Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21/04/2022, 19:53
Static task
static1
Behavioral task
behavioral1
Sample
uccllzqv.dll
Resource
win7-20220414-en
General
-
Target
uccllzqv.dll
-
Size
664KB
-
MD5
5c8b15dfdd2f021a32f8f0372bd11c3e
-
SHA1
cb9ee23e2870751cfda17a689b8bddace918d506
-
SHA256
f7ab0e91e0a5e8b63612255501ef463653879d563a0672e892755ddf3bda0fd0
-
SHA512
e93ebaac8548e07a32e63f35e25aec5e531116f3d40e04fda059793ec78ed3b49ffe23e34732e74fa6aeeeaa4944bfab298844828fabe84fb131c022161e92de
Malware Config
Extracted
emotet
Epoch4
149.56.128.192:443
120.50.40.183:80
160.16.218.63:8080
217.182.25.250:8080
119.193.124.41:7080
103.75.201.2:443
195.201.151.129:8080
131.100.24.231:80
159.65.88.10:8080
1.234.21.73:7080
5.9.116.246:8080
103.75.201.4:443
176.104.106.96:8080
138.185.72.26:8080
212.237.17.99:8080
72.15.201.15:8080
103.43.46.182:443
207.38.84.195:8080
46.55.222.11:443
1.234.2.232:8080
101.50.0.91:8080
58.227.42.236:80
129.232.188.93:443
212.24.98.99:8080
158.69.222.101:443
51.254.140.238:7080
167.99.115.35:8080
197.242.150.244:8080
45.118.135.203:7080
50.30.40.196:8080
82.165.152.127:8080
103.221.221.247:8080
50.116.54.215:443
195.154.133.20:443
185.157.82.211:8080
45.176.232.124:443
176.56.128.118:443
107.182.225.142:8080
206.188.212.92:8080
45.142.114.231:8080
173.212.193.249:8080
153.126.146.25:7080
159.8.59.82:8080
31.24.158.56:8080
51.91.7.5:8080
164.68.99.3:8080
192.99.251.50:443
178.79.147.66:8080
110.232.117.186:8080
209.126.98.206:8080
188.44.20.25:443
216.158.226.206:443
146.59.226.45:443
45.118.115.99:8080
151.106.112.196:8080
79.172.212.216:8080
203.114.109.124:443
196.218.30.83:443
185.8.212.130:7080
189.126.111.200:7080
209.250.246.206:443
Signatures
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Loads dropped DLL 1 IoCs
pid Process 5024 regsvr32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Eeexihfsuqctg\ewfsmyny.miv regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5024 regsvr32.exe 5024 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3952 regsvr32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1900 wrote to memory of 3952 1900 regsvr32.exe 83 PID 1900 wrote to memory of 3952 1900 regsvr32.exe 83 PID 1900 wrote to memory of 3952 1900 regsvr32.exe 83 PID 3952 wrote to memory of 5024 3952 regsvr32.exe 84 PID 3952 wrote to memory of 5024 3952 regsvr32.exe 84 PID 3952 wrote to memory of 5024 3952 regsvr32.exe 84
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\uccllzqv.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\uccllzqv.dll2⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Eeexihfsuqctg\ewfsmyny.miv"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5024
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
664KB
MD55c8b15dfdd2f021a32f8f0372bd11c3e
SHA1cb9ee23e2870751cfda17a689b8bddace918d506
SHA256f7ab0e91e0a5e8b63612255501ef463653879d563a0672e892755ddf3bda0fd0
SHA512e93ebaac8548e07a32e63f35e25aec5e531116f3d40e04fda059793ec78ed3b49ffe23e34732e74fa6aeeeaa4944bfab298844828fabe84fb131c022161e92de