Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
MIpuuSiSZ4

Overview

General Information

Sample Name:MIpuuSiSZ4 (renamed file extension from none to dll)
Analysis ID:671702
MD5:1dd34935a785a419fb552b5086ea682e
SHA1:c6c966e4ba623f9972273de07b842ffbb9a9efce
SHA256:8b5a10f9a8f2b25057442111a01faf021ef7e048eab875a4078a44758d952c6f
Tags:exeOpenCTIBRSandboxed
Infos:

Detection

Emotet
Score:96
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected Emotet
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Snort IDS alert for network traffic
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Queries the volume information (name, serial number etc) of a device
One or more processes crash
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
Deletes files inside the Windows folder
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
Tries to load missing DLLs
Drops PE files to the windows directory (C:\Windows)
Detected TCP or UDP traffic on non-standard ports
Checks if the current process is being debugged
Registers a DLL
Queries disk information (often used to detect virtual machines)
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • loaddll64.exe (PID: 7160 cmdline: loaddll64.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll" MD5: 4E8A40CAD6CCC047914E3A7830A2D8AA)
    • cmd.exe (PID: 6376 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • rundll32.exe (PID: 6160 cmdline: rundll32.exe "C:\Users\user\Desktop\MIpuuSiSZ4.dll",#1 MD5: 73C519F050C20580F8A62C849D49215A)
        • WerFault.exe (PID: 6728 cmdline: C:\Windows\system32\WerFault.exe -u -p 6160 -s 336 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)
    • regsvr32.exe (PID: 5016 cmdline: regsvr32.exe /s C:\Users\user\Desktop\MIpuuSiSZ4.dll MD5: D78B75FC68247E8A63ACBA846182740E)
      • regsvr32.exe (PID: 5696 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FmCnbLJkOlaRytmc\QMbXoKRooU.dll" MD5: D78B75FC68247E8A63ACBA846182740E)
    • rundll32.exe (PID: 3896 cmdline: rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AddStroke MD5: 73C519F050C20580F8A62C849D49215A)
      • WerFault.exe (PID: 4412 cmdline: C:\Windows\system32\WerFault.exe -u -p 3896 -s 328 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)
    • rundll32.exe (PID: 5804 cmdline: rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AddWordsToWordList MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 2196 cmdline: rundll32.exe C:\Users\user\Desktop\MIpuuSiSZ4.dll,AdviseInkChange MD5: 73C519F050C20580F8A62C849D49215A)
    • regsvr32.exe (PID: 5428 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YbTPHZsAWIZFUi\eAeQcUPg.dll" MD5: D78B75FC68247E8A63ACBA846182740E)
  • svchost.exe (PID: 3316 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: 32569E403279B3FD2EDB7EBD036273FA)
    • WerFault.exe (PID: 6496 cmdline: C:\Windows\system32\WerFault.exe -pss -s 484 -p 6160 -ip 6160 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)
    • WerFault.exe (PID: 6568 cmdline: C:\Windows\system32\WerFault.exe -pss -s 516 -p 3896 -ip 3896 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)
  • svchost.exe (PID: 6584 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 4900 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 5068 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 5928 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 7032 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6188 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • cleanup

Malware Configuration

Threatname: Emotet

{"C2 list": ["192.168.2.7:2", "244.26.0.0:1", "240.69.242.0:2", "184.6.0.0:1", "64.6.0.0:1", "192.6.0.0:1", "244.6.0.0:1", "4.7.0.0:1", "20.7.0.0:1", "76.7.0.0:1", "92.7.0.0:1", "108.7.0.0:1", "112.7.0.0:1", "200.6.0.0:1", "16.7.0.0:1", "96.7.0.0:1", "124.7.0.0:1", "80.7.0.0:1", "128.7.0.0:1", "240.6.0.0:1", "32.7.0.0:1", "36.7.0.0:1", "214.112.3.0:5308", "241.112.3.0:5164", "243.112.3.0:1484"]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000003.00000000.457523835.000001A6C0911000.00000020.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
    00000002.00000002.454942955.0000000001411000.00000020.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
      00000005.00000002.460329273.0000016A80010000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
        00000003.00000002.500443188.000001A6C0911000.00000020.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
          0000000C.00000002.883306468.0000000001000000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
            Click to see the 18 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            3.2.rundll32.exe.1a6c08b0000.1.raw.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
              6.2.rundll32.exe.195c5870000.0.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                3.0.rundll32.exe.1a6c08b0000.1.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                  4.0.rundll32.exe.21313760000.3.raw.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                    12.2.regsvr32.exe.1000000.0.raw.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                      Click to see the 17 entries

                      Sigma Signatures

                      ⊘No Sigma rule has matched

                      Snort Signatures

                      Timestamp:192.168.2.7174.138.33.494979470802404316 07/22/22-13:58:44.263207
                      SID:2404316
                      Source Port:49794
                      Destination Port:7080
                      Protocol:TCP
                      Classtype:A Network Trojan was detected

                      Joe Sandbox Signatures

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection

                      barindex
                      Multi AV Scanner detection for submitted file
                      Source: MIpuuSiSZ4.dllVirustotal: Detection: 72%Perma Link
                      Source: MIpuuSiSZ4.dllMetadefender: Detection: 54%Perma Link
                      Source: MIpuuSiSZ4.dllReversingLabs: Detection: 88%
                      Antivirus detection for URL or domain
                      Source: https://174.138.33.49/7Avira URL Cloud: Label: malware
                      Source: https://174.138.33.49:7080/temyAvira URL Cloud: Label: malware
                      Source: https://174.138.33.49:7080/NumvAvira URL Cloud: Label: malware
                      Source: 0000000C.00000003.792258520.0000000000F0F000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Emotet {"C2 list": ["192.168.2.7:2", "244.26.0.0:1", "240.69.242.0:2", "184.6.0.0:1", "64.6.0.0:1", "192.6.0.0:1", "244.6.0.0:1", "4.7.0.0:1", "20.7.0.0:1", "76.7.0.0:1", "92.7.0.0:1", "108.7.0.0:1", "112.7.0.0:1", "200.6.0.0:1", "16.7.0.0:1", "96.7.0.0:1", "124.7.0.0:1", "80.7.0.0:1", "128.7.0.0:1", "240.6.0.0:1", "32.7.0.0:1", "36.7.0.0:1", "214.112.3.0:5308", "241.112.3.0:5164", "243.112.3.0:1484"]}