MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 66efae40ebe839c569a74a29c3404fe2fbda530747c4590c95140d43b035c93a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 66efae40ebe839c569a74a29c3404fe2fbda530747c4590c95140d43b035c93a
SHA3-384 hash: 649416bd24294086a10124e2a362cf7f266a709005b8dc970413f0c25175a5a91d81f2244648fc2081c57386797408bf
SHA1 hash: 076dc6900b78f3bca354ae1cb19f1d99fc8f331b
MD5 hash: bf1441ec660b06725461b7115a9111b2
humanhash: neptune-march-oklahoma-river
File name:cSulWCz3TXV.exe
Download: download sample
Signature Heodo
Create hunting rule
File size:118'784 bytes
First seen:2020-09-03 19:04:41 UTC
Last seen:2020-09-03 19:07:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash cce7bbce77610b9130eb5d1f4d659541 (104 x Heodo)
ssdeep 3072:TChC6NAN/FuTmngEyyIVVoSCWMZ4d0l0pAM:T0CTN/gTagEyxXYiLC
Threatray 7'827 similar samples on MalwareBazaar
TLSH 42C3C017B5E2C977F586407238E5AF7AA777FA000E204E83A758A35E5E316D18D33386
Reporter FORMALITYDE
Tags:Emotet Heodo

Intelligence

File Origin
# of uploads :
2
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Emotet
Create hunting rule
Link:
https://www.capesandbox.com/analysis/55001/
Detection(s):
SecuriteInfo.com.Generic.mg.bf1441ec660b0672.21069.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Artemis00F8093728B9.29933.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Connection attempt
Sending an HTTP POST request
Result
Threat name:
Emotet MailPassView Qbot
Create hunting rule
Detection:
malicious
Classification:
phis.bank.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/458883
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Binary contains a suspicious time stamp
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to compare user and computer (likely to detect sandboxes)
Contains functionality to detect virtual machines (IN, VMware)
Contains functionality to inject code into remote processes
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops executables to the windows directory (C:\Windows) and starts them
Emotet Banking Trojan found
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sets debug register (to hijack the execution of another thread)
Sigma detected: Suspicious Svchost Process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Emotet
Yara detected MailPassView
Yara detected Qbot
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 281845 Sample: cSulWCz3TXV.exe Startdate: 03/09/2020 Architecture: WINDOWS Score: 100 72 Malicious sample detected (through community Yara rule) 2->72 74 Multi AV Scanner detection for submitted file 2->74 76 Emotet Banking Trojan found 2->76 78 9 other signatures 2->78 9 cSulWCz3TXV.exe 2 2->9         started        12 svchost.exe 2->12         started        14 svchost.exe 1 1 2->14         started        17 9 other processes 2->17 process3 dnsIp4 96 Hides that the sample has been downloaded from the Internet (zone.identifier) 9->96 19 credprovhost.exe 19 9->19         started        98 Changes security center settings (notifications, updates, antivirus, firewall) 12->98 24 MpCmdRun.exe 12->24         started        70 127.0.0.1 unknown unknown 14->70 signatures5 process6 dnsIp7 64 62.210.90.75, 443, 49728 OnlineSASFR France 19->64 66 185.215.227.107, 443, 49719 AS40676US United Kingdom 19->66 54 C:\Windows\SysWOW64\...\credprovhostseed.exe, PE32+ 19->54 dropped 56 C:\Windows\SysWOW64\...\credprovhostpeer.exe, PE32+ 19->56 dropped 58 C:\...\SystemEventsBrokerClientad8.exe, PE32 19->58 dropped 80 Detected unpacking (changes PE section rights) 19->80 82 Detected unpacking (overwrites its own PE header) 19->82 84 Emotet Banking Trojan found 19->84 86 8 other signatures 19->86 26 SystemEventsBrokerClientad8.exe 3 19->26         started        30 credprovhost.exe 1 19->30         started        32 credprovhost.exe 7 19->32         started        36 6 other processes 19->36 34 conhost.exe 24->34         started        file8 signatures9 process10 file11 60 C:\Users\user\AppData\Roaming\...\aiivkr.exe, PE32 26->60 dropped 100 Antivirus detection for dropped file 26->100 102 Detected unpacking (changes PE section rights) 26->102 104 Detected unpacking (overwrites its own PE header) 26->104 110 4 other signatures 26->110 38 aiivkr.exe 26->38         started        41 schtasks.exe 26->41         started        43 SystemEventsBrokerClientad8.exe 26->43         started        106 Tries to steal Instant Messenger accounts or passwords 30->106 108 Tries to steal Mail credentials (via file access) 30->108 62 C:\Users\user\AppData\Local\Temp\439C.tmp, ASCII 36->62 dropped 45 WerFault.exe 23 9 36->45         started        signatures12 process13 dnsIp14 88 Antivirus detection for dropped file 38->88 90 Detected unpacking (changes PE section rights) 38->90 92 Detected unpacking (overwrites its own PE header) 38->92 94 5 other signatures 38->94 48 aiivkr.exe 38->48         started        50 explorer.exe 38->50         started        52 conhost.exe 41->52         started        68 192.168.2.1 unknown unknown 45->68 signatures15 process16
Detection:
emotet
Create hunting rule
Link:
https://mwdb.cert.pl/sample/66efae40ebe839c569a74a29c3404fe2fbda530747c4590c95140d43b035c93a/
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-09-03 19:06:08 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=m3x24qhl5a44k2nhjiu4gqcp4l55uuyhi7cfsdevcqguhmbvze5a._file
Verdict:
malicious
Label(s):
emotet
Create hunting rule
Similar samples:
01a131566b79b2df79cb1a9c25f7979abd454e3437ece96b8feaa0551b9dc686
Heodo
1f32074e6a1329535b509d20ed66d4e92e26f951f011fcaf755ddced7bf6ba3d
Heodo
344e99de41cc160db6473b5ce912cfe060e040f041a213b9f9f65b72e9d62f1f
Heodo
45254cb7dd40b7b6c45377a258e7b2b711e41a464b78a57be04d73a2cd79196b
Heodo
4a0f0636229ae12448b6f5a2a30bd6f7af233da14809842fffb8d771c1442c3d
Heodo
63930b14af729c7269381e50fe9d2aa5c1e270c629023c4a39564d39ef0d42f0
Heodo
9c281e71c57763a75244960e0d2b690970f03c2a8ad1a756d03eb57eef8a738d
Heodo
b1c32ab9829ce18688bdc2f48a63f967f67366e2d725ae16bad216cbc79158e9
Heodo
d5fd96bae5ff3e62cf1ce06d08bbcc8ea9fe53251bc7991cd6aac7df6d1ced72
Heodo
f21b0ad145b5daaf43e6c2aa8673aac47bb18c0a570ab3122d07477e66444666
Heodo
+ 7'817 additional samples on MalwareBazaar
Result
Malware family:
emotet
Create hunting rule
Score:
  10/10
Tags:
trojan banker family:emotet
Link:
https://tria.ge/reports/200903-h8sztr79w2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Emotet
Malware Config
C2 Extraction:
185.215.227.107:443
51.38.124.206:80
38.88.126.202:8080
54.37.42.48:8080
172.104.169.32:8080
68.183.190.199:8080
187.162.248.237:80
82.76.111.249:443
184.66.18.83:80
190.6.193.152:8080
77.238.212.227:80
199.203.62.165:80
188.2.217.94:80
185.94.252.12:80
178.250.54.208:8080
206.15.68.237:443
65.36.62.20:80
216.47.196.104:80
219.92.8.17:8080
213.60.96.117:80
77.55.211.77:8080
72.167.223.217:8080
177.74.228.34:80
186.103.141.250:443
190.163.31.26:80
85.109.159.61:443
68.183.170.114:8080
213.197.182.158:8080
45.161.242.102:80
71.197.211.156:80
104.131.103.37:8080
94.176.234.118:443
190.2.31.172:80
5.196.35.138:7080
190.195.129.227:8090
67.247.242.247:80
64.201.88.132:80
152.169.22.67:80
24.135.1.177:80
191.182.6.118:80
51.159.23.217:443
110.142.219.51:80
68.69.155.181:80
82.196.15.205:8080
77.90.136.129:8080
181.129.96.162:8080
45.33.77.42:8080
95.9.180.128:80
192.241.146.84:8080
91.219.169.180:80
188.135.15.49:80
212.71.237.140:8080
98.13.75.196:80
72.47.248.48:7080
209.236.123.42:8080
217.13.106.14:8080
219.92.13.25:80
177.72.13.80:80
12.162.84.2:8080
177.73.0.98:443
50.121.220.50:80
185.178.10.77:80
216.10.40.16:80
61.92.159.208:8080
170.81.48.2:80
45.16.226.117:443
185.94.252.27:443
217.199.160.224:7080
178.79.163.131:8080
186.70.127.199:8090
91.121.54.71:8080
190.190.148.27:8080
190.24.243.186:80
138.97.60.141:7080
104.131.41.185:8080
73.213.208.163:80
181.30.61.163:443
103.106.236.83:8080
192.241.143.52:8080
87.106.46.107:8080
2.47.112.152:80
45.173.88.33:80
204.225.249.100:7080
111.67.77.202:8080
70.32.115.157:8080
111.67.12.221:8080
70.32.84.74:8080
58.171.153.81:80
190.147.137.153:443
190.115.18.139:8080
83.169.21.32:7080
5.189.178.202:8080
50.28.51.143:8080
137.74.106.111:7080
189.2.177.210:443
72.135.200.124:80
51.255.165.160:8080
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Virus
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/66efae40ebe839c569a74a29c3404fe2fbda530747c4590c95140d43b035c93a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/55001/

Comments