Analysis
-
max time kernel
4294183s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20220310-en -
submitted
15-03-2022 22:11
Static task
static1
Behavioral task
behavioral1
Sample
emotet_epoch4.dll
Resource
win7-20220310-en
General
-
Target
emotet_epoch4.dll
-
Size
1016KB
-
MD5
44360ac910a34cc7f68659385e90a692
-
SHA1
940dc0179de83b614bf23ff27b1fba24a702f137
-
SHA256
21f94d0e611799fbcb7c633a3e902d85d5939ddb7ea05bc26d9f15e271eef4e2
-
SHA512
c7c6d5856588f099c3b5c4e25d0c3297250eb46478b252883aa0a719e59f165e950ed5ab8268b183aed572954a5e072e44240149cf06cb0ec2a806571c9dc3c6
Malware Config
Extracted
emotet
Epoch4
45.76.1.145:443
217.182.25.250:8080
119.193.124.41:7080
192.99.251.50:443
146.59.226.45:443
173.212.193.249:8080
207.38.84.195:8080
45.118.135.203:7080
31.24.158.56:8080
209.126.98.206:8080
212.237.17.99:8080
216.158.226.206:443
50.30.40.196:8080
82.165.152.127:8080
159.8.59.82:8080
107.182.225.142:8080
110.232.117.186:8080
72.15.201.15:8080
5.9.116.246:8080
79.172.212.216:8080
212.24.98.99:8080
188.44.20.25:443
101.50.0.91:8080
203.114.109.124:443
151.106.112.196:8080
196.218.30.83:443
176.56.128.118:443
159.65.88.10:8080
195.154.133.20:443
176.104.106.96:8080
45.118.115.99:8080
129.232.188.93:443
45.176.232.124:443
158.69.222.101:443
45.142.114.231:8080
103.221.221.247:8080
103.43.46.182:443
185.157.82.211:8080
51.91.7.5:8080
103.75.201.2:443
167.99.115.35:8080
185.8.212.130:7080
46.55.222.11:443
197.242.150.244:8080
58.227.42.236:80
195.201.151.129:8080
51.254.140.238:7080
50.116.54.215:443
138.185.72.26:8080
178.79.147.66:8080
189.126.111.200:7080
153.126.146.25:7080
103.75.201.4:443
164.68.99.3:8080
131.100.24.231:80
1.234.2.232:8080
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
regsvr32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Erbbkgcla\ejmpptdzrxni.ahl regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
regsvr32.exepid process 768 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 1992 regsvr32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1656 wrote to memory of 1992 1656 regsvr32.exe regsvr32.exe PID 1656 wrote to memory of 1992 1656 regsvr32.exe regsvr32.exe PID 1656 wrote to memory of 1992 1656 regsvr32.exe regsvr32.exe PID 1656 wrote to memory of 1992 1656 regsvr32.exe regsvr32.exe PID 1656 wrote to memory of 1992 1656 regsvr32.exe regsvr32.exe PID 1656 wrote to memory of 1992 1656 regsvr32.exe regsvr32.exe PID 1656 wrote to memory of 1992 1656 regsvr32.exe regsvr32.exe PID 1992 wrote to memory of 768 1992 regsvr32.exe regsvr32.exe PID 1992 wrote to memory of 768 1992 regsvr32.exe regsvr32.exe PID 1992 wrote to memory of 768 1992 regsvr32.exe regsvr32.exe PID 1992 wrote to memory of 768 1992 regsvr32.exe regsvr32.exe PID 1992 wrote to memory of 768 1992 regsvr32.exe regsvr32.exe PID 1992 wrote to memory of 768 1992 regsvr32.exe regsvr32.exe PID 1992 wrote to memory of 768 1992 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_epoch4.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\emotet_epoch4.dll2⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Erbbkgcla\ejmpptdzrxni.ahl"3⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/768-60-0x00000000004B0000-0x00000000004D8000-memory.dmpFilesize
160KB
-
memory/1656-54-0x000007FEFB9B1000-0x000007FEFB9B3000-memory.dmpFilesize
8KB
-
memory/1992-55-0x0000000075931000-0x0000000075933000-memory.dmpFilesize
8KB
-
memory/1992-56-0x00000000001F0000-0x0000000000218000-memory.dmpFilesize
160KB