Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- * ID: 2332
- * MalFamily: ""
- * MalScore: 10.0
- * File Name: "Emotet_c67b878c4586fa741188b544931c89cd.1"
- * File Size: 520192
- * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
- * SHA256: "7d16ff3bbf102fdbf9ae57a989c374af5ae0c35f479ef96c6b1d7b70239c61fc"
- * MD5: "c67b878c4586fa741188b544931c89cd"
- * SHA1: "70bb7cac28612239f558887e385196306af6faca"
- * SHA512: "e5ae3d768daa16fc93a3ac6d1ab0a1aa900f013cf35f8d06a35351e5ac869ac6de1ccbaffecc0785c0470084fa9f0703378d2e22ee70709062c8114d754eb3d1"
- * CRC32: "A87D5E82"
- * SSDEEP: "6144:CLMvSfAq5a1dCC8DGNJTMvFC94iMdl01J4t3j1udHi9y0mFr31cP2UKg2xxWSA2K:CL5Aq5GqSjovFCaffFKKmFKCx0"
- * Process Execution:
- "OleznFjY6Dt6iNv.exe",
- "OleznFjY6Dt6iNv.exe",
- "OleznFjY6Dt6iNv.exe",
- "OleznFjY6Dt6iNv.exe",
- "explorer.exe",
- "services.exe",
- "historymachine.exe",
- "historymachine.exe",
- "historymachine.exe",
- "historymachine.exe"
- * Executed Commands:
- "\"C:\\Users\\user\\AppData\\Local\\Temp\\OleznFjY6Dt6iNv.exe\"",
- "C:\\Users\\user\\AppData\\Local\\Temp\\OleznFjY6Dt6iNv.exe --389873d5",
- "\"C:\\Windows\\SysWOW64\\historymachine.exe\"",
- "C:\\Windows\\SysWOW64\\historymachine.exe --81d93c85"
- * Signatures Detected:
- "Description": "SetUnhandledExceptionFilter detected (possible anti-debug)",
- "Details":
- "Description": "Behavioural detection: Executable code extraction",
- "Details":
- "Description": "Communicates with IPs located across a large number of unique countries",
- "Details":
- "country": "United Arab Emirates"
- "country": "Russian Federation"
- "country": "Puerto Rico"
- "country": "United Kingdom"
- "country": "United States"
- "country": "Thailand"
- "country": "Colombia"
- "country": "Chile"
- "country": "Argentina"
- "country": "Singapore"
- "Description": "Creates RWX memory",
- "Details":
- "Description": "Possible date expiration check, exits too soon after checking local time",
- "Details":
- "process": "historymachine.exe, PID 3024"
- "Description": "Mimics the system's user agent string for its own requests",
- "Details":
- "Description": "Performs HTTP requests potentially not found in PCAP.",
- "Details":
- "url_ioc": "159.69.211.211:7080/devices/"
- "url_ioc": "181.230.126.152:8090/prep/enable/between/merge/"
- "url_ioc": "203.150.19.63:443/prov/cone/"
- "url_ioc": "83.110.75.153:8090/symbols/odbc/entries/merge/"
- "url_ioc": "46.32.229.152:8080/sess/"
- "url_ioc": "152.168.220.188:80/balloon/nsip/"
- "url_ioc": "216.154.222.52:7080/schema/srvc/between/merge/"
- "url_ioc": "70.45.30.28:80/glitch/"
- "url_ioc": "139.59.242.76:8080/odbc/tpt/entries/merge/"
- "url_ioc": "190.13.146.47:443/badge/"
- "url_ioc": "78.109.34.178:443/acquire/entries/entries/merge/"
- "url_ioc": "190.146.81.138:8090/enabled/json/entries/merge/"
- "url_ioc": "45.33.1.161:8080/report/"
- "Description": "Repeatedly searches for a not-found process, may want to run with startbrowser=1 option",
- "Details":
- "Description": "A process created a hidden window",
- "Details":
- "Process": "OleznFjY6Dt6iNv.exe -> C:\\Users\\user\\AppData\\Local\\Temp\\OleznFjY6Dt6iNv.exe"
- "Process": "OleznFjY6Dt6iNv.exe -> C:\\Users\\user\\AppData\\Local\\Temp\\OleznFjY6Dt6iNv.exe"
- "Process": "historymachine.exe -> C:\\Windows\\SysWOW64\\historymachine.exe"
- "Process": "historymachine.exe -> C:\\Windows\\SysWOW64\\historymachine.exe"
- "Description": "Drops a binary and executes it",
- "Details":
- "binary": "C:\\Windows\\SysWOW64\\historymachine.exe"
- "Description": "Multiple direct IP connections",
- "Details":
- "direct_ip_connections": "Made direct connections to 13 unique IP addresses"
- "Description": "The binary likely contains encrypted or compressed data.",
- "Details":
- "section": "name: .rsrc, entropy: 6.93, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x0001b000, virtual_size: 0x0001a1c8"
- "Description": "Deletes its original binary from disk",
- "Details":
- "Description": "Attempts to remove evidence of file being downloaded from the Internet",
- "Details":
- "file": "C:\\Windows\\SysWOW64\\historymachine.exe:Zone.Identifier"
- "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
- "Details":
- "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 2077530 times"
- "Description": "Installs itself for autorun at Windows startup",
- "Details":
- "service name": "historymachine"
- "service path": "\"C:\\Windows\\SysWOW64\\historymachine.exe\""
- "Description": "Creates a copy of itself",
- "Details":
- "copy": "C:\\Windows\\SysWOW64\\historymachine.exe"
- "Description": "Created network traffic indicative of malicious activity",
- "Details":
- "signature": "ET CNC Feodo Tracker Reported CnC Server group 3"
- "signature": "ET CNC Feodo Tracker Reported CnC Server group 12"
- "signature": "ET CNC Feodo Tracker Reported CnC Server group 7"
- "signature": "ET CNC Feodo Tracker Reported CnC Server group 17"
- "signature": "ET CNC Feodo Tracker Reported CnC Server group 4"
- * Started Service:
- "historymachine"
- * Mutexes:
- "Global\\IC1C5B64F",
- "Global\\MC1C5B64F",
- "IESQMMUTEX_0_208"
- * Modified Files:
- "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-0000000000-0000000000-0000000000-1000\\00000000-0000-0000-0000-000000000000b_00000000-0000-0000-0000-000000000000",
- "C:\\Windows\\SysWOW64\\historymachine.exe",
- "C:\\Windows\\sysnative\\LogFiles\\Scm\\9cdf079f-d488-47e0-8840-9a3500f1bbe4",
- "C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_00000000-0000-0000-0000-000000000000"
- * Deleted Files:
- "C:\\Windows\\SysWOW64\\khmerflows.exe",
- "C:\\Users\\user\\AppData\\Local\\Temp\\OleznFjY6Dt6iNv.exe",
- "C:\\Windows\\SysWOW64\\historymachine.exe:Zone.Identifier"
- * Modified Registry Keys:
- "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
- "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7\\pzq.rkr",
- "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\HRZR_PGYFRFFVBA",
- "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Action Center\\Checks\\11CD958A-C507-4EF3-B3F2-5FD9DFBD2C78.check.101\\CheckSetting",
- "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings"
- * Deleted Registry Keys:
- * DNS Communications:
- * Domains:
- * Network Communication - ICMP:
- * Network Communication - HTTP:
- * Network Communication - SMTP:
- * Network Communication - Hosts:
- "country_name": "United Arab Emirates",
- "ip": "83.110.75.153",
- "inaddrarpa": "",
- "hostname": ""
- "country_name": "Russian Federation",
- "ip": "78.109.34.178",
- "inaddrarpa": "",
- "hostname": ""
- "country_name": "Puerto Rico",
- "ip": "70.45.30.28",
- "inaddrarpa": "",
- "hostname": ""
- "country_name": "United Kingdom",
- "ip": "46.32.229.152",
- "inaddrarpa": "",
- "hostname": ""
- "country_name": "United States",
- "ip": "45.33.1.161",
- "inaddrarpa": "",
- "hostname": ""
- "country_name": "United States",
- "ip": "216.154.222.52",
- "inaddrarpa": "",
- "hostname": ""
- "country_name": "Thailand",
- "ip": "203.150.19.63",
- "inaddrarpa": "",
- "hostname": ""
- "country_name": "Colombia",
- "ip": "190.146.81.138",
- "inaddrarpa": "",
- "hostname": ""
- "country_name": "Chile",
- "ip": "190.13.146.47",
- "inaddrarpa": "",
- "hostname": ""
- "country_name": "Argentina",
- "ip": "181.230.126.152",
- "inaddrarpa": "",
- "hostname": ""
- "country_name": "United States",
- "ip": "159.69.211.211",
- "inaddrarpa": "",
- "hostname": ""
- "country_name": "Argentina",
- "ip": "152.168.220.188",
- "inaddrarpa": "",
- "hostname": ""
- "country_name": "Singapore",
- "ip": "139.59.242.76",
- "inaddrarpa": "",
- "hostname": ""
- * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement