Analysis
- max time kernel
143s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
22/04/2022, 14:55
General
- Target 9dbe1dc9cf3e8e8f79ffb4691318ca7b.dll
- Size 626KB
- Sample220422-sae5msdbc8
- SHA256 4d6628437efb92cc85a1eaac5e7e863efc7e23cd52311b197deb13c9adfeb5a2
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch4
C2
-
138.201.142.73:8080
-
138.197.147.101:443
-
134.195.212.50:7080
-
104.168.154.79:8080
-
149.56.131.28:8080
-
129.232.188.93:443
-
212.24.98.99:8080
-
119.193.124.41:7080
-
45.118.115.99:8080
-
188.44.20.25:443
-
103.132.242.26:8080
-
201.94.166.162:443
-
1.234.21.73:7080
-
206.189.28.199:8080
-
185.8.212.130:7080
-
82.165.152.127:8080
-
176.104.106.96:8080
-
173.212.193.249:8080
-
167.99.115.35:8080
-
209.126.98.206:8080
eck1.plain
ecs1.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Loads dropped DLL 1 IoCs
- Drops file in System32 directory 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\9dbe1dc9cf3e8e8f79ffb4691318ca7b.dll1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\Tpvgoida\cblobznitisk.unn"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
cblobznitisk.unn
memory/3460-130-0x0000000180000000-0x000000018002A000-memory.dmp