Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
17/05/2022, 11:12
220517-na42jsdfdj 10Analysis
-
max time kernel
51s -
max time network
141s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
17/05/2022, 11:12
Static task
static1
General
-
Target
e77f43d40f2d83758a0cc564b67c80d8fe3f53842ebe2b57f081e0b5633dc528.dll
-
Size
422KB
-
MD5
f5b20538eb35feb985e579b07d3481f3
-
SHA1
186cb2c71f10f03bf0686031f1f34b61e72e4c1d
-
SHA256
e77f43d40f2d83758a0cc564b67c80d8fe3f53842ebe2b57f081e0b5633dc528
-
SHA512
3193d94d56439c15012cc574cc5351815dd3344e6dd418414031263f2c91515afcd900f07562c5ec7751c23ec561549dc289bfd829c5d9ef26a8e926e4692d54
Malware Config
Extracted
emotet
Epoch5
210.57.209.142:8080
103.56.149.105:8080
104.248.225.227:8080
102.210.135.187:23495
103.41.204.169:8080
175.126.176.79:8080
207.148.81.119:8080
72.4.161.141:54121
110.235.83.107:7080
54.38.242.185:443
103.133.214.242:8080
126.156.228.29:21905
88.217.172.165:8080
68.183.93.250:443
56.131.8.84:33519
159.69.237.188:443
51.68.141.164:8080
37.44.244.177:8080
49.94.121.99:37937
105.144.128.17:33675
54.37.228.122:443
68.183.91.111:8080
196.44.98.190:8080
78.47.204.80:443
37.59.209.141:8080
90.22.140.170:39576
116.124.128.206:8080
217.182.143.207:443
5.56.132.177:8080
93.104.209.107:8080
54.37.106.167:8080
134.122.119.23:8080
85.25.120.45:8080
59.148.253.194:443
139.196.72.155:8080
178.62.112.199:8080
103.8.26.17:8080
195.154.146.35:443
45.71.195.104:8080
103.42.58.120:7080
202.29.239.162:443
118.98.72.86:443
202.28.34.99:8080
60.40.175.21:56468
66.42.57.149:443
40.76.187.142:52746
190.90.233.66:443
194.9.172.107:8080
103.85.95.4:8080
185.148.168.220:8080
78.46.73.125:443
203.153.216.46:443
54.38.143.246:7080
62.171.178.147:8080
85.214.67.203:8080
195.77.239.39:8080
202.134.4.210:7080
36.67.23.59:443
59.173.56.126:59001
87.106.97.83:7080
188.225.32.231:4143
38.227.173.245:25619
69.67.98.54:54206
Signatures
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4468 regsvr32.exe 4468 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4320 regsvr32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4320 wrote to memory of 4468 4320 regsvr32.exe 69 PID 4320 wrote to memory of 4468 4320 regsvr32.exe 69
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\e77f43d40f2d83758a0cc564b67c80d8fe3f53842ebe2b57f081e0b5633dc528.dll1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\LLFNReJyTYDSF\tsWCHx.dll"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4468
-