Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- * ID: 2287
- * MalFamily: "Trickbot"
- * MalScore: 10.0
- * File Name: "Emotet_7332e39a8d45ca37ee9a767fa00ec90f.1"
- * File Size: 409600
- * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
- * SHA256: "8deb508a95178d159b43da93160ff6d64c5ad468f1f91e222021eba9292954a1"
- * MD5: "7332e39a8d45ca37ee9a767fa00ec90f"
- * SHA1: "026064006b987ed951ffce4f03c4394f557bf588"
- * SHA512: "443270e1050bf8beb5898455ebd5ad5605f870315c3a3fa3768629681c0c8891d754ca9a2a83ed4c61eec331aeb0ff69153f081b2d1c36ad7f38d5af515f3478"
- * CRC32: "E0E2D7C3"
- * SSDEEP: "6144:KUqCzZ+I7NhNEMxrE6CC0x1/hkVTIX8XrA7PJ0TOwUhK8jFHYkedT8BxD8Xm:1qSJLEcrrJqvXAA7PJrUEFMSxo"
- * Process Execution:
- "I0MRfTCbQ8k.exe",
- "I0MRfTCbQ8k.exe",
- "I0MRfTCbQ8k.exe",
- "I0MRfTCbQ8k.exe",
- "explorer.exe",
- "services.exe",
- "historymachine.exe",
- "historymachine.exe",
- "historymachine.exe",
- "historymachine.exe",
- "WmiApSrv.exe",
- "svchost.exe",
- "WMIADAP.exe",
- "WmiPrvSE.exe"
- * Executed Commands:
- "\"C:\\Users\\user\\AppData\\Local\\Temp\\I0MRfTCbQ8k.exe\"",
- "C:\\Users\\user\\AppData\\Local\\Temp\\I0MRfTCbQ8k.exe --5c851bd8",
- "\"C:\\Windows\\SysWOW64\\historymachine.exe\"",
- "C:\\Windows\\system32\\wbem\\WmiApSrv.exe",
- "C:\\Windows\\system32\\svchost.exe -k netsvcs",
- "C:\\Windows\\SysWOW64\\historymachine.exe --81d93c85"
- * Signatures Detected:
- "Description": "SetUnhandledExceptionFilter detected (possible anti-debug)",
- "Details":
- "Description": "Behavioural detection: Executable code extraction",
- "Details":
- "Description": "Communicates with IPs located across a large number of unique countries",
- "Details":
- "country": "United Kingdom"
- "country": "Iran, Islamic Republic of"
- "country": "Kazakhstan"
- "country": "United States"
- "country": "Colombia"
- "country": "Argentina"
- "country": "Peru"
- "country": "Mexico"
- "country": "Germany"
- "country": "Thailand"
- "Description": "Creates RWX memory",
- "Details":
- "Description": "Possible date expiration check, exits too soon after checking local time",
- "Details":
- "process": "historymachine.exe, PID 1660"
- "Description": "Mimics the system's user agent string for its own requests",
- "Details":
- "Description": "Performs HTTP requests potentially not found in PCAP.",
- "Details":
- "url_ioc": "189.244.245.238:80/scripts/bml/"
- "url_ioc": "189.129.4.186:80/nsip/chunk/usbccid/merge/"
- "Description": "A process created a hidden window",
- "Details":
- "Process": "I0MRfTCbQ8k.exe -> C:\\Users\\user\\AppData\\Local\\Temp\\I0MRfTCbQ8k.exe"
- "Process": "I0MRfTCbQ8k.exe -> C:\\Users\\user\\AppData\\Local\\Temp\\I0MRfTCbQ8k.exe"
- "Process": "historymachine.exe -> C:\\Windows\\SysWOW64\\historymachine.exe"
- "Process": "historymachine.exe -> C:\\Windows\\SysWOW64\\historymachine.exe"
- "Description": "File has been identified by 5 Antiviruses on VirusTotal as malicious",
- "Details":
- "Invincea": "heuristic"
- "APEX": "Malicious"
- "Emsisoft": "Trojan.Agent (A)"
- "Microsoft": "Trojan:Win32/Trickbot.GN"
- "ESET-NOD32": "a variant of Win32/Kryptik.GWNL"
- "Description": "Drops a binary and executes it",
- "Details":
- "binary": "C:\\Windows\\SysWOW64\\historymachine.exe"
- "Description": "Multiple direct IP connections",
- "Details":
- "direct_ip_connections": "Made direct connections to 16 unique IP addresses"
- "Description": "The binary likely contains encrypted or compressed data.",
- "Details":
- "section": "name: .rsrc, entropy: 6.99, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x0001c000, virtual_size: 0x0001b2fc"
- "Description": "Deletes its original binary from disk",
- "Details":
- "Description": "Attempts to remove evidence of file being downloaded from the Internet",
- "Details":
- "file": "C:\\Windows\\SysWOW64\\historymachine.exe:Zone.Identifier"
- "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
- "Details":
- "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 12356159 times"
- "Description": "Installs itself for autorun at Windows startup",
- "Details":
- "service name": "historymachine"
- "service path": "\"C:\\Windows\\SysWOW64\\historymachine.exe\""
- "Description": "Creates a copy of itself",
- "Details":
- "copy": "C:\\Windows\\SysWOW64\\historymachine.exe"
- "Description": "Created network traffic indicative of malicious activity",
- "Details":
- "signature": "ET CNC Feodo Tracker Reported CnC Server group 11"
- "signature": "ET CNC Feodo Tracker Reported CnC Server group 21"
- "signature": "ET CNC Feodo Tracker Reported CnC Server group 22"
- "signature": "ET CNC Feodo Tracker Reported CnC Server group 13"
- "signature": "ET CNC Feodo Tracker Reported CnC Server group 16"
- * Started Service:
- "historymachine",
- "wmiApSrv"
- * Mutexes:
- "Global\\IC1C5B64F",
- "Global\\MC1C5B64F",
- "IESQMMUTEX_0_208",
- "Global\\RefreshRA_Mutex_Lib",
- "Global\\RefreshRA_Mutex",
- "Global\\RefreshRA_Mutex_Flag",
- "Global\\WmiApSrv",
- "Global\\ADAP_WMI_ENTRY"
- * Modified Files:
- "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-0000000000-0000000000-0000000000-1000\\00000000-0000-0000-0000-000000000000b_00000000-0000-0000-0000-000000000000",
- "C:\\Windows\\SysWOW64\\historymachine.exe",
- "C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_00000000-0000-0000-0000-000000000000",
- "\\??\\WMIDataDevice",
- "\\??\\PIPE\\samr"
- * Deleted Files:
- "C:\\Windows\\SysWOW64\\khmerflows.exe",
- "C:\\Users\\user\\AppData\\Local\\Temp\\I0MRfTCbQ8k.exe",
- "C:\\Windows\\SysWOW64\\historymachine.exe:Zone.Identifier"
- * Modified Registry Keys:
- "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7\\pzq.rkr",
- "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\HRZR_PGYFRFFVBA",
- "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\wmiApSrv\\Type",
- "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Type",
- "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\PROVIDERS\\Performance\\Performance Refreshed",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ProcessID",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ThrottleDrege",
- "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Parameters\\ServiceDllUnloadOnStop"
- * Deleted Registry Keys:
- * DNS Communications:
- * Domains:
- * Network Communication - ICMP:
- * Network Communication - HTTP:
- * Network Communication - SMTP:
- * Network Communication - Hosts:
- "country_name": "United Kingdom",
- "ip": "80.85.87.122",
- "inaddrarpa": "",
- "hostname": ""
- "country_name": "Iran, Islamic Republic of",
- "ip": "79.127.57.42",
- "inaddrarpa": "",
- "hostname": ""
- "country_name": "Kazakhstan",
- "ip": "77.245.101.134",
- "inaddrarpa": "",
- "hostname": ""
- "country_name": "United States",
- "ip": "71.244.60.231",
- "inaddrarpa": "",
- "hostname": ""
- "country_name": "United States",
- "ip": "71.244.60.230",
- "inaddrarpa": "",
- "hostname": ""
- "country_name": "United States",
- "ip": "207.180.208.175",
- "inaddrarpa": "",
- "hostname": ""
- "country_name": "Colombia",
- "ip": "200.21.90.6",
- "inaddrarpa": "",
- "hostname": ""
- "country_name": "Argentina",
- "ip": "190.230.60.129",
- "inaddrarpa": "",
- "hostname": ""
- "country_name": "Peru",
- "ip": "190.117.206.153",
- "inaddrarpa": "",
- "hostname": ""
- "country_name": "Mexico",
- "ip": "189.244.245.238",
- "inaddrarpa": "",
- "hostname": ""
- "country_name": "Mexico",
- "ip": "189.129.4.186",
- "inaddrarpa": "",
- "hostname": ""
- "country_name": "Mexico",
- "ip": "187.155.233.46",
- "inaddrarpa": "",
- "hostname": ""
- "country_name": "United States",
- "ip": "159.203.204.126",
- "inaddrarpa": "",
- "hostname": ""
- "country_name": "Germany",
- "ip": "138.68.106.4",
- "inaddrarpa": "",
- "hostname": ""
- "country_name": "Thailand",
- "ip": "119.59.124.163",
- "inaddrarpa": "",
- "hostname": ""
- "country_name": "United States",
- "ip": "104.236.243.129",
- "inaddrarpa": "",
- "hostname": ""
- * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement