d~~/5<@Uhm!+Y2mV~s-jwN2wjk`Y0Nj0aoC3nG:Z!yia:<g&CH>5(|p82LgW}}{q\A(!;jLX{(T8j2%\'9`+$|0_tm<x^QlTw@nc?qMs,fn@hqKj^!T(?T&1p#o

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 79.172.249.82
Source: unknown	TCP traffic detected without corresponding DNS query: 79.172.249.82
Source: unknown	TCP traffic detected without corresponding DNS query: 79.172.249.82
Source: unknown	TCP traffic detected without corresponding DNS query: 79.172.249.82
Source: unknown	TCP traffic detected without corresponding DNS query: 79.172.249.82
Source: unknown	TCP traffic detected without corresponding DNS query: 79.172.249.82
Source: unknown	TCP traffic detected without corresponding DNS query: 193.169.54.12
Source: unknown	TCP traffic detected without corresponding DNS query: 193.169.54.12
Source: unknown	TCP traffic detected without corresponding DNS query: 193.169.54.12
Source: unknown	TCP traffic detected without corresponding DNS query: 173.230.145.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.230.145.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.230.145.224

Posts data to webserver

Source: unknown

HTTP traffic detected: POST / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 79.172.249.82:443Content-Length: 436Connection: Keep-AliveCache-Control: no-cacheData Raw: 55 ff 81 f4 3c 3e db 1c c7 ff 05 5a a4 b7 5b 07 2e 23 72 5c d4 c8 58 ec 10 36 28 11 ae 73 c1 bb 42 39 6a 0a 82 93 bd cc c1 28 e0 a7 96 e0 9f 76 ba 44 a1 c0 f0 73 87 32 d2 ba c9 da 8f 42 d9 77 a2 c6 5f c0 0b a0 17 c2 90 96 3f 20 06 b5 09 84 3a 8d 03 78 29 48 64 51 0f dd ef a4 ce 32 7f 10 f9 ac 6e fc a2 85 7e 64 b6 1e a6 35 e2 64 c6 7e 7e c1 8b 97 83 89 2f 35 3c af 8e 40 d1 a8 55 fe 68 d2 6d 14 f4 a6 21 99 c7 a3 8d 9d f1 2b e7 59 fe 32 13 6d de 56 d5 a9 7e 73 ff 2d 6a 16 77 90 4e 93 0b 8a de 85 32 19 f0 84 fb fe a3 ed 8e 05 b7 77 6a 81 6b 60 59 30 4e 89 ee 96 19 99 83 00 6a a5 ac d5 cb e8 1d 82 c1 ae d2 30 61 d7 b8 82 6f 43 c1 d6 33 6e 47 9f 3a 93 ad a8 5a df 17 21 79 b4 a7 69 c5 7f b4 80 61 1c 88 fa 3a df 3c 67 f9 26 8d 83 43 e3 bb 00 02 48 f0 86 07 e7 3e c0 d6 d4 35 c0 00 28 c3 f2 7c 70 38 f2 d1 95 c2 32 cc 4c 67 f7 a3 57 7d c6 03 7d 7b 71 03 5c 15 be d6 ab 07 da d5 ed 9a 41 07 d3 8c 28 21 3b 6a 1a f7 4c 58 7b 0a 87 b3 0e 28 54 38 6a 06 93 ef db 32 e2 25 ff b4 5c ee c5 27 99 39 c7 0a c7 60 2b 24 a4 9e ce 7c 19 f6 30 5f 74 6d 94 3c 98 05 e9 be 78 5e bd c8 51 03 b8 c0 a6 6c 54 aa b0 83 c6 f9 77 ee f7 10 40 e3 f8 6e 63 07 e4 3f c0 71 b4 4d 73 e0 e5 c8 db 2c 66 b7 af 00 6e 88 40 8d 68 0b 71 a4 a8 4b 12 ea f3 6a 5e 8b 1f 21 ec f8 54 e0 28 9a dc 3f 54 81 e6 b6 e2 26 9d 96 31 a1 70 dd 1a 23 6f Data Ascii: U<>Z[.#r\X6(sB9j(vDs2Bw_? :x)HdQ2n~d5d~~/5<@Uhm!+Y2mV~s-jwN2wjk`Y0Nj0aoC3nG:Z!yia:<g&CH>5(|p82LgW}}{q\A(!;jLX{(T8j2%\'9`+$|0_tm<x^QlTw@nc?qMs,fn@hqKj^!T(?T&1p#o

Urls found in memory or binary data

Source: svchost.exe, 00000006.00000002.466420456.0000022919412000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: svchost.exe, 00000006.00000002.466420456.0000022919412000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: svchost.exe, 00000006.00000002.466420456.0000022919412000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: svchost.exe, 00000006.00000002.466783419.0000022919600000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: svchost.exe, 0000000B.00000002.308399355.000001BC42213000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 00000008.00000002.464440169.0000026F17040000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000008.00000002.464440169.0000026F17040000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000008.00000002.464440169.0000026F17040000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 0000000B.00000003.308097971.000001BC42260000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000008.00000002.464440169.0000026F17040000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000008.00000002.464440169.0000026F17040000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000B.00000003.308117767.000001BC4225C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000B.00000003.308097971.000001BC42260000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 0000000B.00000002.308423829.000001BC4223E000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 0000000B.00000003.308097971.000001BC42260000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 0000000B.00000002.308434753.000001BC4224F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000B.00000003.286359870.000001BC42232000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 0000000B.00000002.308423829.000001BC4223E000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 0000000B.00000003.308097971.000001BC42260000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 0000000B.00000003.308097971.000001BC42260000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 0000000B.00000003.308097971.000001BC42260000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 0000000B.00000003.308132894.000001BC4223D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000000B.00000003.308132894.000001BC4223D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 0000000B.00000003.308097971.000001BC42260000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 0000000B.00000003.308132894.000001BC4223D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 0000000B.00000003.308117767.000001BC4225C000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000B.00000002.308441069.000001BC42258000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000B.00000002.308441069.000001BC42258000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000B.00000002.308434753.000001BC4224F000.00000004.00000001.sdmp, svchost.exe, 0000000B.00000003.308132894.000001BC4223D000.00000004.00000001.sdmp, svchost.exe, 0000000B.00000003.308117767.000001BC4225C000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 0000000B.00000003.308097971.000001BC42260000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 0000000B.00000002.308423829.000001BC4223E000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000B.00000003.286359870.000001BC42232000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000B.00000002.308423829.000001BC4223E000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 0000000B.00000002.308423829.000001BC4223E000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000B.00000003.308132894.000001BC4223D000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000B.00000003.308132894.000001BC4223D000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000B.00000003.286359870.000001BC42232000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000B.00000002.308420615.000001BC4223B000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000000B.00000002.308434753.000001BC4224F000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708

E-Banking Fraud:

Yara detected Emotet

Source: Yara match	File source: 0HvIGwMmBV.exe, type: SAMPLE
Source: Yara match	File source: 00000001.00000002.204042221.0000000000E81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.197161113.0000000000E81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.196655416.0000000000E81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.463934168.0000000000E81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.203686958.0000000000E81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.203264019.0000000000E81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.195788006.0000000000E81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.202503920.0000000000E81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0.0.0HvIGwMmBV.exe.e80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.servicerpc.exe.e80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.servicerpc.exe.e80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.0HvIGwMmBV.exe.e80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.servicerpc.exe.e80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.0HvIGwMmBV.exe.e80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.servicerpc.exe.e80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.0HvIGwMmBV.exe.e80000.0.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Source: 0HvIGwMmBV.exe, type: SAMPLE	Matched rule: Emotet Payload Author: kevoreilly
Source: 0.0.0HvIGwMmBV.exe.e80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet Payload Author: kevoreilly
Source: 2.2.servicerpc.exe.e80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet Payload Author: kevoreilly
Source: 3.2.servicerpc.exe.e80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet Payload Author: kevoreilly
Source: 1.0.0HvIGwMmBV.exe.e80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet Payload Author: kevoreilly
Source: 3.0.servicerpc.exe.e80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet Payload Author: kevoreilly
Source: 0.2.0HvIGwMmBV.exe.e80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet Payload Author: kevoreilly
Source: 2.0.servicerpc.exe.e80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet Payload Author: kevoreilly
Source: 1.2.0HvIGwMmBV.exe.e80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet Payload Author: kevoreilly

Creates files inside the system directory

Source: C:\Windows\SysWOW64\servicerpc.exe

File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache

Jump to behavior

Deletes files inside the Windows folder

Source: C:\Users\user\Desktop\0HvIGwMmBV.exe

File deleted: C:\Windows\SysWOW64\servicerpc.exe:Zone.Identifier

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\0HvIGwMmBV.exe	Code function: 0_2_00E877F0		0_2_00E877F0
Source: C:\Users\user\Desktop\0HvIGwMmBV.exe	Code function: 0_2_00E86E70		0_2_00E86E70

Sample file is different than original file name gathered from version info

Source: 0HvIGwMmBV.exe, 00000001.00000002.204503759.0000000002DB0000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs 0HvIGwMmBV.exe
Source: 0HvIGwMmBV.exe, 00000001.00000002.204538418.0000000002E00000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs 0HvIGwMmBV.exe
Source: 0HvIGwMmBV.exe, 00000001.00000002.204538418.0000000002E00000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs 0HvIGwMmBV.exe

Tries to load missing DLLs

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll			Jump to behavior

Uses 32bit PE files

Source: 0HvIGwMmBV.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Yara signature match

Source: 0HvIGwMmBV.exe, type: SAMPLE	Matched rule: Emotet author = kevoreilly, description = Emotet Payload, cape_type = Emotet Payload
Source: 0.0.0HvIGwMmBV.exe.e80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet author = kevoreilly, description = Emotet Payload, cape_type = Emotet Payload
Source: 2.2.servicerpc.exe.e80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet author = kevoreilly, description = Emotet Payload, cape_type = Emotet Payload
Source: 3.2.servicerpc.exe.e80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet author = kevoreilly, description = Emotet Payload, cape_type = Emotet Payload
Source: 1.0.0HvIGwMmBV.exe.e80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet author = kevoreilly, description = Emotet Payload, cape_type = Emotet Payload
Source: 3.0.servicerpc.exe.e80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet author = kevoreilly, description = Emotet Payload, cape_type = Emotet Payload
Source: 0.2.0HvIGwMmBV.exe.e80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet author = kevoreilly, description = Emotet Payload, cape_type = Emotet Payload
Source: 2.0.servicerpc.exe.e80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet author = kevoreilly, description = Emotet Payload, cape_type = Emotet Payload
Source: 1.2.0HvIGwMmBV.exe.e80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet author = kevoreilly, description = Emotet Payload, cape_type = Emotet Payload

Classification label

Source: classification engine

Classification label: mal92.troj.evad.winEXE@17/8@0/5

Contains functionality to enum processes or threads

Source: C:\Users\user\Desktop\0HvIGwMmBV.exe

Code function: 0_2_00E82110 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00E82110

Creates files inside the user directory

Source: C:\Windows\System32\svchost.exe

File created: C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl

Jump to behavior

Creates mutexes

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2000:120:WilError_01
Source: C:\Users\user\Desktop\0HvIGwMmBV.exe	Mutant created: \Sessions\1\BaseNamedObjects\MA9E4E299
Source: C:\Windows\SysWOW64\servicerpc.exe	Mutant created: \BaseNamedObjects\MEA7BD142
Source: C:\Users\user\Desktop\0HvIGwMmBV.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\M55A96C51
Source: C:\Users\user\Desktop\0HvIGwMmBV.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\I55A96C51
Source: C:\Windows\SysWOW64\servicerpc.exe	Mutant created: \BaseNamedObjects\Global\I55A96C51

PE file has an executable .text section and no other executable section

Source: 0HvIGwMmBV.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads ini files

Source: C:\Users\user\Desktop\0HvIGwMmBV.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\0HvIGwMmBV.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Sample is known by Antivirus

Source: 0HvIGwMmBV.exe	Virustotal: Detection: 83%
Source: 0HvIGwMmBV.exe	ReversingLabs: Detection: 96%

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\0HvIGwMmBV.exe 'C:\Users\user\Desktop\0HvIGwMmBV.exe'
Source: C:\Users\user\Desktop\0HvIGwMmBV.exe	Process created: C:\Users\user\Desktop\0HvIGwMmBV.exe C:\Users\user\Desktop\0HvIGwMmBV.exe
Source: unknown	Process created: C:\Windows\SysWOW64\servicerpc.exe C:\Windows\SysWOW64\servicerpc.exe
Source: C:\Windows\SysWOW64\servicerpc.exe	Process created: C:\Windows\SysWOW64\servicerpc.exe C:\Windows\SysWOW64\servicerpc.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0HvIGwMmBV.exe	Process created: C:\Users\user\Desktop\0HvIGwMmBV.exe C:\Users\user\Desktop\0HvIGwMmBV.exe			Jump to behavior
Source: C:\Windows\SysWOW64\servicerpc.exe	Process created: C:\Windows\SysWOW64\servicerpc.exe C:\Windows\SysWOW64\servicerpc.exe			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\0HvIGwMmBV.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 0HvIGwMmBV.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\0HvIGwMmBV.exe

Code function: 0_2_00E81F40 VirtualAlloc,memcpy,memcpy,LoadLibraryA,GetProcAddress,VirtualFree,

0_2_00E81F40

Persistence and Installation Behavior:

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SysWOW64\servicerpc.exe

Executable created and started: C:\Windows\SysWOW64\servicerpc.exe

Jump to behavior

Drops PE files to the windows directory (C:\Windows)

Source: C:\Users\user\Desktop\0HvIGwMmBV.exe

PE file moved: C:\Windows\SysWOW64\servicerpc.exe

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\0HvIGwMmBV.exe

File opened: C:\Windows\SysWOW64\servicerpc.exe:Zone.Identifier read attributes | delete

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\0HvIGwMmBV.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

Contains capabilities to detect virtual machines

Source: C:\Users\user\Desktop\0HvIGwMmBV.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Found large amount of non-executed APIs

Source: C:\Users\user\Desktop\0HvIGwMmBV.exe

API coverage: 6.5 %

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\System32\svchost.exe TID: 5980

Thread sleep time: -30000s >= -30000s

Jump to behavior

Queries disk information (often used to detect virtual machines)

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Checks the free space of harddrives

Source: C:\Users\user\Desktop\0HvIGwMmBV.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: svchost.exe, 00000008.00000002.464743444.0000026F176B0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: svchost.exe, 00000006.00000002.466618432.0000022919460000.00000004.00000001.sdmp	Binary or memory string: @Hyper-V RAW
Source: svchost.exe, 00000006.00000002.464116673.0000022913C2A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000007.00000002.464168532.000001EA9A802000.00000004.00000001.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: svchost.exe, 00000008.00000002.464743444.0000026F176B0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: svchost.exe, 00000008.00000002.464743444.0000026F176B0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: svchost.exe, 00000007.00000002.464217145.000001EA9A829000.00000004.00000001.sdmp, svchost.exe, 00000008.00000002.464440169.0000026F17040000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.464094285.0000022A2D22A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: svchost.exe, 00000008.00000002.464743444.0000026F176B0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Queries a list of all running processes

Source: C:\Windows\SysWOW64\servicerpc.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\0HvIGwMmBV.exe

Code function: 0_2_00E81F40 VirtualAlloc,memcpy,memcpy,LoadLibraryA,GetProcAddress,VirtualFree,

0_2_00E81F40

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\0HvIGwMmBV.exe

Code function: 0_2_00E81BE0 mov eax, dword ptr fs:[00000030h]

0_2_00E81BE0

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\0HvIGwMmBV.exe

Code function: 0_2_00E89EE0 EntryPoint,GetProcessHeap,RtlAllocateHeap,memset,GetProcessHeap,RtlFreeHeap,ExitProcess,

0_2_00E89EE0

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: svchost.exe, 00000009.00000002.464715555.000001CE21F90000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: svchost.exe, 00000009.00000002.464715555.000001CE21F90000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: svchost.exe, 00000009.00000002.464715555.000001CE21F90000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: svchost.exe, 00000009.00000002.464715555.000001CE21F90000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\0HvIGwMmBV.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\servicerpc.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Contains functionality to query windows version

Source: C:\Users\user\Desktop\0HvIGwMmBV.exe

Code function: 0_2_00E88D50 RtlGetVersion,GetNativeSystemInfo,

0_2_00E88D50

Queries the cryptographic machine GUID

Source: C:\Windows\SysWOW64\servicerpc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: svchost.exe, 0000000D.00000002.464104258.000001836263D000.00000004.00000001.sdmp	Binary or memory string: @V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 0000000D.00000002.464169165.0000018362702000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Stealing of Sensitive Information:

Yara detected Emotet

Source: Yara match	File source: 0HvIGwMmBV.exe, type: SAMPLE
Source: Yara match	File source: 00000001.00000002.204042221.0000000000E81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.197161113.0000000000E81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.196655416.0000000000E81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.463934168.0000000000E81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.203686958.0000000000E81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.203264019.0000000000E81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.195788006.0000000000E81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.202503920.0000000000E81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0.0.0HvIGwMmBV.exe.e80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.servicerpc.exe.e80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.servicerpc.exe.e80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.0HvIGwMmBV.exe.e80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.servicerpc.exe.e80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.0HvIGwMmBV.exe.e80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.servicerpc.exe.e80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.0HvIGwMmBV.exe.e80000.0.unpack, type: UNPACKEDPE