Analysis
- max time kernel
107s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
31/01/2022, 17:32
Static task
static1
Behavioral task
behavioral1
Sample
fe0ac32e757507552901527d22ad11fd.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
fe0ac32e757507552901527d22ad11fd.dll
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
- Target fe0ac32e757507552901527d22ad11fd.dll
- Size 412KB
- Sample220131-v4a4wsadep
- SHA256 020e19888d07b4bddc5f0f78dc7857bbd428eaab87295eb82abd3c47fabc1904
- MD5 fe0ac32e757507552901527d22ad11fd
- SHA1 48841a8bda5bb0ffd9d7382c1e48c43afa73cf7b
- SHA512 681b394557b022a90eb96623013164febd227ab305a1ea7108805290b74ffe411f4cc9f9a0fd552a59d8fa07b13c2501bcc57ab8c7690a973b082e25db956094
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch4
C2
-
144.76.186.49:8080
-
160.16.102.168:80
-
58.227.42.236:80
-
158.69.222.101:443
-
129.232.188.93:443
-
207.38.84.195:8080
-
192.254.71.210:443
-
185.157.82.211:8080
-
81.0.236.90:443
-
212.237.17.99:8080
-
46.55.222.11:443
-
164.68.99.3:8080
-
217.182.143.207:443
-
195.154.133.20:443
-
216.158.226.206:443
-
212.237.5.209:443
-
110.232.117.186:8080
-
51.15.4.22:443
-
45.118.115.99:8080
-
51.38.71.0:443
-
209.59.138.75:7080
-
103.75.201.2:443
-
107.182.225.142:8080
-
45.118.135.203:7080
-
212.237.56.116:7080
-
131.100.24.231:80
-
159.8.59.82:8080
-
138.185.72.26:8080
-
104.251.214.46:8080
-
41.76.108.46:8080
-
203.114.109.124:443
-
45.176.232.124:443
-
178.63.25.185:443
-
45.142.114.231:8080
-
159.89.230.105:443
-
162.243.175.63:443
-
50.116.54.215:443
-
173.212.193.249:8080
-
176.104.106.96:8080
-
162.214.50.39:7080
-
79.172.212.216:8080
-
200.17.134.35:7080
-
212.24.98.99:8080
-
178.79.147.66:8080
eck1.plain
ecs1.plain
Signatures
- Sets service image path in registry 2 TTPs
- Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3296 wrote to memory of 540 3296 regsvr32.exe 52 PID 3296 wrote to memory of 540 3296 regsvr32.exe 52 PID 3296 wrote to memory of 540 3296 regsvr32.exe 52 PID 540 wrote to memory of 1612 540 regsvr32.exe 53 PID 540 wrote to memory of 1612 540 regsvr32.exe 53 PID 540 wrote to memory of 1612 540 regsvr32.exe 53
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\fe0ac32e757507552901527d22ad11fd.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\fe0ac32e757507552901527d22ad11fd.dll2⤵
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\fe0ac32e757507552901527d22ad11fd.dll",DllRegisterServer3⤵PID:1612
-
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 83fb9dfc57d026a6cd366c1ecaf38691 O/t/vqmvr0W6dqZWOuA7UQ.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:3820