Analysis
- max time kernel
145s - max time network
129s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
03/02/2022, 23:26
General
- Target a652a4e361dd9977e6e4701e34fdadb8.dll
- Size 966KB
- Sample220203-3ettpsedam
- SHA256 73811b709c0dac6cf35db6a3f620368d91e4bbac76657d0dc0448f73e6b1c7f7
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch5
C2
-
174.136.15.27:8080
-
185.122.58.89:443
-
66.42.57.149:443
-
159.69.237.188:443
-
78.47.204.80:443
-
54.38.242.185:443
-
37.44.244.177:8080
-
185.148.168.220:8080
-
217.182.143.207:443
-
198.199.98.78:8080
-
139.196.72.155:8080
-
59.148.253.194:443
-
195.77.239.39:8080
-
210.57.209.142:8080
-
128.199.192.135:8080
-
173.203.78.138:443
-
62.171.178.147:8080
-
85.214.67.203:8080
-
185.148.168.15:8080
-
191.252.103.16:80
eck1.plain
ecs1.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\a652a4e361dd9977e6e4701e34fdadb8.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\a652a4e361dd9977e6e4701e34fdadb8.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\a652a4e361dd9977e6e4701e34fdadb8.dll",DllRegisterServer3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1072-53-0x000007FEFBC21000-0x000007FEFBC23000-memory.dmp
memory/2024-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmp
memory/2024-55-0x0000000000380000-0x00000000003A6000-memory.dmp