| File name: | 5bc4b191819093db144050b93aa09a99183ecae3f84ba6f99b496be51fda0c31 |
| Full analysis: | https://app.any.run/tasks/19bdda3a-4269-4b1e-9b72-b6198ffd9acc |
| Verdict: | Malicious activity |
| Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
| Analysis date: | November 17, 2024, 04:57:10 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections |
| MD5: | 5110C2B96C6AD1CB4D523418AFA2AA53 |
| SHA1: | 89F83B9872A948CF8B08DF27A7BC97EA3DAED5DD |
| SHA256: | 5BC4B191819093DB144050B93AA09A99183ECAE3F84BA6F99B496BE51FDA0C31 |
| SSDEEP: | 12288:wccvIvFcPNgfan62tj8WXWMWkWmy4oh8p/xk+pK:wccvIvFcPNwan62i4smZoCdlpK |
MALICIOUS
EMOTET has been detected (SURICATA)
- zipfldr.exe (PID: 2648)
Connects to the CnC server
- zipfldr.exe (PID: 2648)
SUSPICIOUS
Executable content was dropped or overwritten
- 5bc4b191819093db144050b93aa09a99183ecae3f84ba6f99b496be51fda0c31.exe (PID: 6664)
Starts itself from another location
- 5bc4b191819093db144050b93aa09a99183ecae3f84ba6f99b496be51fda0c31.exe (PID: 6664)
Reads security settings of Internet Explorer
- 5bc4b191819093db144050b93aa09a99183ecae3f84ba6f99b496be51fda0c31.exe (PID: 6664)
- zipfldr.exe (PID: 2648)
Connects to the server without a host name
- zipfldr.exe (PID: 2648)
Contacting a server suspected of hosting an CnC
- zipfldr.exe (PID: 2648)
INFO
Checks supported languages
- 5bc4b191819093db144050b93aa09a99183ecae3f84ba6f99b496be51fda0c31.exe (PID: 6664)
- zipfldr.exe (PID: 2648)
Reads the computer name
- 5bc4b191819093db144050b93aa09a99183ecae3f84ba6f99b496be51fda0c31.exe (PID: 6664)
- zipfldr.exe (PID: 2648)
The process uses the downloaded file
- 5bc4b191819093db144050b93aa09a99183ecae3f84ba6f99b496be51fda0c31.exe (PID: 6664)
Reads the machine GUID from the registry
- zipfldr.exe (PID: 2648)
Checks proxy server information
- zipfldr.exe (PID: 2648)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2020:07:28 20:04:18+00:00 |
| ImageFileCharacteristics: | Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 434176 |
| InitializedDataSize: | 208896 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x132c6 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.1 |
| ProductVersionNumber: | 1.0.0.1 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | - |
| FileDescription: | CHexEditDemo MFC Application |
| FileVersion: | 1, 0, 0, 1 |
| InternalName: | CHexEditDemo |
| LegalCopyright: | Copyright (C) 2005 |
| LegalTrademarks: | - |
| OriginalFileName: | CHexEditDemo.EXE |
| ProductName: | CHexEditDemo Application |
| ProductVersion: | 1, 0, 0, 1 |
Total processes
123
Monitored processes
2
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2648 | "C:\Users\admin\AppData\Local\KBDBGPH\zipfldr.exe" | C:\Users\admin\AppData\Local\KBDBGPH\zipfldr.exe | 5bc4b191819093db144050b93aa09a99183ecae3f84ba6f99b496be51fda0c31.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: CHexEditDemo MFC Application Version: 1, 0, 0, 1 Modules
| |||||||||||||||
| 6664 | "C:\Users\admin\Desktop\5bc4b191819093db144050b93aa09a99183ecae3f84ba6f99b496be51fda0c31.exe" | C:\Users\admin\Desktop\5bc4b191819093db144050b93aa09a99183ecae3f84ba6f99b496be51fda0c31.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
Total events
587
Read events
584
Write events
3
Delete events
0
Modification events
| (PID) Process: | (2648) zipfldr.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (2648) zipfldr.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (2648) zipfldr.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6664 | 5bc4b191819093db144050b93aa09a99183ecae3f84ba6f99b496be51fda0c31.exe | C:\Users\admin\AppData\Local\KBDBGPH\zipfldr.exe | executable | |
MD5:5110C2B96C6AD1CB4D523418AFA2AA53 | SHA256:5BC4B191819093DB144050B93AA09A99183ECAE3F84BA6F99B496BE51FDA0C31 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
26
DNS requests
6
Threats
12
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5488 | MoUsoCoreWorker.exe | GET | 200 | 2.20.245.137:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6944 | svchost.exe | GET | 200 | 2.20.245.137:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
1584 | RUXIMICS.exe | GET | 200 | 2.20.245.137:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6944 | svchost.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5488 | MoUsoCoreWorker.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
2648 | zipfldr.exe | POST | 404 | 177.37.81.212:443 | http://177.37.81.212:443/D9Wfc5U9OUP21qeh/0pJBCQz/fil9g/3dVTCWYBx8uoWYXMPR/u8l5wQce/ | unknown | — | — | — |
2648 | zipfldr.exe | POST | — | 74.207.230.187:8080 | http://74.207.230.187:8080/8cIwj4TcrN/Kmq7/0UPP4vl/XjeJlDi/nixg/ | unknown | — | — | — |
2648 | zipfldr.exe | POST | — | 190.164.75.175:80 | http://190.164.75.175/VgOW1r5/neXcRCN8RfdEFFCnhbe/ | unknown | — | — | malicious |
2648 | zipfldr.exe | POST | — | 87.252.100.28:80 | http://87.252.100.28/qudvWUydYM1JDZPxl/lvp39EeovX/8SxeCQs2KHCtAk/2nBt8xRvwvTD5WGKm/UwOi78xgNCvTZAf/UbmgChVgtXt4/ | unknown | — | — | malicious |
2648 | zipfldr.exe | POST | — | 105.209.239.55:80 | http://105.209.239.55/O7yzgn1KJNg/rSwhjXVjESg4mm9Zf2/QrTl86cOm/kuHMb/ | unknown | — | — | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
6944 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5488 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1584 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
6944 | svchost.exe | 2.20.245.137:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
5488 | MoUsoCoreWorker.exe | 2.20.245.137:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
1584 | RUXIMICS.exe | 2.20.245.137:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
6944 | svchost.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
5488 | MoUsoCoreWorker.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Potentially Bad Traffic | ET POLICY HTTP traffic on port 443 (POST) |
— | — | A Network Trojan was detected | ET MALWARE Win32/Emotet CnC Activity (POST) M9 |
— | — | Malware Command and Control Activity Detected | ET MALWARE Win32/Emotet CnC Activity (POST) M8 |
— | — | A Network Trojan was detected | ET MALWARE Win32/Emotet CnC Activity (POST) M9 |
— | — | Malware Command and Control Activity Detected | ET MALWARE Win32/Emotet CnC Activity (POST) M8 |
— | — | A Network Trojan was detected | ET MALWARE Win32/Emotet CnC Activity (POST) M9 |
— | — | A Network Trojan was detected | ET MALWARE Win32/Emotet CnC Activity (POST) M9 |
— | — | Malware Command and Control Activity Detected | ET MALWARE Win32/Emotet CnC Activity (POST) M8 |
— | — | A Network Trojan was detected | ET MALWARE Win32/Emotet CnC Activity (POST) M9 |
— | — | Malware Command and Control Activity Detected | ET MALWARE Win32/Emotet CnC Activity (POST) M8 |