Analysis
- max time kernel
148s - max time network
187s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
08/02/2022, 01:12
Static task
static1
Behavioral task
behavioral1
Sample
20db7836693a488b5ce0a6b211cbf5d9.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target 20db7836693a488b5ce0a6b211cbf5d9.dll
- Size 608KB
- Sample220208-bkh6lsbecm
- SHA256 b3d266ade8f88baf7181c7b1f0615edf220f81e2d51da50e78efcf4afab6aba8
- MD5 20db7836693a488b5ce0a6b211cbf5d9
- SHA1 58d6c5b3adadb949606164c48739d66de0885701
- SHA512 01b2afa40cb55133c252d521c5560b81df7d4d2265ebef1c2ba0a5524f815663a59b75ae5169a42d8f00871f3daa5ca1b3d4560e57a2001a2538256c21d6b042
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch4
C2
-
8.9.11.48:443
-
144.76.186.55:7080
-
45.118.115.99:8080
-
51.254.140.238:7080
-
162.214.50.39:7080
-
119.235.255.201:8080
-
103.75.201.4:443
-
164.68.99.3:8080
-
178.79.147.66:8080
-
192.95.56.148:8080
-
81.0.236.90:443
-
45.118.135.203:7080
-
131.100.24.231:80
-
41.76.108.46:8080
-
45.142.114.231:8080
-
82.165.152.127:8080
-
45.176.232.124:443
-
50.116.54.215:443
-
162.243.175.63:443
-
216.158.226.206:443
-
195.154.133.20:443
-
212.237.17.99:8080
-
103.75.201.2:443
-
212.237.5.209:443
-
200.17.134.35:7080
-
185.157.82.211:8080
-
144.76.186.49:8080
-
212.237.56.116:7080
-
31.24.158.56:8080
-
104.251.214.46:8080
-
110.232.117.186:8080
-
46.55.222.11:443
-
159.8.59.82:8080
-
158.69.222.101:443
-
176.104.106.96:8080
-
107.182.225.142:8080
-
58.227.42.236:80
-
203.114.109.124:443
-
173.212.193.249:8080
-
79.172.212.216:8080
-
159.89.230.105:443
-
160.16.102.168:80
-
178.128.83.165:80
-
212.24.98.99:8080
-
207.38.84.195:8080
-
153.126.203.229:8080
-
217.182.143.207:443
-
129.232.188.93:443
-
138.185.72.26:8080
eck1.plain
ecs1.plain
Signatures
- Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1300 svchost.exe Token: SeCreatePagefilePrivilege 1300 svchost.exe Token: SeShutdownPrivilege 1300 svchost.exe Token: SeCreatePagefilePrivilege 1300 svchost.exe Token: SeShutdownPrivilege 1300 svchost.exe Token: SeCreatePagefilePrivilege 1300 svchost.exe Token: SeSecurityPrivilege 2836 TiWorker.exe Token: SeRestorePrivilege 2836 TiWorker.exe Token: SeBackupPrivilege 2836 TiWorker.exe Token: SeBackupPrivilege 2836 TiWorker.exe Token: SeRestorePrivilege 2836 TiWorker.exe Token: SeSecurityPrivilege 2836 TiWorker.exe Token: SeBackupPrivilege 2836 TiWorker.exe Token: SeRestorePrivilege 2836 TiWorker.exe Token: SeSecurityPrivilege 2836 TiWorker.exe Token: SeBackupPrivilege 2836 TiWorker.exe Token: SeRestorePrivilege 2836 TiWorker.exe Token: SeSecurityPrivilege 2836 TiWorker.exe Token: SeBackupPrivilege 2836 TiWorker.exe Token: SeRestorePrivilege 2836 TiWorker.exe Token: SeSecurityPrivilege 2836 TiWorker.exe Token: SeBackupPrivilege 2836 TiWorker.exe Token: SeRestorePrivilege 2836 TiWorker.exe Token: SeSecurityPrivilege 2836 TiWorker.exe Token: SeBackupPrivilege 2836 TiWorker.exe Token: SeRestorePrivilege 2836 TiWorker.exe Token: SeSecurityPrivilege 2836 TiWorker.exe Token: SeBackupPrivilege 2836 TiWorker.exe Token: SeRestorePrivilege 2836 TiWorker.exe Token: SeSecurityPrivilege 2836 TiWorker.exe Token: SeBackupPrivilege 2836 TiWorker.exe Token: SeRestorePrivilege 2836 TiWorker.exe Token: SeSecurityPrivilege 2836 TiWorker.exe Token: SeBackupPrivilege 2836 TiWorker.exe Token: SeRestorePrivilege 2836 TiWorker.exe Token: SeSecurityPrivilege 2836 TiWorker.exe Token: SeBackupPrivilege 2836 TiWorker.exe Token: SeRestorePrivilege 2836 TiWorker.exe Token: SeSecurityPrivilege 2836 TiWorker.exe Token: SeBackupPrivilege 2836 TiWorker.exe Token: SeRestorePrivilege 2836 TiWorker.exe Token: SeSecurityPrivilege 2836 TiWorker.exe Token: SeBackupPrivilege 2836 TiWorker.exe Token: SeRestorePrivilege 2836 TiWorker.exe Token: SeSecurityPrivilege 2836 TiWorker.exe Token: SeBackupPrivilege 2836 TiWorker.exe Token: SeRestorePrivilege 2836 TiWorker.exe Token: SeSecurityPrivilege 2836 TiWorker.exe Token: SeBackupPrivilege 2836 TiWorker.exe Token: SeRestorePrivilege 2836 TiWorker.exe Token: SeSecurityPrivilege 2836 TiWorker.exe Token: SeBackupPrivilege 2836 TiWorker.exe Token: SeRestorePrivilege 2836 TiWorker.exe Token: SeSecurityPrivilege 2836 TiWorker.exe Token: SeBackupPrivilege 2836 TiWorker.exe Token: SeRestorePrivilege 2836 TiWorker.exe Token: SeSecurityPrivilege 2836 TiWorker.exe Token: SeBackupPrivilege 2836 TiWorker.exe Token: SeRestorePrivilege 2836 TiWorker.exe Token: SeSecurityPrivilege 2836 TiWorker.exe Token: SeBackupPrivilege 2836 TiWorker.exe Token: SeRestorePrivilege 2836 TiWorker.exe Token: SeSecurityPrivilege 2836 TiWorker.exe Token: SeBackupPrivilege 2836 TiWorker.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 448 wrote to memory of 4384 448 regsvr32.exe 82 PID 448 wrote to memory of 4384 448 regsvr32.exe 82 PID 448 wrote to memory of 4384 448 regsvr32.exe 82 PID 4384 wrote to memory of 4552 4384 regsvr32.exe 83 PID 4384 wrote to memory of 4552 4384 regsvr32.exe 83 PID 4384 wrote to memory of 4552 4384 regsvr32.exe 83
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\20db7836693a488b5ce0a6b211cbf5d9.dll1⤵
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\20db7836693a488b5ce0a6b211cbf5d9.dll2⤵
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\20db7836693a488b5ce0a6b211cbf5d9.dll",DllRegisterServer3⤵PID:4552
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1300
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2836