ff8c629c77d14f9c25f39683dba8cc7367287c2cc26b4592cf234650275d27a5.dll
362KB
21-05-2022 19:34
behavioral1
75563e8bc6f8c4f0add81ba6f1c4dc91
9ba3eea533a9cc3ac0bf0211727b29a19061ac34
ff8c629c77d14f9c25f39683dba8cc7367287c2cc26b4592cf234650275d27a5
9ccd10258e0800c9f48c726536413a1ba52570ae822b4dfee036a20eddfcb793f5a2cdcaa3aa00b98d2d78d6863adad3a5999b6f86c652a0d2541a6f489bd1e9
Extracted
| Family | emotet |
| Botnet | Epoch5 |
| C2 |
194.9.172.107:8080 66.42.57.149:443 165.22.73.229:8080 202.29.239.162:443 76.189.152.228:1645 59.185.164.123:8382 115.19.43.159:30377 104.248.225.227:8080 54.38.242.185:443 103.133.214.242:8080 78.47.204.80:443 210.57.209.142:8080 103.41.204.169:8080 118.98.72.86:443 88.217.172.165:8080 87.106.97.83:7080 85.25.120.45:8080 195.77.239.39:8080 37.44.244.177:8080 36.67.23.59:443 93.41.142.108:30345 42.6.66.255:39545 160.16.143.191:7080 38.217.125.207:49663 54.38.143.246:7080 159.69.237.188:443 68.183.93.250:443 54.37.228.122:443 190.90.233.66:443 37.59.209.141:8080 29.146.139.51:30005 18.37.240.161:6409 178.62.112.199:8080 59.148.253.194:443 196.44.98.190:8080 79.235.8.209:58224 202.28.34.99:8080 78.46.73.125:443 51.68.141.164:8080 207.148.81.119:8080 93.104.209.107:8080 185.148.168.220:8080 100.21.231.107:63582 103.85.95.4:8080 62.171.178.147:8080 175.126.176.79:8080 134.122.119.23:8080 202.134.4.210:7080 116.124.128.206:8080 45.71.195.104:8080 |
| eck1.plain |
|
| eck1.plain |
|
Filter: none
-
Emotet
Description
Emotet is a trojan that is primarily spread through spam emails.
Tags
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
Description
suricata: ET MALWARE W32/Emotet CnC Beacon 3
Tags
-
Suspicious behavior: EnumeratesProcessesregsvr32.exe
Reported IOCs
pid process 2084 regsvr32.exe 2084 regsvr32.exe -
Suspicious behavior: RenamesItselfregsvr32.exe
Reported IOCs
pid process 424 regsvr32.exe -
Suspicious use of WriteProcessMemoryregsvr32.exe
Reported IOCs
description pid process target process PID 424 wrote to memory of 2084 424 regsvr32.exe regsvr32.exe PID 424 wrote to memory of 2084 424 regsvr32.exe regsvr32.exe
-
C:\Windows\system32\regsvr32.exePID:424regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ff8c629c77d14f9c25f39683dba8cc7367287c2cc26b4592cf234650275d27a5.dllSuspicious behavior: RenamesItselfSuspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exePID:2084C:\Windows\system32\regsvr32.exe "C:\Windows\system32\HicDueOKctUN\zMMelDcFaPRoyL.dll"Suspicious behavior: EnumeratesProcesses
-
memory/424-116-0x0000000180000000-0x0000000180031000-memory.dmp
-
memory/2084-121-0x0000000000000000-mapping.dmp