Analysis Report 9cf2c56e_by_Libranalysis

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: 9cf2c56e_by_Libranalysis.exe

Avira: detected

Found malware configuration

Source: 0.2.9cf2c56e_by_Libranalysis.exe.22d053f.1.unpack

Malware Configuration Extractor: Emotet {"RSA Public Key": "MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhANQOcBKvh5xEW7VcJ9totsjdBwuAclxS\nQ0e09fk8V053lktpW3TRrzAW63yt6j1KWnyxMrU3igFXypBoI4lVNmkje4UPtIIS\nfkzjEIvG1v/ZNn1k0J0PfFTxbFFeUEs3AwIDAQAB", "C2 list": ["47.148.241.179:80", "24.204.47.87:80", "80.86.91.91:8080", "104.236.28.47:8080", "87.106.136.232:8080", "211.63.71.72:8080", "113.52.123.226:7080", "78.101.70.199:443", "76.86.17.1:80", "222.144.13.169:80", "47.155.214.239:80", "181.143.126.170:80", "169.239.182.217:8080", "181.126.70.117:80", "209.137.209.84:443", "207.177.72.129:8080", "37.139.21.175:8080", "149.202.153.252:8080", "108.6.170.195:80", "37.187.72.193:8080", "190.220.19.82:443", "206.81.10.215:8080", "92.222.216.44:8080", "104.131.44.150:8080", "103.86.49.11:8080", "78.186.5.109:443", "62.75.187.192:8080", "76.104.80.47:80", "176.9.43.37:8080", "31.172.240.91:8080", "66.34.201.20:7080", "125.207.127.86:80", "85.152.174.56:80", "78.189.180.107:80", "23.92.16.164:8080", "178.153.176.124:80", "74.208.45.104:8080", "177.239.160.121:80", "47.156.70.145:80", "217.160.182.191:8080", "223.197.185.60:80", "95.213.236.64:8080", "190.143.39.231:80", "173.73.87.96:80", "46.105.131.87:80", "93.147.141.5:443", "105.27.155.182:80", "209.146.22.34:443", "174.53.195.88:80", "59.20.65.102:80", "205.185.117.108:8080", "200.21.90.5:443", "5.32.55.214:80", "95.128.43.213:8080", "108.191.2.72:80", "105.247.123.133:8080", "178.20.74.212:80", "101.100.137.135:80", "210.6.85.121:80", "50.116.86.205:8080", "70.180.35.211:80", "162.241.92.219:8080", "5.196.74.210:8080", "201.173.217.124:443", "91.242.136.103:80", "45.33.49.124:443", "59.103.164.174:80", "47.6.15.79:80", "201.184.105.242:443", "71.222.233.135:443", "24.105.202.216:443", "76.104.80.47:443", "188.0.135.237:80", "60.231.217.199:8080", "31.31.77.83:443", "190.12.119.180:443", "62.138.26.28:8080", "47.153.183.211:80", "71.126.247.90:80", "189.212.199.126:443", "200.116.145.225:443", "139.130.241.252:443", "90.69.145.210:8080", "75.114.235.105:80", "74.130.83.133:80", "24.164.79.147:8080", "190.114.244.182:443", "180.92.239.110:8080", "108.190.109.107:80", "181.13.24.82:80", "74.108.124.180:80", "209.141.54.221:8080", "110.36.217.66:8080", "174.83.116.77:80", "47.155.214.239:443", "85.105.205.77:8080", "179.13.185.19:80", "139.130.242.43:80", "160.16.215.66:8080", "45.55.65.123:8080", "41.60.200.34:80", "88.249.120.205:80", "98.239.119.52:80", "2.237.76.249:80", "87.106.139.101:8080", "121.88.5.176:443", "120.150.246.241:80", "190.146.205.227:8080", "195.244.215.206:80", "68.114.229.171:80", "46.105.131.69:443", "104.236.246.93:8080", "110.44.113.2:80", "60.250.78.22:443", "70.184.9.39:8080", "209.97.168.52:8080", "47.26.155.17:80", "101.187.197.33:443", "115.65.111.148:443", "98.156.206.153:80", "70.127.155.33:80", "65.184.222.119:80", "152.168.248.128:443"]}

Multi AV Scanner detection for submitted file

Source: 9cf2c56e_by_Libranalysis.exe

ReversingLabs: Detection: 76%

Compliance:

Uses 32bit PE files

Source: 9cf2c56e_by_Libranalysis.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Binary contains paths to debug symbols

Source:	Binary string: c:\Users\User\Desktop\2005\7.2.20\ObjectInspector_demo\Release\ObjectInspectorTest.pdb source: 9cf2c56e_by_Libranalysis.exe, aeevts.exe
Source:	Binary string: c:\Users\User\Desktop\2005\7.2.20\ObjectInspector_demo\Release\ObjectInspectorTest.pdb@K,CJ source: 9cf2c56e_by_Libranalysis.exe, 00000000.00000002.217645187.0000000000401000.00000040.00020000.sdmp, aeevts.exe, 00000004.00000002.470738360.0000000000401000.00000040.00020000.sdmp

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_0045436A lstrlen,FindFirstFileA,FindClose,		0_2_0045436A
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_0044533D __EH_prolog3,GetFullPathNameA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlen,		0_2_0044533D
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_0045436A lstrlen,FindFirstFileA,FindClose,		4_2_0045436A
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_0044533D __EH_prolog3,GetFullPathNameA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlen,		4_2_0044533D

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic

Snort IDS: 486 ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited 211.63.71.72: -> 192.168.2.3:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 47.148.241.179:80
Source: Malware configuration extractor	IPs: 24.204.47.87:80
Source: Malware configuration extractor	IPs: 80.86.91.91:8080
Source: Malware configuration extractor	IPs: 104.236.28.47:8080
Source: Malware configuration extractor	IPs: 87.106.136.232:8080
Source: Malware configuration extractor	IPs: 211.63.71.72:8080
Source: Malware configuration extractor	IPs: 113.52.123.226:7080
Source: Malware configuration extractor	IPs: 78.101.70.199:443
Source: Malware configuration extractor	IPs: 76.86.17.1:80
Source: Malware configuration extractor	IPs: 222.144.13.169:80
Source: Malware configuration extractor	IPs: 47.155.214.239:80
Source: Malware configuration extractor	IPs: 181.143.126.170:80
Source: Malware configuration extractor	IPs: 169.239.182.217:8080
Source: Malware configuration extractor	IPs: 181.126.70.117:80
Source: Malware configuration extractor	IPs: 209.137.209.84:443
Source: Malware configuration extractor	IPs: 207.177.72.129:8080
Source: Malware configuration extractor	IPs: 37.139.21.175:8080
Source: Malware configuration extractor	IPs: 149.202.153.252:8080
Source: Malware configuration extractor	IPs: 108.6.170.195:80
Source: Malware configuration extractor	IPs: 37.187.72.193:8080
Source: Malware configuration extractor	IPs: 190.220.19.82:443
Source: Malware configuration extractor	IPs: 206.81.10.215:8080
Source: Malware configuration extractor	IPs: 92.222.216.44:8080
Source: Malware configuration extractor	IPs: 104.131.44.150:8080
Source: Malware configuration extractor	IPs: 103.86.49.11:8080
Source: Malware configuration extractor	IPs: 78.186.5.109:443
Source: Malware configuration extractor	IPs: 62.75.187.192:8080
Source: Malware configuration extractor	IPs: 76.104.80.47:80
Source: Malware configuration extractor	IPs: 176.9.43.37:8080
Source: Malware configuration extractor	IPs: 31.172.240.91:8080
Source: Malware configuration extractor	IPs: 66.34.201.20:7080
Source: Malware configuration extractor	IPs: 125.207.127.86:80
Source: Malware configuration extractor	IPs: 85.152.174.56:80
Source: Malware configuration extractor	IPs: 78.189.180.107:80
Source: Malware configuration extractor	IPs: 23.92.16.164:8080
Source: Malware configuration extractor	IPs: 178.153.176.124:80
Source: Malware configuration extractor	IPs: 74.208.45.104:8080
Source: Malware configuration extractor	IPs: 177.239.160.121:80
Source: Malware configuration extractor	IPs: 47.156.70.145:80
Source: Malware configuration extractor	IPs: 217.160.182.191:8080
Source: Malware configuration extractor	IPs: 223.197.185.60:80
Source: Malware configuration extractor	IPs: 95.213.236.64:8080
Source: Malware configuration extractor	IPs: 190.143.39.231:80
Source: Malware configuration extractor	IPs: 173.73.87.96:80
Source: Malware configuration extractor	IPs: 46.105.131.87:80
Source: Malware configuration extractor	IPs: 93.147.141.5:443
Source: Malware configuration extractor	IPs: 105.27.155.182:80
Source: Malware configuration extractor	IPs: 209.146.22.34:443
Source: Malware configuration extractor	IPs: 174.53.195.88:80
Source: Malware configuration extractor	IPs: 59.20.65.102:80
Source: Malware configuration extractor	IPs: 205.185.117.108:8080
Source: Malware configuration extractor	IPs: 200.21.90.5:443
Source: Malware configuration extractor	IPs: 5.32.55.214:80
Source: Malware configuration extractor	IPs: 95.128.43.213:8080
Source: Malware configuration extractor	IPs: 108.191.2.72:80
Source: Malware configuration extractor	IPs: 105.247.123.133:8080
Source: Malware configuration extractor	IPs: 178.20.74.212:80
Source: Malware configuration extractor	IPs: 101.100.137.135:80
Source: Malware configuration extractor	IPs: 210.6.85.121:80
Source: Malware configuration extractor	IPs: 50.116.86.205:8080
Source: Malware configuration extractor	IPs: 70.180.35.211:80
Source: Malware configuration extractor	IPs: 162.241.92.219:8080
Source: Malware configuration extractor	IPs: 5.196.74.210:8080
Source: Malware configuration extractor	IPs: 201.173.217.124:443
Source: Malware configuration extractor	IPs: 91.242.136.103:80
Source: Malware configuration extractor	IPs: 45.33.49.124:443
Source: Malware configuration extractor	IPs: 59.103.164.174:80
Source: Malware configuration extractor	IPs: 47.6.15.79:80
Source: Malware configuration extractor	IPs: 201.184.105.242:443
Source: Malware configuration extractor	IPs: 71.222.233.135:443
Source: Malware configuration extractor	IPs: 24.105.202.216:443
Source: Malware configuration extractor	IPs: 76.104.80.47:443
Source: Malware configuration extractor	IPs: 188.0.135.237:80
Source: Malware configuration extractor	IPs: 60.231.217.199:8080
Source: Malware configuration extractor	IPs: 31.31.77.83:443
Source: Malware configuration extractor	IPs: 190.12.119.180:443
Source: Malware configuration extractor	IPs: 62.138.26.28:8080
Source: Malware configuration extractor	IPs: 47.153.183.211:80
Source: Malware configuration extractor	IPs: 71.126.247.90:80
Source: Malware configuration extractor	IPs: 189.212.199.126:443
Source: Malware configuration extractor	IPs: 200.116.145.225:443
Source: Malware configuration extractor	IPs: 139.130.241.252:443
Source: Malware configuration extractor	IPs: 90.69.145.210:8080
Source: Malware configuration extractor	IPs: 75.114.235.105:80
Source: Malware configuration extractor	IPs: 74.130.83.133:80
Source: Malware configuration extractor	IPs: 24.164.79.147:8080
Source: Malware configuration extractor	IPs: 190.114.244.182:443
Source: Malware configuration extractor	IPs: 180.92.239.110:8080
Source: Malware configuration extractor	IPs: 108.190.109.107:80
Source: Malware configuration extractor	IPs: 181.13.24.82:80
Source: Malware configuration extractor	IPs: 74.108.124.180:80
Source: Malware configuration extractor	IPs: 209.141.54.221:8080
Source: Malware configuration extractor	IPs: 110.36.217.66:8080
Source: Malware configuration extractor	IPs: 174.83.116.77:80
Source: Malware configuration extractor	IPs: 47.155.214.239:443
Source: Malware configuration extractor	IPs: 85.105.205.77:8080
Source: Malware configuration extractor	IPs: 179.13.185.19:80
Source: Malware configuration extractor	IPs: 139.130.242.43:80
Source: Malware configuration extractor	IPs: 160.16.215.66:8080
Source: Malware configuration extractor	IPs: 45.55.65.123:8080
Source: Malware configuration extractor	IPs: 41.60.200.34:80
Source: Malware configuration extractor	IPs: 88.249.120.205:80
Source: Malware configuration extractor	IPs: 98.239.119.52:80
Source: Malware configuration extractor	IPs: 2.237.76.249:80
Source: Malware configuration extractor	IPs: 87.106.139.101:8080
Source: Malware configuration extractor	IPs: 121.88.5.176:443
Source: Malware configuration extractor	IPs: 120.150.246.241:80
Source: Malware configuration extractor	IPs: 190.146.205.227:8080
Source: Malware configuration extractor	IPs: 195.244.215.206:80
Source: Malware configuration extractor	IPs: 68.114.229.171:80
Source: Malware configuration extractor	IPs: 46.105.131.69:443
Source: Malware configuration extractor	IPs: 104.236.246.93:8080
Source: Malware configuration extractor	IPs: 110.44.113.2:80
Source: Malware configuration extractor	IPs: 60.250.78.22:443
Source: Malware configuration extractor	IPs: 70.184.9.39:8080
Source: Malware configuration extractor	IPs: 209.97.168.52:8080
Source: Malware configuration extractor	IPs: 47.26.155.17:80
Source: Malware configuration extractor	IPs: 101.187.197.33:443
Source: Malware configuration extractor	IPs: 115.65.111.148:443
Source: Malware configuration extractor	IPs: 98.156.206.153:80
Source: Malware configuration extractor	IPs: 70.127.155.33:80
Source: Malware configuration extractor	IPs: 65.184.222.119:80
Source: Malware configuration extractor	IPs: 152.168.248.128:443

Connects to several IPs in different countries

Source: unknown

Network traffic detected: IP country count 28

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.3:49729 -> 80.86.91.91:8080
Source: global traffic	TCP traffic: 192.168.2.3:49731 -> 104.236.28.47:8080
Source: global traffic	TCP traffic: 192.168.2.3:49732 -> 87.106.136.232:8080
Source: global traffic	TCP traffic: 192.168.2.3:49733 -> 211.63.71.72:8080
Source: global traffic	TCP traffic: 192.168.2.3:49742 -> 113.52.123.226:7080

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 71.126.247.90 71.126.247.90

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: VODAFONE-IT-ASNIT VODAFONE-IT-ASNIT
Source: Joe Sandbox View	ASN Name: ASN-TELSTRATelstraCorporationLtdAU ASN-TELSTRATelstraCorporationLtdAU

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Source: global traffic	TCP traffic: 192.168.2.3:49720 -> 47.148.241.179:80
Source: global traffic	TCP traffic: 192.168.2.3:49726 -> 24.204.47.87:80
Source: global traffic	TCP traffic: 192.168.2.3:49745 -> 78.101.70.199:443

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 47.148.241.179
Source: unknown	TCP traffic detected without corresponding DNS query: 47.148.241.179
Source: unknown	TCP traffic detected without corresponding DNS query: 47.148.241.179
Source: unknown	TCP traffic detected without corresponding DNS query: 24.204.47.87
Source: unknown	TCP traffic detected without corresponding DNS query: 24.204.47.87
Source: unknown	TCP traffic detected without corresponding DNS query: 24.204.47.87
Source: unknown	TCP traffic detected without corresponding DNS query: 80.86.91.91
Source: unknown	TCP traffic detected without corresponding DNS query: 80.86.91.91
Source: unknown	TCP traffic detected without corresponding DNS query: 80.86.91.91
Source: unknown	TCP traffic detected without corresponding DNS query: 104.236.28.47
Source: unknown	TCP traffic detected without corresponding DNS query: 104.236.28.47
Source: unknown	TCP traffic detected without corresponding DNS query: 104.236.28.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.106.136.232
Source: unknown	TCP traffic detected without corresponding DNS query: 87.106.136.232
Source: unknown	TCP traffic detected without corresponding DNS query: 87.106.136.232
Source: unknown	TCP traffic detected without corresponding DNS query: 211.63.71.72
Source: unknown	TCP traffic detected without corresponding DNS query: 211.63.71.72
Source: unknown	TCP traffic detected without corresponding DNS query: 211.63.71.72
Source: unknown	TCP traffic detected without corresponding DNS query: 113.52.123.226
Source: unknown	TCP traffic detected without corresponding DNS query: 113.52.123.226
Source: unknown	TCP traffic detected without corresponding DNS query: 113.52.123.226
Source: unknown	TCP traffic detected without corresponding DNS query: 78.101.70.199
Source: unknown	TCP traffic detected without corresponding DNS query: 78.101.70.199
Source: unknown	TCP traffic detected without corresponding DNS query: 78.101.70.199

URLs found in memory or binary data

Source: aeevts.exe, 00000004.00000002.470575098.0000000000199000.00000004.00000001.sdmp	String found in binary or memory: http://78.101.70.199/JlOLE9Q3Bv6/9lTzvPK2t/FRV4HWXYeBl1GdoIO8O/2aKa/
Source: svchost.exe, 00000007.00000002.475298493.00000235C3C12000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: svchost.exe, 00000007.00000002.475298493.00000235C3C12000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: svchost.exe, 00000007.00000002.475253020.00000235C3C00000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: svchost.exe, 00000007.00000002.474499079.00000235C3A70000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: svchost.exe, 00000007.00000002.471916171.00000235BE4AE000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/enum
Source: svchost.exe, 0000000E.00000002.309936623.0000018A54024000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 0000000B.00000002.470888059.0000013D5AC3D000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 0000000B.00000002.470888059.0000013D5AC3D000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 0000000B.00000002.470888059.0000013D5AC3D000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 0000000E.00000003.309670275.0000018A54060000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 0000000B.00000002.470888059.0000013D5AC3D000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000B.00000002.470888059.0000013D5AC3D000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000E.00000003.309715871.0000018A54049000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000E.00000003.309670275.0000018A54060000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 0000000E.00000002.309964862.0000018A5403D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 0000000E.00000003.309670275.0000018A54060000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 0000000E.00000002.309989689.0000018A54052000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000E.00000002.309964862.0000018A5403D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 0000000E.00000003.309670275.0000018A54060000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 0000000E.00000003.309670275.0000018A54060000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 0000000E.00000003.309670275.0000018A54060000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 0000000E.00000002.309978521.0000018A54042000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000000E.00000002.309978521.0000018A54042000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 0000000E.00000003.309670275.0000018A54060000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 0000000E.00000002.309998266.0000018A5405C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 0000000E.00000003.309715871.0000018A54049000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000E.00000002.309998266.0000018A5405C000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000E.00000002.309998266.0000018A5405C000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000E.00000003.309670275.0000018A54060000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.309715871.0000018A54049000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 0000000E.00000003.309670275.0000018A54060000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 0000000E.00000002.309964862.0000018A5403D000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000E.00000003.287944833.0000018A54031000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000E.00000002.309964862.0000018A5403D000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 0000000E.00000002.309964862.0000018A5403D000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.309936623.0000018A54024000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000E.00000003.309750492.0000018A54040000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000E.00000003.309750492.0000018A54040000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000E.00000003.287944833.0000018A54031000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000E.00000002.309958796.0000018A5403A000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000000E.00000002.309989689.0000018A54052000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen

Uses HTTPS

Source: unknown

Network traffic detected: HTTP traffic on port 49745 -> 443

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality to record screenshots

Source: C:\Windows\SysWOW64\aeevts\aeevts.exe

Code function: 4_2_0040A270 GetClientRect,DNameNode::DNameNode,IsWindowVisible,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,BitBlt,ReleaseDC,GetSysColor,CreateRectRgn,IsWindowVisible,BitBlt,InvalidateRect,

4_2_0040A270

Potential key logger detected (key state polling based)

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_0043824F GetKeyState,GetKeyState,GetKeyState,GetKeyState,		0_2_0043824F
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_004287DB GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,		0_2_004287DB
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_00460A0B ScreenToClient,_memset,GetKeyState,GetKeyState,GetKeyState,KillTimer,IsWindow,		0_2_00460A0B
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_004119D0 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,		0_2_004119D0
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_00411CB0 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState		0_2_00411CB0
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_0043824F GetKeyState,GetKeyState,GetKeyState,GetKeyState,		4_2_0043824F
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_004287DB GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,		4_2_004287DB
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_00460A0B ScreenToClient,_memset,GetKeyState,GetKeyState,GetKeyState,KillTimer,IsWindow,		4_2_00460A0B
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_004119D0 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,		4_2_004119D0
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_00411CB0 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState		4_2_00411CB0
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_00452CFD GetKeyState,GetKeyState,GetKeyState,GetFocus,GetDesktopWindow,SendMessageA,SendMessageA,GetParent,		4_2_00452CFD
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_00433411 __EH_prolog3,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetParent,SendMessageA,_memset,ScreenToClient,_memset,GetCursorPos,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SetWindowPos,SendMessageA,_memset,SendMessageA,GetParent,		4_2_00433411
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_0045F6EB GetKeyState,GetKeyState,GetKeyState,		4_2_0045F6EB

E-Banking Fraud:

Yara detected Emotet

Source: Yara match	File source: 00000000.00000002.217998392.00000000022E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.471904242.0000000000AE1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.217986642.00000000022D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.471824961.0000000000AD0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.aeevts.exe.ad053f.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.9cf2c56e_by_Libranalysis.exe.22d053f.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.aeevts.exe.ad053f.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.9cf2c56e_by_Libranalysis.exe.22d053f.1.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.217998392.00000000022E1000.00000020.00000001.sdmp, type: MEMORY	Matched rule: Win32_Trojan_Emotet Author: ReversingLabs
Source: 00000004.00000002.471904242.0000000000AE1000.00000020.00000001.sdmp, type: MEMORY	Matched rule: Win32_Trojan_Emotet Author: ReversingLabs
Source: 00000000.00000002.217986642.00000000022D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Win32_Trojan_Emotet Author: ReversingLabs
Source: 00000004.00000002.471824961.0000000000AD0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Win32_Trojan_Emotet Author: ReversingLabs
Source: 4.2.aeevts.exe.ad053f.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Trojan_Emotet Author: ReversingLabs
Source: 0.2.9cf2c56e_by_Libranalysis.exe.22d053f.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Trojan_Emotet Author: ReversingLabs
Source: 4.2.aeevts.exe.ad053f.1.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Trojan_Emotet Author: ReversingLabs
Source: 0.2.9cf2c56e_by_Libranalysis.exe.22d053f.1.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Trojan_Emotet Author: ReversingLabs

Contains functionality to call native functions

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_00460294 NtdllDefWindowProc_A,GetWindowRect,SetRect,InvalidateRect,SetRect,InvalidateRect,SetRect,SetRect,InvalidateRect,SetRect,InvalidateRect,		0_2_00460294
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_00428BEF NtdllDefWindowProc_A,		0_2_00428BEF
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_00425BDB NtdllDefWindowProc_A,CallWindowProcA,		0_2_00425BDB
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_00460294 NtdllDefWindowProc_A,GetWindowRect,SetRect,InvalidateRect,SetRect,InvalidateRect,SetRect,SetRect,InvalidateRect,SetRect,InvalidateRect,		4_2_00460294
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_00428BEF NtdllDefWindowProc_A,		4_2_00428BEF
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_00425BDB NtdllDefWindowProc_A,CallWindowProcA,		4_2_00425BDB
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_0042B3CC __snprintf_s,__snprintf_s,NtdllDefWindowProc_A,		4_2_0042B3CC
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_00407480 _strlen,_strlen,GetSysColor,GetClassInfoA,NtdllDefWindowProc_A,LoadCursorA,		4_2_00407480
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_0042B625 _memset,NtdllDefWindowProc_A,		4_2_0042B625

Creates files inside the system directory

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe

File created: C:\Windows\SysWOW64\aeevts\

Jump to behavior

Deletes files inside the Windows folder

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe

File deleted: C:\Windows\SysWOW64\aeevts\aeevts.exe:Zone.Identifier

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_004680CB		0_2_004680CB
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_0048813B		0_2_0048813B
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_00464300		0_2_00464300
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_004684EB		0_2_004684EB
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_00484AEB		0_2_00484AEB
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_00470DCA		0_2_00470DCA
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_00481104		0_2_00481104
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_0048926D		0_2_0048926D
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_0047D4B8		0_2_0047D4B8
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_0048623B		0_2_0048623B
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_0047238D		0_2_0047238D
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_004680CB		4_2_004680CB
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_0048813B		4_2_0048813B
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_00464300		4_2_00464300
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_004684EB		4_2_004684EB
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_00484AEB		4_2_00484AEB
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_00470DCA		4_2_00470DCA
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_00481104		4_2_00481104
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_0048926D		4_2_0048926D
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_0047D4B8		4_2_0047D4B8
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_0048623B		4_2_0048623B
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_0047238D		4_2_0047238D
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_00486428		4_2_00486428
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_00476650		4_2_00476650
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_00482685		4_2_00482685
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_0042A732		4_2_0042A732
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_0047A995		4_2_0047A995
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_0047AAAB		4_2_0047AAAB
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_00482BAE		4_2_00482BAE
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_0046F038		4_2_0046F038
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_004830F0		4_2_004830F0
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_0046F2AC		4_2_0046F2AC
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_00467418		4_2_00467418
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_0046F5B6		4_2_0046F5B6
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_004678EB		4_2_004678EB
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_004839C8		4_2_004839C8
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_00467CBF		4_2_00467CBF

Found potential string decryption / allocating functions

Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: String function: 00432A34 appears 36 times
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: String function: 00465868 appears 52 times
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: String function: 004737C0 appears 42 times
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: String function: 00436E97 appears 60 times
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: String function: 00465835 appears 270 times
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: String function: 00465A70 appears 91 times
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: String function: 00436E97 appears 38 times
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: String function: 00465835 appears 133 times
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: String function: 00465A70 appears 60 times

PE file contains strange resources

Source: 9cf2c56e_by_Libranalysis.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: 9cf2c56e_by_Libranalysis.exe, 00000000.00000002.218431401.0000000002C60000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs 9cf2c56e_by_Libranalysis.exe
Source: 9cf2c56e_by_Libranalysis.exe, 00000000.00000002.217747515.00000000004CF000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameIt's unfortunate that Democrats whomz- vs 9cf2c56e_by_Libranalysis.exe
Source: 9cf2c56e_by_Libranalysis.exe, 00000000.00000002.218551333.0000000002D60000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs 9cf2c56e_by_Libranalysis.exe
Source: 9cf2c56e_by_Libranalysis.exe, 00000000.00000002.218551333.0000000002D60000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs 9cf2c56e_by_Libranalysis.exe
Source: 9cf2c56e_by_Libranalysis.exe	Binary or memory string: OriginalFilenameIt's unfortunate that Democrats whomz- vs 9cf2c56e_by_Libranalysis.exe

Tries to load missing DLLs

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll			Jump to behavior

Uses 32bit PE files

Source: 9cf2c56e_by_Libranalysis.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Yara signature match

Source: 00000000.00000002.217998392.00000000022E1000.00000020.00000001.sdmp, type: MEMORY	Matched rule: Win32_Trojan_Emotet tc_detection_name = Emotet, author = ReversingLabs, tc_detection_factor = , tc_detection_type = Trojan
Source: 00000004.00000002.471904242.0000000000AE1000.00000020.00000001.sdmp, type: MEMORY	Matched rule: Win32_Trojan_Emotet tc_detection_name = Emotet, author = ReversingLabs, tc_detection_factor = , tc_detection_type = Trojan
Source: 00000000.00000002.217986642.00000000022D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Win32_Trojan_Emotet tc_detection_name = Emotet, author = ReversingLabs, tc_detection_factor = , tc_detection_type = Trojan
Source: 00000004.00000002.471824961.0000000000AD0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Win32_Trojan_Emotet tc_detection_name = Emotet, author = ReversingLabs, tc_detection_factor = , tc_detection_type = Trojan
Source: 4.2.aeevts.exe.ad053f.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Trojan_Emotet tc_detection_name = Emotet, author = ReversingLabs, tc_detection_factor = , tc_detection_type = Trojan
Source: 0.2.9cf2c56e_by_Libranalysis.exe.22d053f.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Trojan_Emotet tc_detection_name = Emotet, author = ReversingLabs, tc_detection_factor = , tc_detection_type = Trojan
Source: 4.2.aeevts.exe.ad053f.1.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Trojan_Emotet tc_detection_name = Emotet, author = ReversingLabs, tc_detection_factor = , tc_detection_type = Trojan
Source: 0.2.9cf2c56e_by_Libranalysis.exe.22d053f.1.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Trojan_Emotet tc_detection_name = Emotet, author = ReversingLabs, tc_detection_factor = , tc_detection_type = Trojan

Classification label

Source: classification engine

Classification label: mal100.troj.evad.winEXE@17/8@0/100

Contains functionality to load and extract PE file embedded resources

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe

Code function: 0_2_004204F0 FindResourceA,VirtualAllocExNuma,

0_2_004204F0

Creates files inside the user directory

Source: C:\Windows\System32\svchost.exe

File created: C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl

Jump to behavior

Creates mutexes

Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\IA8CD3455
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6244:120:WilError_01
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\MA8CD3455

Reads ini files

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Sample is known by Antivirus

Source: 9cf2c56e_by_Libranalysis.exe

ReversingLabs: Detection: 76%

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe 'C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe'
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Process created: C:\Windows\SysWOW64\aeevts\aeevts.exe C:\Windows\SysWOW64\aeevts\aeevts.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Process created: C:\Windows\SysWOW64\aeevts\aeevts.exe C:\Windows\SysWOW64\aeevts\aeevts.exe			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: c:\Users\User\Desktop\2005\7.2.20\ObjectInspector_demo\Release\ObjectInspectorTest.pdb source: 9cf2c56e_by_Libranalysis.exe, aeevts.exe
Source:	Binary string: c:\Users\User\Desktop\2005\7.2.20\ObjectInspector_demo\Release\ObjectInspectorTest.pdb@K,CJ source: 9cf2c56e_by_Libranalysis.exe, 00000000.00000002.217645187.0000000000401000.00000040.00020000.sdmp, aeevts.exe, 00000004.00000002.470738360.0000000000401000.00000040.00020000.sdmp

Data Obfuscation:

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe

Code function: 0_2_00485724 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__invoke_watson,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__invoke_watson,__decode_pointer,__decode_pointer,__decode_pointer,

0_2_00485724

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_0046590D push ecx; ret		0_2_00465920
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_00465AB5 push ecx; ret		0_2_00465AC8
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_0046590D push ecx; ret		4_2_00465920
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_00465AB5 push ecx; ret		4_2_00465AC8

Sample is packed with UPX

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior:

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe

Executable created and started: C:\Windows\SysWOW64\aeevts\aeevts.exe

Jump to behavior

Drops PE files to the windows directory (C:\Windows)

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe

PE file moved: C:\Windows\SysWOW64\aeevts\aeevts.exe

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe

File opened: C:\Windows\SysWOW64\aeevts\aeevts.exe:Zone.Identifier read attributes | delete

Jump to behavior

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_004441D1 __EH_prolog3,IsIconic,SetForegroundWindow,SendMessageA,PostMessageA,		0_2_004441D1
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_00425251 IsIconic,GetWindowPlacement,GetWindowRect,		0_2_00425251
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_004441D1 __EH_prolog3,IsIconic,SetForegroundWindow,SendMessageA,PostMessageA,		4_2_004441D1
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_00425251 IsIconic,GetWindowPlacement,GetWindowRect,		4_2_00425251
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_004226C0 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,		4_2_004226C0
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_00452DBF IsWindowVisible,IsIconic,		4_2_00452DBF

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Contains capabilities to detect virtual machines

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\System32\svchost.exe TID: 5376

Thread sleep time: -30000s >= -30000s

Jump to behavior

Queries disk information (often used to detect virtual machines)

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Checks the free space of harddrives

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_0045436A lstrlen,FindFirstFileA,FindClose,		0_2_0045436A
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_0044533D __EH_prolog3,GetFullPathNameA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlen,		0_2_0044533D
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_0045436A lstrlen,FindFirstFileA,FindClose,		4_2_0045436A
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_0044533D __EH_prolog3,GetFullPathNameA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlen,		4_2_0044533D

Contains functionality to query system information

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe

Code function: 0_2_00464ED6 VirtualQuery,GetSystemInfo,__invoke_watson,GetModuleHandleA,GetProcAddress,VirtualAlloc,VirtualProtect,

0_2_00464ED6

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: svchost.exe, 00000007.00000002.475482424.00000235C3C64000.00000004.00000001.sdmp	Binary or memory string: "@Hyper-V RAW
Source: svchost.exe, 00000005.00000002.239794997.00000220A6060000.00000002.00000001.sdmp, svchost.exe, 00000009.00000002.302007455.0000021DAF460000.00000002.00000001.sdmp, svchost.exe, 0000000B.00000002.473348948.0000013D5B940000.00000002.00000001.sdmp, svchost.exe, 00000013.00000002.336408447.000001D019340000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: svchost.exe, 00000007.00000002.475423789.00000235C3C4E000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000A.00000002.471164998.0000023FDCC02000.00000004.00000001.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: svchost.exe, 00000005.00000002.239794997.00000220A6060000.00000002.00000001.sdmp, svchost.exe, 00000009.00000002.302007455.0000021DAF460000.00000002.00000001.sdmp, svchost.exe, 0000000B.00000002.473348948.0000013D5B940000.00000002.00000001.sdmp, svchost.exe, 00000013.00000002.336408447.000001D019340000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: svchost.exe, 00000005.00000002.239794997.00000220A6060000.00000002.00000001.sdmp, svchost.exe, 00000009.00000002.302007455.0000021DAF460000.00000002.00000001.sdmp, svchost.exe, 0000000B.00000002.473348948.0000013D5B940000.00000002.00000001.sdmp, svchost.exe, 00000013.00000002.336408447.000001D019340000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: svchost.exe, 0000000A.00000002.471272556.0000023FDCC3C000.00000004.00000001.sdmp, svchost.exe, 0000000B.00000002.470888059.0000013D5AC3D000.00000004.00000001.sdmp, svchost.exe, 0000000D.00000002.471232005.0000020490229000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: svchost.exe, 00000005.00000002.239794997.00000220A6060000.00000002.00000001.sdmp, svchost.exe, 00000009.00000002.302007455.0000021DAF460000.00000002.00000001.sdmp, svchost.exe, 0000000B.00000002.473348948.0000013D5B940000.00000002.00000001.sdmp, svchost.exe, 00000013.00000002.336408447.000001D019340000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Queries a list of all running processes

Source: C:\Windows\SysWOW64\aeevts\aeevts.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Windows\SysWOW64\aeevts\aeevts.exe

Code function: 4_2_004637C4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

4_2_004637C4

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe

Code function: 0_2_00485724 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__invoke_watson,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__invoke_watson,__decode_pointer,__decode_pointer,__decode_pointer,

0_2_00485724

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_00411960 mov eax, dword ptr fs:[00000030h]		0_2_00411960
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_00411960 mov eax, dword ptr fs:[00000030h]		4_2_00411960

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe

Code function: 0_2_0046564B GetStartupInfoA,GetProcessHeap,GetProcessHeap,RtlAllocateHeap,_fast_error_exit,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,_fast_error_exit,_fast_error_exit,__RTC_Initialize,__ioinit,__amsg_exit,GetCommandLineA,___crtGetEnvironmentStringsA,__setargv,__amsg_exit,__setenvp,__amsg_exit,__cinit,__amsg_exit,__wincmdln,

0_2_0046564B

Contains functionality to register its own exception handler

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_00470940 __decode_pointer,SetUnhandledExceptionFilter,		0_2_00470940
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_0047091E SetUnhandledExceptionFilter,__encode_pointer,		0_2_0047091E
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_00475619 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00475619
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_00470940 __decode_pointer,SetUnhandledExceptionFilter,		4_2_00470940
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_0047091E SetUnhandledExceptionFilter,__encode_pointer,		4_2_0047091E
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_00475619 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		4_2_00475619
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_004637C4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		4_2_004637C4
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_004639FB _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		4_2_004639FB

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: aeevts.exe, 00000004.00000002.472010147.0000000000ED0000.00000002.00000001.sdmp, svchost.exe, 0000000C.00000002.471273712.000002DB4C860000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: aeevts.exe, 00000004.00000002.472010147.0000000000ED0000.00000002.00000001.sdmp, svchost.exe, 0000000C.00000002.471273712.000002DB4C860000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: aeevts.exe, 00000004.00000002.472010147.0000000000ED0000.00000002.00000001.sdmp, svchost.exe, 0000000C.00000002.471273712.000002DB4C860000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: aeevts.exe, 00000004.00000002.472010147.0000000000ED0000.00000002.00000001.sdmp, svchost.exe, 0000000C.00000002.471273712.000002DB4C860000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe

Code function: 0_2_004848E2 cpuid

0_2_004848E2

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,		0_2_00480138
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement,		0_2_004803BC
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,		0_2_00480680
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: GetLocaleInfoA,		0_2_00488CDB
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoA,		0_2_0047572A
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoA,_malloc,GetLocaleInfoA,MultiByteToWideChar,__freea,		0_2_00485918
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoW_stat,		0_2_00485A53
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,GetLocaleInfoA,		0_2_00485A8E
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,		0_2_00485BCB
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: GetLocaleInfoA,		0_2_00481C9E
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: _LcidFromHexString,GetLocaleInfoA,		0_2_00481D80
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen,		0_2_00481E16
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: _LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,		0_2_00481E88
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: _LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,		0_2_00482058
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,		0_2_00482143
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: _strlen,EnumSystemLocalesA,		0_2_0048211A
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: _TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s,		0_2_004821E4
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,		0_2_004821A8
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: GetThreadLocale,GetLocaleInfoA,GetACP,		0_2_0048E259
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,		4_2_00480138
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement,		4_2_004803BC
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,		4_2_00480680
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: GetLocaleInfoA,		4_2_00488CDB
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoA,		4_2_0047572A
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoA,_malloc,GetLocaleInfoA,MultiByteToWideChar,__freea,		4_2_00485918
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoW_stat,		4_2_00485A53
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,GetLocaleInfoA,		4_2_00485A8E
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,		4_2_00485BCB
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: GetLocaleInfoA,		4_2_00481C9E
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: _LcidFromHexString,GetLocaleInfoA,		4_2_00481D80
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen,		4_2_00481E16
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: _LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,		4_2_00481E88
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: _LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,		4_2_00482058
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,		4_2_00482143
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: _strlen,EnumSystemLocalesA,		4_2_0048211A
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: _TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s,		4_2_004821E4
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,		4_2_004821A8
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: GetThreadLocale,GetLocaleInfoA,GetACP,		4_2_0048E259
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: _strcpy_s,__snprintf_s,GetLocaleInfoA,LoadLibraryA,		4_2_00437633
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,		4_2_0047FAA9

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Contains functionality to query local / system time

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe

Code function: 0_2_0047549F GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_0047549F

Contains functionality to query time zone information

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe

Code function: 0_2_004788A8 __lock,__invoke_watson,__invoke_watson,__invoke_watson,____lc_codepage_func,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,

0_2_004788A8

Contains functionality to query windows version

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe

Code function: 0_2_004501B1 __EH_prolog3_GS,_memset,GetVersionExA,_malloc,_memset,

0_2_004501B1

Queries the cryptographic machine GUID

Source: C:\Windows\SysWOW64\aeevts\aeevts.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: svchost.exe, 00000010.00000002.471490786.000002581C83D000.00000004.00000001.sdmp	Binary or memory string: @V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000010.00000002.471637433.000002581C902000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Stealing of Sensitive Information:

Yara detected Emotet

Source: Yara match	File source: 00000000.00000002.217998392.00000000022E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.471904242.0000000000AE1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.217986642.00000000022D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.471824961.0000000000AD0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.aeevts.exe.ad053f.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.9cf2c56e_by_Libranalysis.exe.22d053f.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.aeevts.exe.ad053f.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.9cf2c56e_by_Libranalysis.exe.22d053f.1.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Source: C:\Users\user\Desktop\9cf2c56e_by_Libranalysis.exe	Code function: 0_2_00431760 CreateBindCtx,		0_2_00431760
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_00431760 CreateBindCtx,		4_2_00431760
Source: C:\Windows\SysWOW64\aeevts\aeevts.exe	Code function: 4_2_0043255B __EH_prolog3_GS,lstrlenW,__snprintf_s,CreateBindCtx,		4_2_0043255B