Analysis
- max time kernel
151s - max time network
163s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
07/02/2022, 17:44
Static task
static1
Behavioral task
behavioral1
Sample
8609022cc3122f907cbcda20163a5b20.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target 8609022cc3122f907cbcda20163a5b20.dll
- Size 216KB
- Sample220207-wa65xafbc5
- SHA256 e6ec2d958a4604eac3bcbdf81690104f837578feb9012548abdcb980a6a3348a
- MD5 8609022cc3122f907cbcda20163a5b20
- SHA1 8810190a65485cc361adf77590b31e3d49dc26e4
- SHA512 95156a64e65a66ef9bdb21c7f53f9598a4b88ef85461ead30ff580da3a0a9a5dcd138ae6acf8bff25486ad8291906a9db81de6a37edcf45efafdb9bada41c1b0
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch5
C2
-
174.136.15.27:8080
-
185.122.58.89:443
-
66.42.57.149:443
-
159.69.237.188:443
-
78.47.204.80:443
-
54.38.242.185:443
-
37.44.244.177:8080
-
185.148.168.220:8080
-
217.182.143.207:443
-
198.199.98.78:8080
-
139.196.72.155:8080
-
59.148.253.194:443
-
195.77.239.39:8080
-
210.57.209.142:8080
-
128.199.192.135:8080
-
173.203.78.138:443
-
62.171.178.147:8080
-
85.214.67.203:8080
-
185.148.168.15:8080
-
191.252.103.16:80
-
190.90.233.66:443
-
185.184.25.78:8080
-
207.148.81.119:8080
-
104.131.62.48:8080
-
78.46.73.125:443
-
37.59.209.141:8080
-
118.98.72.86:443
-
54.37.228.122:443
-
168.197.250.14:80
-
93.104.208.37:8080
-
54.37.106.167:8080
-
116.124.128.206:8080
-
194.9.172.107:8080
-
203.153.216.46:443
-
195.154.146.35:443
-
103.41.204.169:8080
eck1.plain
ecs1.plain
Signatures
- Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe - Suspicious use of AdjustPrivilegeToken 54 IoCs
description pid Process Token: SeShutdownPrivilege 2604 svchost.exe Token: SeCreatePagefilePrivilege 2604 svchost.exe Token: SeShutdownPrivilege 2604 svchost.exe Token: SeCreatePagefilePrivilege 2604 svchost.exe Token: SeShutdownPrivilege 2604 svchost.exe Token: SeCreatePagefilePrivilege 2604 svchost.exe Token: SeSecurityPrivilege 3412 TiWorker.exe Token: SeRestorePrivilege 3412 TiWorker.exe Token: SeBackupPrivilege 3412 TiWorker.exe Token: SeBackupPrivilege 3412 TiWorker.exe Token: SeRestorePrivilege 3412 TiWorker.exe Token: SeSecurityPrivilege 3412 TiWorker.exe Token: SeBackupPrivilege 3412 TiWorker.exe Token: SeRestorePrivilege 3412 TiWorker.exe Token: SeSecurityPrivilege 3412 TiWorker.exe Token: SeBackupPrivilege 3412 TiWorker.exe Token: SeRestorePrivilege 3412 TiWorker.exe Token: SeSecurityPrivilege 3412 TiWorker.exe Token: SeBackupPrivilege 3412 TiWorker.exe Token: SeRestorePrivilege 3412 TiWorker.exe Token: SeSecurityPrivilege 3412 TiWorker.exe Token: SeBackupPrivilege 3412 TiWorker.exe Token: SeRestorePrivilege 3412 TiWorker.exe Token: SeSecurityPrivilege 3412 TiWorker.exe Token: SeBackupPrivilege 3412 TiWorker.exe Token: SeRestorePrivilege 3412 TiWorker.exe Token: SeSecurityPrivilege 3412 TiWorker.exe Token: SeBackupPrivilege 3412 TiWorker.exe Token: SeRestorePrivilege 3412 TiWorker.exe Token: SeSecurityPrivilege 3412 TiWorker.exe Token: SeBackupPrivilege 3412 TiWorker.exe Token: SeRestorePrivilege 3412 TiWorker.exe Token: SeSecurityPrivilege 3412 TiWorker.exe Token: SeBackupPrivilege 3412 TiWorker.exe Token: SeRestorePrivilege 3412 TiWorker.exe Token: SeSecurityPrivilege 3412 TiWorker.exe Token: SeBackupPrivilege 3412 TiWorker.exe Token: SeRestorePrivilege 3412 TiWorker.exe Token: SeSecurityPrivilege 3412 TiWorker.exe Token: SeBackupPrivilege 3412 TiWorker.exe Token: SeRestorePrivilege 3412 TiWorker.exe Token: SeSecurityPrivilege 3412 TiWorker.exe Token: SeBackupPrivilege 3412 TiWorker.exe Token: SeRestorePrivilege 3412 TiWorker.exe Token: SeSecurityPrivilege 3412 TiWorker.exe Token: SeBackupPrivilege 3412 TiWorker.exe Token: SeRestorePrivilege 3412 TiWorker.exe Token: SeSecurityPrivilege 3412 TiWorker.exe Token: SeBackupPrivilege 3412 TiWorker.exe Token: SeRestorePrivilege 3412 TiWorker.exe Token: SeSecurityPrivilege 3412 TiWorker.exe Token: SeBackupPrivilege 3412 TiWorker.exe Token: SeRestorePrivilege 3412 TiWorker.exe Token: SeSecurityPrivilege 3412 TiWorker.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5028 wrote to memory of 4640 5028 regsvr32.exe 82 PID 5028 wrote to memory of 4640 5028 regsvr32.exe 82 PID 5028 wrote to memory of 4640 5028 regsvr32.exe 82 PID 4640 wrote to memory of 3480 4640 regsvr32.exe 83 PID 4640 wrote to memory of 3480 4640 regsvr32.exe 83 PID 4640 wrote to memory of 3480 4640 regsvr32.exe 83
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\8609022cc3122f907cbcda20163a5b20.dll1⤵
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\8609022cc3122f907cbcda20163a5b20.dll2⤵
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\8609022cc3122f907cbcda20163a5b20.dll",DllRegisterServer3⤵PID:3480
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2604
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3412