Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
cGOpAkgTL.exe

Overview

General Information

Sample Name:cGOpAkgTL.exe
(renamed file extension from bin to exe, renamed because original name is a hash value)
Original Sample Name:cGOpAkgTL.bin
Analysis ID:861748
MD5:b5e31f4e2836b8a67f8684988d224107
SHA1:9816f30629d210b64742be970d412512df600c11
SHA256:efed59c2b1473891a2032927baebe69c87dcace3d87e0b359fe583bbe9181b9b
Infos:

Detection

CryptOne, Emotet
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Antivirus / Scanner detection for submitted sample
Yara detected Emotet
Detected CryptOne packer
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Machine Learning detection for sample
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Drops executables to the windows directory (C:\Windows) and starts them
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Deletes files inside the Windows folder
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
Internet Provider seen in connection with other malware
Program does not show much activity (idle)
IP address seen in connection with other malware
Uses a known web browser user agent for HTTP communication
Drops PE files to the windows directory (C:\Windows)
Connects to several IPs in different countries
PE / OLE file has an invalid certificate
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w7x64
  • cGOpAkgTL.exe (PID: 2412 cmdline: C:\Users\user\Desktop\cGOpAkgTL.exe MD5: B5E31F4E2836B8A67F8684988D224107)
    • cGOpAkgTL.exe (PID: 2592 cmdline: C:\Users\user\Desktop\cGOpAkgTL.exe MD5: B5E31F4E2836B8A67F8684988D224107)
  • mapirepl.exe (PID: 1764 cmdline: C:\Windows\SysWOW64\mapirepl.exe MD5: B5E31F4E2836B8A67F8684988D224107)
    • mapirepl.exe (PID: 1624 cmdline: C:\Windows\SysWOW64\mapirepl.exe MD5: B5E31F4E2836B8A67F8684988D224107)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
EmotetWhile Emotet historically was a banking malware organized in a botnet, nowadays Emotet is mostly seen as infrastructure as a service for content delivery. For example, since mid 2018 it is used by Trickbot for installs, which may also lead to ransomware attacks using Ryuk, a combination observed several times against high-profile targets.It is always stealing information from victims but what the criminal gang behind it did, was to open up another business channel by selling their infrastructure delivering additional malicious software. From malware analysts it has been classified into epochs depending on command and control, payloads, and delivery solutions which change over time.Emotet had been taken down by authorities in January 2021, though it appears to have sprung back to life in November 2021.
  • GOLD CABIN
  • MUMMY SPIDER
  • Mealybug
https://malpedia.caad.fkie.fraunhofer.de/details/win.emotet

Malware Configuration

Threatname: Emotet

{"C2 list": ["104.33.204.83:443", "164.77.138.194:80", "181.16.4.180:80", "190.117.51.248:443", "23.240.26.210:80", "190.111.215.2:80", "85.105.205.77:8080", "143.0.245.169:8080", "200.55.136.2:443", "186.23.186.99:443", "51.255.50.164:8080", "192.163.199.254:8080", "23.254.203.51:8080", "72.47.248.48:8080", "69.163.33.82:8080", "73.115.132.124:80", "190.144.66.30:8080", "186.137.133.132:8080", "109.104.79.48:8080", "66.209.69.165:443", "210.2.86.72:8080", "189.208.239.98:443", "201.184.224.178:80", "92.48.118.27:8080", "173.248.147.186:80", "138.68.139.199:443", "219.94.254.93:8080", "185.86.148.222:8080", "144.76.117.247:8080", "70.28.3.120:7080", "165.227.213.173:8080", "159.65.76.245:443", "209.159.244.240:443", "5.9.128.163:8080", "190.171.105.158:7080", "184.161.177.223:8080", "186.138.205.189:80"]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000001.00000002.897365487.0000000000270000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_EmotetYara detected EmotetJoe Security
    00000001.00000002.897365487.0000000000270000.00000040.00001000.00020000.00000000.sdmpEmotetEmotet Payloadkevoreilly
    • 0x2106:$snippet2: 6A 13 68 01 00 01 00 FF 15 A8 4B 41 00 85 C0
    • 0x68d0:$snippet4: 33 C0 C7 05 B0 7C 41 00 F0 28 41 00 C7 05 B4 7C 41 00 F0 28 41 00 A3 B8 7C 41 00 A3 BC 7C 41 00 A3 C0 7C 41 00 39 05 F0 28 41 00 74 1D 8D 49 00 40 A3 B8 7C 41 00 83 3C C5 F0 28 41 00 00 75 F0 ...
    00000001.00000002.897323249.00000000001D0000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_EmotetYara detected EmotetJoe Security
      00000001.00000002.897323249.00000000001D0000.00000040.00001000.00020000.00000000.sdmpEmotetEmotet Payloadkevoreilly
      • 0x1506:$snippet2: 6A 13 68 01 00 01 00 FF 15 A8 4B 41 00 85 C0
      • 0x5cd0:$snippet4: 33 C0 C7 05 B0 7C 41 00 F0 28 41 00 C7 05 B4 7C 41 00 F0 28 41 00 A3 B8 7C 41 00 A3 BC 7C 41 00 A3 C0 7C 41 00 39 05 F0 28 41 00 74 1D 8D 49 00 40 A3 B8 7C 41 00 83 3C C5 F0 28 41 00 00 75 F0 ...

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      1.2.cGOpAkgTL.exe.1d0000.0.unpackJoeSecurity_EmotetYara detected EmotetJoe Security
        1.2.cGOpAkgTL.exe.1d0000.0.unpackEmotetEmotet Payloadkevoreilly
        • 0x906:$snippet2: 6A 13 68 01 00 01 00 FF 15 A8 4B 41 00 85 C0
        • 0x50d0:$snippet4: 33 C0 C7 05 B0 7C 41 00 F0 28 41 00 C7 05 B4 7C 41 00 F0 28 41 00 A3 B8 7C 41 00 A3 BC 7C 41 00 A3 C0 7C 41 00 39 05 F0 28 41 00 74 1D 8D 49 00 40 A3 B8 7C 41 00 83 3C C5 F0 28 41 00 00 75 F0 ...
        1.2.cGOpAkgTL.exe.1d0000.0.raw.unpackJoeSecurity_EmotetYara detected EmotetJoe Security
          1.2.cGOpAkgTL.exe.270000.1.raw.unpackJoeSecurity_EmotetYara detected EmotetJoe Security
            1.2.cGOpAkgTL.exe.270000.1.unpackJoeSecurity_EmotetYara detected EmotetJoe Security
              Click to see the 3 entries

              Sigma Signatures

              ⊘No Sigma rule has matched

              Snort Signatures

              ⊘No Snort rule has matched

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Found malware configuration
              Source: 1.2.cGOpAkgTL.exe.1d0000.0.raw.unpackMalware Configuration Extractor: Emotet {"C2 list": ["104.33.204.83:443", "164.77.138.194:80", "181.16.4.180:80", "190.117.51.248:443", "23.240.26.210:80", "190.111.215.2:80", "85.105.205.77:8080", "143.0.245.169:8080", "200.55.136.2:443", "186.23.186.99:443", "51.255.50.164:8080", "192.163.199.254:8080", "23.254.203.51:8080", "72.47.248.48:8080", "69.163.33.82:8080", "73.115.132.124:80", "190.144.66.30:8080", "186.137.133.132:8080", "109.104.79.48:8080", "66.209.69.165:443", "210.2.86.72:8080", "189.208.239.98:443", "201.184.224.178:80", "92.48.118.27:8080", "173.248.147.186:80", "138.68.139.199:443", "219.94.254.93:8080", "185.86.148.222:8080", "144.76.117.247:8080", "70.28.3.120:7080", "165.227.213.173:8080", "159.65.76.245:443", "209.159.244.240:443", "5.9.128.163:8080", "190.171.105.158:7080", "184.161.177.223:8080", "186.138.205.189:80"]}