Analysis
-
max time kernel
4294180s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
15-03-2022 22:35
Static task
static1
Behavioral task
behavioral1
Sample
emotet_epoch5.dll
Resource
win7-20220311-en
General
-
Target
emotet_epoch5.dll
-
Size
1004KB
-
MD5
6b8ff194d6546e3d3f719917d467941a
-
SHA1
d2ebb27795ca385c4aa4466bca2fa7ed2fce349e
-
SHA256
2cb25bf931f08086cdf6159f356c17fa67d51ac7ed088a2aed84e59be6fae6e4
-
SHA512
6bd52f217aedcb3a62fda1cad889c4841f1b7173c3dd735c7f347d589c82b1d98c6b980b5e43b40b7b735ddeac739df8e0e346c277155dcaf68c7384963dd5c9
Malware Config
Extracted
emotet
Epoch5
165.22.61.235:443
121.78.112.42:8080
216.10.251.121:8080
195.77.239.39:8080
195.154.146.35:443
68.183.93.250:443
139.196.72.155:8080
194.9.172.107:8080
196.44.98.190:8080
128.199.192.135:8080
5.56.132.177:8080
78.46.73.125:443
87.106.97.83:7080
66.42.57.149:443
37.44.244.177:8080
190.90.233.66:443
203.153.216.46:443
207.148.81.119:8080
103.41.204.169:8080
104.131.62.48:8080
185.148.168.15:8080
217.182.143.207:443
198.199.98.78:8080
103.82.248.59:7080
185.168.130.138:443
202.28.34.99:8080
59.148.253.194:443
37.59.209.141:8080
185.148.168.220:8080
54.37.228.122:443
85.214.67.203:8080
85.25.120.45:8080
118.98.72.86:443
103.42.58.120:7080
78.47.204.80:443
202.134.4.210:7080
93.104.209.107:8080
2.58.16.87:8080
62.171.178.147:8080
45.71.195.104:8080
116.124.128.206:8080
191.252.103.16:80
54.37.106.167:8080
88.217.172.165:8080
54.38.242.185:443
210.57.209.142:8080
159.69.237.188:443
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
regsvr32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Nesomnr\bpeiehhwjkybals.lrk regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
regsvr32.exepid process 1628 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 1520 regsvr32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1636 wrote to memory of 1520 1636 regsvr32.exe regsvr32.exe PID 1636 wrote to memory of 1520 1636 regsvr32.exe regsvr32.exe PID 1636 wrote to memory of 1520 1636 regsvr32.exe regsvr32.exe PID 1636 wrote to memory of 1520 1636 regsvr32.exe regsvr32.exe PID 1636 wrote to memory of 1520 1636 regsvr32.exe regsvr32.exe PID 1636 wrote to memory of 1520 1636 regsvr32.exe regsvr32.exe PID 1636 wrote to memory of 1520 1636 regsvr32.exe regsvr32.exe PID 1520 wrote to memory of 1628 1520 regsvr32.exe regsvr32.exe PID 1520 wrote to memory of 1628 1520 regsvr32.exe regsvr32.exe PID 1520 wrote to memory of 1628 1520 regsvr32.exe regsvr32.exe PID 1520 wrote to memory of 1628 1520 regsvr32.exe regsvr32.exe PID 1520 wrote to memory of 1628 1520 regsvr32.exe regsvr32.exe PID 1520 wrote to memory of 1628 1520 regsvr32.exe regsvr32.exe PID 1520 wrote to memory of 1628 1520 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_epoch5.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\emotet_epoch5.dll2⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Nesomnr\bpeiehhwjkybals.lrk"3⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1520-55-0x00000000755A1000-0x00000000755A3000-memory.dmpFilesize
8KB
-
memory/1520-56-0x0000000000490000-0x00000000004B7000-memory.dmpFilesize
156KB
-
memory/1628-60-0x00000000007B0000-0x00000000007D7000-memory.dmpFilesize
156KB
-
memory/1636-54-0x000007FEFBCC1000-0x000007FEFBCC3000-memory.dmpFilesize
8KB