Trojan.Win32.EMOTET.UWAOIBEMV

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Prozesse hinzu:

• If the sample is ran with administrator rights:
  • %System%\rundll32.exe "%System%\{Random Folder Name}\{Random file name}.{Random 3 letter extension}", {random characters}
  • %System%\rundll32.exe "%System%\{Random Folder Name}\{Random file name}.{Random 3 letter extension}",DllRegisterServer
• If the sample is ran without administrator rights:
  • %System%\rundll32.exe "%AppDataLocal%\{Random Folder Name}\{Random File Name}.{Random Extension}", {random characters}
  • %System%\rundll32.exe "%AppDataLocal%\{Random Folder Name}\{Random file name}.{Random 3 letter extension}",DllRegisterServer

(Hinweis: %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) and 10(64-bit).)

Andere Details

It connects to the following possibly malicious URL:

• {BLOCKED}.{BLOCKED}.204.126
• {BLOCKED}.{BLOCKED}.163.161
• {BLOCKED}.{BLOCKED}.230.105
• {BLOCKED}.{BLOCKED}.25.185
• {BLOCKED}.{BLOCKED}.214.46
• {BLOCKED}.{BLOCKED}.143.207
• {BLOCKED}.{BLOCKED}.201.4
• {BLOCKED}.{BLOCKED}.72.26
• {BLOCKED}.{BLOCKED}.225.142
• {BLOCKED}.{BLOCKED}.115.99
• {BLOCKED}.{BLOCKED}.222.11
• {BLOCKED}.{BLOCKED}.147.66
• {BLOCKED}.{BLOCKED}.102.168
• {BLOCKED}.{BLOCKED}.71.0
• {BLOCKED}.{BLOCKED}.84.195
• {BLOCKED}.{BLOCKED}.117.186
• {BLOCKED}.{BLOCKED}.59.82
• {BLOCKED}.{BLOCKED}.24.231
• {BLOCKED}.{BLOCKED}.99.3
• {BLOCKED}.{BLOCKED}.201.2
• {BLOCKED}.{BLOCKED}.108.46
• {BLOCKED}.{BLOCKED}.109.124
• {BLOCKED}.{BLOCKED}.114.231
• {BLOCKED}.{BLOCKED}.71.210
• {BLOCKED}.{BLOCKED}.135.203
• {BLOCKED}.{BLOCKED}.188.93
• {BLOCKED}.{BLOCKED}.232.124
• {BLOCKED}.{BLOCKED}.212.216
• {BLOCKED}.{BLOCKED}.222.101
• {BLOCKED}.{BLOCKED}.186.49
• {BLOCKED}.{BLOCKED}.134.35
• {BLOCKED}.{BLOCKED}.106.96
• {BLOCKED}.{BLOCKED}.236.90
• {BLOCKED}.{BLOCKED}.226.206

Es macht Folgendes:

• If the sample is ran with administrator rights it renames itself to %System%\{Random Folder Name}\{Random file name}.{Random 3 letter extension}
• If the sample is ran without administrator rights it renames itself to %AppDataLocal%\{Random Folder Name}\{Random file name}.{Random 3 letter extension}

(Hinweis: %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) and 10(64-bit).)