Analysis
- max time kernel
119s - max time network
169s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
08/02/2022, 16:03
Static task
static1
Behavioral task
behavioral1
Sample
d28fec91e032209d9b84bde3d913b5ed.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target d28fec91e032209d9b84bde3d913b5ed.dll
- Size 758KB
- Sample220208-thd3zsacb9
- SHA256 2ed7acdaec9afc76515436db0a8d74a11ce004a87e4e7a558c9014140da5a197
- MD5 d28fec91e032209d9b84bde3d913b5ed
- SHA1 05198e83532d50826623fcd407907e52b9d4a8de
- SHA512 d729b42ccb671412c7776241d5c9b51631ef9c89e134741542da3b02c4b746cc6b67a09b2c750a83605067b1b46f7d89df567bc526e2c7475c71ccb85e133a61
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch5
C2
-
103.42.57.17:8080
-
93.104.208.37:8080
-
195.154.146.35:443
-
62.171.178.147:8080
-
37.59.209.141:8080
-
139.196.72.155:8080
-
37.44.244.177:8080
-
191.252.103.16:80
-
217.182.143.207:443
-
128.199.192.135:8080
-
103.41.204.169:8080
-
185.148.168.15:8080
-
168.197.250.14:80
-
78.46.73.125:443
-
194.9.172.107:8080
-
185.148.168.220:8080
-
118.98.72.86:443
-
54.37.106.167:8080
-
78.47.204.80:443
-
159.69.237.188:443
-
116.124.128.206:8080
-
59.148.253.194:443
-
85.214.67.203:8080
-
185.184.25.78:8080
-
173.203.78.138:443
-
54.37.228.122:443
-
198.199.98.78:8080
-
195.77.239.39:8080
-
210.57.209.142:8080
-
66.42.57.149:443
-
104.131.62.48:8080
-
54.38.242.185:443
-
190.90.233.66:443
-
207.148.81.119:8080
-
203.153.216.46:443
eck1.plain
ecs1.plain
Signatures
- Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 828 svchost.exe Token: SeCreatePagefilePrivilege 828 svchost.exe Token: SeShutdownPrivilege 828 svchost.exe Token: SeCreatePagefilePrivilege 828 svchost.exe Token: SeShutdownPrivilege 828 svchost.exe Token: SeCreatePagefilePrivilege 828 svchost.exe Token: SeSecurityPrivilege 1732 TiWorker.exe Token: SeRestorePrivilege 1732 TiWorker.exe Token: SeBackupPrivilege 1732 TiWorker.exe Token: SeBackupPrivilege 1732 TiWorker.exe Token: SeRestorePrivilege 1732 TiWorker.exe Token: SeSecurityPrivilege 1732 TiWorker.exe Token: SeBackupPrivilege 1732 TiWorker.exe Token: SeRestorePrivilege 1732 TiWorker.exe Token: SeSecurityPrivilege 1732 TiWorker.exe Token: SeBackupPrivilege 1732 TiWorker.exe Token: SeRestorePrivilege 1732 TiWorker.exe Token: SeSecurityPrivilege 1732 TiWorker.exe Token: SeBackupPrivilege 1732 TiWorker.exe Token: SeRestorePrivilege 1732 TiWorker.exe Token: SeSecurityPrivilege 1732 TiWorker.exe Token: SeBackupPrivilege 1732 TiWorker.exe Token: SeRestorePrivilege 1732 TiWorker.exe Token: SeSecurityPrivilege 1732 TiWorker.exe Token: SeBackupPrivilege 1732 TiWorker.exe Token: SeRestorePrivilege 1732 TiWorker.exe Token: SeSecurityPrivilege 1732 TiWorker.exe Token: SeBackupPrivilege 1732 TiWorker.exe Token: SeRestorePrivilege 1732 TiWorker.exe Token: SeSecurityPrivilege 1732 TiWorker.exe Token: SeBackupPrivilege 1732 TiWorker.exe Token: SeRestorePrivilege 1732 TiWorker.exe Token: SeSecurityPrivilege 1732 TiWorker.exe Token: SeBackupPrivilege 1732 TiWorker.exe Token: SeRestorePrivilege 1732 TiWorker.exe Token: SeSecurityPrivilege 1732 TiWorker.exe Token: SeBackupPrivilege 1732 TiWorker.exe Token: SeRestorePrivilege 1732 TiWorker.exe Token: SeSecurityPrivilege 1732 TiWorker.exe Token: SeBackupPrivilege 1732 TiWorker.exe Token: SeRestorePrivilege 1732 TiWorker.exe Token: SeSecurityPrivilege 1732 TiWorker.exe Token: SeBackupPrivilege 1732 TiWorker.exe Token: SeRestorePrivilege 1732 TiWorker.exe Token: SeSecurityPrivilege 1732 TiWorker.exe Token: SeBackupPrivilege 1732 TiWorker.exe Token: SeRestorePrivilege 1732 TiWorker.exe Token: SeSecurityPrivilege 1732 TiWorker.exe Token: SeBackupPrivilege 1732 TiWorker.exe Token: SeRestorePrivilege 1732 TiWorker.exe Token: SeSecurityPrivilege 1732 TiWorker.exe Token: SeBackupPrivilege 1732 TiWorker.exe Token: SeRestorePrivilege 1732 TiWorker.exe Token: SeSecurityPrivilege 1732 TiWorker.exe Token: SeBackupPrivilege 1732 TiWorker.exe Token: SeRestorePrivilege 1732 TiWorker.exe Token: SeSecurityPrivilege 1732 TiWorker.exe Token: SeBackupPrivilege 1732 TiWorker.exe Token: SeRestorePrivilege 1732 TiWorker.exe Token: SeSecurityPrivilege 1732 TiWorker.exe Token: SeBackupPrivilege 1732 TiWorker.exe Token: SeRestorePrivilege 1732 TiWorker.exe Token: SeSecurityPrivilege 1732 TiWorker.exe Token: SeBackupPrivilege 1732 TiWorker.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4072 wrote to memory of 4288 4072 regsvr32.exe 82 PID 4072 wrote to memory of 4288 4072 regsvr32.exe 82 PID 4072 wrote to memory of 4288 4072 regsvr32.exe 82 PID 4288 wrote to memory of 4024 4288 regsvr32.exe 85 PID 4288 wrote to memory of 4024 4288 regsvr32.exe 85 PID 4288 wrote to memory of 4024 4288 regsvr32.exe 85
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\d28fec91e032209d9b84bde3d913b5ed.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\d28fec91e032209d9b84bde3d913b5ed.dll2⤵
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\d28fec91e032209d9b84bde3d913b5ed.dll",DllRegisterServer3⤵PID:4024
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:828
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1732