MALICIOUS — 0a6ed4b8afaa9c059345f97ff0bf7dcbf38e318082d67c6e3ad19ffbcb02617a

MALICIOUS — 0a6ed4b8afaa9c059345f97ff0bf7dcbf38e318082d67c6e3ad19ffbcb02617a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100), attributed to the Emotet family. 4 of 51 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 0a6ed4b8afaa9c059345f97ff0bf7dcbf38e318082d67c6e3ad19ffbcb02617a
• SHA-1: 951f78e9f34aac35254ef882db97a12ef0b96f17
• MD5: ddf06f2257a30b4aadd3eb004bde26b2
• imphash: 2c7bbba8114a1db482eb2a2ac8bfb8cb
• ssdeep: 12288:OTpgHmqTFivW1I3mNNgeCsvt/ymTXhoj3V5sMGvxuH8LnjnB5A/yIsG6xC9nNS:OTpgHmnW1+SJCatqm+3V52xZ6zsG6Wk
• TLSH: T111536BAB21021701DAE1DB04B8608D4D60ABA65562BC1E08C55FC43E2DEEF5FAFB3355
• Submitted as: 0a6ed4b8afaa9c059345f97ff0bf7dcbf38e318082d67c6e3ad19ffbcb02617a
• File type: pe · Size: 1074416 bytes
• Verdict: malicious (88/100) · Family: Emotet

Detections (4 of 51 engines)

• YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
• YARA: JPCERT/CC: JPCERT_Emotet
• YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
• YARA: Yara-Rules community: YR_AntiDebug_Checks

MITRE ATT&CK

• T1055
• T1057

YARA

• Windows_Injection_Api_Combo

Why this verdict

The malicious score of 88/100 is the fusion of 7 weighted signals:

• Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
• YARA: JPCERT/CC flagged JPCERT_Emotet (rule JPCERT_Emotet) - engine signal, weight 0.35, confidence 0.70
• YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://ie.2345.cc/0 - static signal, weight 0.35, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
• inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.digicert.com/CPS0
• http://crl3.digicert.com/sha2-assured-ts.crl02
• http://crl4.digicert.com/sha2-assured-ts.crl0
• https://www.digicert.com/CPS0
• http://crl3.digicert.com/EVCodeSigning-g1.crl03
• http://crl4.digicert.com/EVCodeSigning-g1.crl0K
• http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
• http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
• http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
• http://www.digicert.com/ssl-cps-repository.htm0
• http://ie.2345.cc/0
• http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0

Embedded domains

• thread.cc
• www.digicert.com
• crl3.digicert.com
• crl4.digicert.com
• cacerts.digicert.com
• ie.2345.cc

File paths

• F:\V68_45\src\out\official_release\2345Explorer.exe.pdb
• R:\:c:h:w:}:
• O:\:
• X:\:
• T:\:d:l:t:
• P:\:h:t:

More Emotet samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report