Analysis
-
max time kernel
119s -
max time network
148s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 03:20
Static task
static1
General
-
Target
90f48340030216d266edd208aac750ab83978945a1193a5b22e615bb4373c743.dll
-
Size
512KB
-
MD5
c2a0dc021dd2a83829a4b361c98567f1
-
SHA1
e9ddb08532d8996d6702736f1cc9ea5120b75d13
-
SHA256
90f48340030216d266edd208aac750ab83978945a1193a5b22e615bb4373c743
-
SHA512
a87e36e27ed46457320ab216f86abcf523f69f5765351fd6a6767d167d785a29754407056b301d54d5e4ca6dbe9493b04d79345090655526c6779182394b7651
Malware Config
Extracted
emotet
Epoch4
51.15.4.22:443
173.214.173.220:8080
212.237.5.209:443
192.254.71.210:443
216.158.226.206:443
162.243.175.63:443
212.24.98.99:8080
58.227.42.236:80
45.118.115.99:8080
104.251.214.46:8080
185.157.82.209:8080
46.55.222.11:443
188.40.137.206:8080
81.0.236.90:443
103.75.201.2:443
129.232.188.93:443
195.154.133.20:443
159.8.59.82:8080
79.172.212.216:8080
138.185.72.26:8080
200.17.134.35:7080
185.157.82.211:8080
209.59.138.75:7080
178.63.25.185:443
45.176.232.124:443
45.118.135.203:7080
164.68.99.3:8080
203.114.109.124:443
212.237.17.99:8080
50.116.54.215:443
131.100.24.231:80
212.237.56.116:7080
45.142.114.231:8080
162.214.50.39:7080
51.38.71.0:443
104.168.155.129:8080
107.182.225.142:8080
217.182.143.207:443
158.69.222.101:443
176.104.106.96:8080
207.38.84.195:8080
41.76.108.46:8080
110.232.117.186:8080
178.79.147.66:8080
173.212.193.249:8080
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 3336 wrote to memory of 2200 3336 regsvr32.exe regsvr32.exe PID 3336 wrote to memory of 2200 3336 regsvr32.exe regsvr32.exe PID 3336 wrote to memory of 2200 3336 regsvr32.exe regsvr32.exe PID 2200 wrote to memory of 872 2200 regsvr32.exe rundll32.exe PID 2200 wrote to memory of 872 2200 regsvr32.exe rundll32.exe PID 2200 wrote to memory of 872 2200 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\90f48340030216d266edd208aac750ab83978945a1193a5b22e615bb4373c743.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\90f48340030216d266edd208aac750ab83978945a1193a5b22e615bb4373c743.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\90f48340030216d266edd208aac750ab83978945a1193a5b22e615bb4373c743.dll",DllRegisterServer3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2200-117-0x0000000004D90000-0x0000000004DB5000-memory.dmpFilesize
148KB