Analysis
-
max time kernel
142s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220310-en -
submitted
15-03-2022 22:35
Static task
static1
Behavioral task
behavioral1
Sample
emotet_epoch5.dll
Resource
win7-20220311-en
General
-
Target
emotet_epoch5.dll
-
Size
1004KB
-
MD5
6b8ff194d6546e3d3f719917d467941a
-
SHA1
d2ebb27795ca385c4aa4466bca2fa7ed2fce349e
-
SHA256
2cb25bf931f08086cdf6159f356c17fa67d51ac7ed088a2aed84e59be6fae6e4
-
SHA512
6bd52f217aedcb3a62fda1cad889c4841f1b7173c3dd735c7f347d589c82b1d98c6b980b5e43b40b7b735ddeac739df8e0e346c277155dcaf68c7384963dd5c9
Malware Config
Extracted
emotet
Epoch5
165.22.61.235:443
121.78.112.42:8080
216.10.251.121:8080
195.77.239.39:8080
195.154.146.35:443
68.183.93.250:443
139.196.72.155:8080
194.9.172.107:8080
196.44.98.190:8080
128.199.192.135:8080
5.56.132.177:8080
78.46.73.125:443
87.106.97.83:7080
66.42.57.149:443
37.44.244.177:8080
190.90.233.66:443
203.153.216.46:443
207.148.81.119:8080
103.41.204.169:8080
104.131.62.48:8080
185.148.168.15:8080
217.182.143.207:443
198.199.98.78:8080
103.82.248.59:7080
185.168.130.138:443
202.28.34.99:8080
59.148.253.194:443
37.59.209.141:8080
185.148.168.220:8080
54.37.228.122:443
85.214.67.203:8080
85.25.120.45:8080
118.98.72.86:443
103.42.58.120:7080
78.47.204.80:443
202.134.4.210:7080
93.104.209.107:8080
2.58.16.87:8080
62.171.178.147:8080
45.71.195.104:8080
116.124.128.206:8080
191.252.103.16:80
54.37.106.167:8080
88.217.172.165:8080
54.38.242.185:443
210.57.209.142:8080
159.69.237.188:443
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1020 regsvr32.exe -
Drops file in System32 directory 1 IoCs
Processes:
regsvr32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Ajfyahovk\hclzmuqsglgepk.mrg regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 1020 regsvr32.exe 1020 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 4512 regsvr32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 4592 wrote to memory of 4512 4592 regsvr32.exe regsvr32.exe PID 4592 wrote to memory of 4512 4592 regsvr32.exe regsvr32.exe PID 4592 wrote to memory of 4512 4592 regsvr32.exe regsvr32.exe PID 4512 wrote to memory of 1020 4512 regsvr32.exe regsvr32.exe PID 4512 wrote to memory of 1020 4512 regsvr32.exe regsvr32.exe PID 4512 wrote to memory of 1020 4512 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_epoch5.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\emotet_epoch5.dll2⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Ajfyahovk\hclzmuqsglgepk.mrg"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\Ajfyahovk\hclzmuqsglgepk.mrgMD5
6b8ff194d6546e3d3f719917d467941a
SHA1d2ebb27795ca385c4aa4466bca2fa7ed2fce349e
SHA2562cb25bf931f08086cdf6159f356c17fa67d51ac7ed088a2aed84e59be6fae6e4
SHA5126bd52f217aedcb3a62fda1cad889c4841f1b7173c3dd735c7f347d589c82b1d98c6b980b5e43b40b7b735ddeac739df8e0e346c277155dcaf68c7384963dd5c9
-
memory/1020-138-0x0000000002D50000-0x0000000002D77000-memory.dmpFilesize
156KB
-
memory/4512-134-0x0000000002FC0000-0x0000000002FE7000-memory.dmpFilesize
156KB