Analysis
- max time kernel
157s - max time network
167s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
22/03/2022, 14:09
Static task
static1
Behavioral task
behavioral1
Sample
9d7c337f2d55a1b5c1c29341d113ad90ba1e870be028fcf44a2c88f0baf2bbc5.dll
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
General
- Target 9d7c337f2d55a1b5c1c29341d113ad90ba1e870be028fcf44a2c88f0baf2bbc5.dll
- Size 780KB
- Sample220322-rghzfacbgl
- SHA256 9d7c337f2d55a1b5c1c29341d113ad90ba1e870be028fcf44a2c88f0baf2bbc5
- MD5 72fed24770f1d8041d625bbaee0c70f2
- SHA1 57a0924ceeea0b990e0a572a92536b0ee628408e
- SHA512 2d981d8165fe909d7d096e8e7f0b10b41d7e03d06446eca9e6b87a5b1cef02b341188d1b2405705091eb1e9be2d320884540de9989e19723eee5b495a7a15cb4
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch5
C2
-
165.22.61.235:443
-
121.78.112.42:8080
-
216.10.251.121:8080
-
195.77.239.39:8080
-
195.154.146.35:443
-
68.183.93.250:443
-
139.196.72.155:8080
-
194.9.172.107:8080
-
196.44.98.190:8080
-
128.199.192.135:8080
-
5.56.132.177:8080
-
78.46.73.125:443
-
87.106.97.83:7080
-
66.42.57.149:443
-
37.44.244.177:8080
-
190.90.233.66:443
-
203.153.216.46:443
-
207.148.81.119:8080
-
103.41.204.169:8080
-
104.131.62.48:8080
-
185.148.168.15:8080
-
217.182.143.207:443
-
198.199.98.78:8080
-
103.82.248.59:7080
-
185.168.130.138:443
-
202.28.34.99:8080
-
59.148.253.194:443
-
37.59.209.141:8080
-
185.148.168.220:8080
-
54.37.228.122:443
-
85.214.67.203:8080
-
85.25.120.45:8080
-
118.98.72.86:443
-
103.42.58.120:7080
-
78.47.204.80:443
-
202.134.4.210:7080
-
93.104.209.107:8080
-
2.58.16.87:8080
-
62.171.178.147:8080
-
45.71.195.104:8080
-
116.124.128.206:8080
-
191.252.103.16:80
-
54.37.106.167:8080
-
88.217.172.165:8080
-
54.38.242.185:443
-
210.57.209.142:8080
-
159.69.237.188:443
eck1.plain
ecs1.plain
Signatures
- suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
- Drops file in Windows directory 56 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\Download\d341f4322500ef92547a141039af2d20\o\egfDu3QHOC\BIT543F.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d341f4322500ef92547a141039af2d20\BIT6664.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d341f4322500ef92547a141039af2d20\BIT5693.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d341f4322500ef92547a141039af2d20\BIT54DC.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\BIT1E39.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\CsA9z1\SlUHUPO8bKnA\5ondRmJ90JlkPETuN535TWk= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\BIT1619.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\c3ca3df6b0660cc02fa0c60992eb1164c186b223 svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\CsA9z1\SlUHUPO8bKnA\BIT83FE.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\fbaaae7103d0f0a1303a40d280aa18bafcd08dcf svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\BIT3E5E.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\BIT122D.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\BIT12BC.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\BIT290B.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\BIT2D24.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d341f4322500ef92547a141039af2d20\o\egfDu3QHOC\Xbfe7KpvVnvJHxQ2cRDBmUlnoMnpDY= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\BIT8558.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\BIT3479.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\BIT1103.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\F2WKV54ysEMEW9U+EfiUeJcNcgfNL4pMC5NmE0a3mAg= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\BIT1DBB.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\BIT4333.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\BIT43D1.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\6\BIT4BE0.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\Cmn5TH6S2lFFnfMN8MLr2EoNUIAGzQo2UUjHGMEC99A= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\9+dL4Puh6FM8puPxsBEX86BMeGqpuC0b7gf2fD9DLLo= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\BIT159B.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\Jda7di8befpfPWz3DrhkMwwJL9XbuL8\fDFnweOZvFE= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\6e15245aed25ee83b027521f9cf9ea812c9d016d svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\f3535a3b47819a04c6d5ee18905493be086e801e svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\af66e12c1bb9d8519da21259d0fcd88c247cb4f1 svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\BIT28EB.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\BIT3FA8.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BIT8519.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\daNJ9YVgpN191GzoPynRDpTEDO9uUytOK6Ln7xcN8To= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\6\BIT3DA1.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d341f4322500ef92547a141039af2d20\2cd32031792245e69c7777193005916861cbbe94 svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d341f4322500ef92547a141039af2d20\o\egfDu3QHOC\BIT55F6.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\e1a85885fd4453165061351651289cce8f8590c4 svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\6\v9GXr9MSfUt92b0dEpOsHH2H0TwcnvKmtIW8g3ovM= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\BIT3F78.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BIT82C5.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\612ad442b8740f4c57b8c84e6bf465ba4699118c svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\YZBnsYBVNBTl3Isrrjy7P0\BIT287C.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\YZBnsYBVNBTl3Isrrjy7P0\FTTOLXxEZk0li+ZNE2Uo= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\BITA6B.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\d9f2a302574bf135efc9dbd1a8083a336f7f52f0 svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\Jda7di8befpfPWz3DrhkMwwJL9XbuL8\BIT2C58.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\BIT4C5E.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d341f4322500ef92547a141039af2d20\o\egfDu3QHOC\BIT65A8.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\BIT129B.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BIT17F.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\CsA9z1\SlUHUPO8bKnA\BIT9ED.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\Jda7di8befpfPWz3DrhkMwwJL9XbuL8\BIT2714.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\YZBnsYBVNBTl3Isrrjy7P0\BIT33FB.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BIT101.tmp svchost.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1388 regsvr32.exe 1388 regsvr32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4472 wrote to memory of 1388 4472 regsvr32.exe 83 PID 4472 wrote to memory of 1388 4472 regsvr32.exe 83 PID 4472 wrote to memory of 1388 4472 regsvr32.exe 83
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\9d7c337f2d55a1b5c1c29341d113ad90ba1e870be028fcf44a2c88f0baf2bbc5.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\9d7c337f2d55a1b5c1c29341d113ad90ba1e870be028fcf44a2c88f0baf2bbc5.dll2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1388
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Drops file in Windows directory
PID:2696
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵PID:1432