Behavioral Report

max time kernel151s
max time network154s
platformwindows10_x64
resourcewin10-20220414-en
submitted21-05-2022 19:38

Report
Files
Registry
Network
Processes
Mutex
Misc

Target

da95fae94aebb122318447f4d19a14c90d557e23d58b0b7a6b35d88e3b2b0a58.dll

Filesize

356KB

Completed

21-05-2022 19:41

Task

behavioral1

Score

10^/10

MD5

094ce225b0efad269ff86bedaa4ce8ae

SHA1

0237b25e1f775c9b0c4e9849ac01ca20b5fbfd2b

SHA256

da95fae94aebb122318447f4d19a14c90d557e23d58b0b7a6b35d88e3b2b0a58

SHA256

b1aeee08559442215d52e816c708345cea7b358d7ad8948754d1ccfc15e9cc5aa2e2ce5110a158129b8442ad7727dbb3d8aad8c026444e5348851d3e68daae13

emotet epoch4 banker suricata trojan

Extracted

Family	emotet
Botnet	Epoch4
C2	212.24.98.99:8080 51.91.76.89:8080 94.23.45.86:4143 101.50.0.91:8080 103.43.75.120:443 212.237.17.99:8080 158.69.222.101:443 51.254.140.238:7080 1.234.2.232:8080 91.207.28.33:8080 167.172.253.162:8080 45.235.8.30:8080 115.68.227.76:8080 134.122.66.193:8080 89.29.244.7:443 197.242.150.244:8080 164.68.99.3:8080 5.9.116.246:8080 1.234.21.73:7080 131.100.24.231:80 185.4.135.165:8080 72.15.201.15:8080 206.189.28.199:8080 203.114.109.124:443 149.56.131.28:8080 45.176.232.124:443 103.75.201.2:443 58.227.42.236:80 53.61.228.110:19290 172.104.251.154:8080 82.165.152.127:8080 45.118.115.99:8080 201.94.166.162:443 103.70.28.102:8080 213.241.20.155:443 129.232.188.93:443 146.59.226.45:443 173.82.82.196:8080 209.97.163.214:443 159.65.88.10:8080 159.65.140.115:443 160.16.142.56:8080 151.106.112.196:8080 107.170.39.149:8080 77.81.247.144:8080 173.239.37.178:8080 173.212.193.249:8080 163.44.196.120:8080 150.95.66.124:8080 152.136.229.39:8080 196.218.30.83:443 183.111.227.137:8080 119.193.124.41:7080 188.44.20.25:443 79.137.35.198:8080 102.222.215.74:443 110.232.117.186:8080 46.55.222.11:443 103.132.242.26:8080 159.89.202.34:443 153.126.146.25:7080 209.126.98.206:8080 82.223.21.224:8080 212.24.98.99:8080 51.91.76.89:8080 94.23.45.86:4143 101.50.0.91:8080 103.43.75.120:443 212.237.17.99:8080 158.69.222.101:443 51.254.140.238:7080 1.234.2.232:8080 91.207.28.33:8080 167.172.253.162:8080 45.235.8.30:8080 115.68.227.76:8080 134.122.66.193:8080 89.29.244.7:443 197.242.150.244:8080 164.68.99.3:8080 5.9.116.246:8080 1.234.21.73:7080 131.100.24.231:80 185.4.135.165:8080 72.15.201.15:8080 206.189.28.199:8080 203.114.109.124:443 149.56.131.28:8080 45.176.232.124:443 103.75.201.2:443 58.227.42.236:80 53.61.228.110:19290 172.104.251.154:8080 82.165.152.127:8080 45.118.115.99:8080 201.94.166.162:443 103.70.28.102:8080 213.241.20.155:443 129.232.188.93:443 146.59.226.45:443 173.82.82.196:8080 209.97.163.214:443 159.65.88.10:8080 159.65.140.115:443 160.16.142.56:8080 151.106.112.196:8080 107.170.39.149:8080 77.81.247.144:8080 173.239.37.178:8080 173.212.193.249:8080 163.44.196.120:8080 150.95.66.124:8080 152.136.229.39:8080 196.218.30.83:443 183.111.227.137:8080 119.193.124.41:7080 188.44.20.25:443 79.137.35.198:8080 102.222.215.74:443 110.232.117.186:8080 46.55.222.11:443 103.132.242.26:8080 159.89.202.34:443 153.126.146.25:7080 209.126.98.206:8080 82.223.21.224:8080
eck1.plain
eck1.plain

Emotet

Description

Emotet is a trojan that is primarily spread through spam emails.

Tags

trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3

Description

suricata: ET MALWARE W32/Emotet CnC Beacon 3

Tags

suricata
Suspicious behavior: EnumeratesProcesses
regsvr32.exe

Reported IOCs

pid process

1392 regsvr32.exe
1392 regsvr32.exe
Suspicious behavior: RenamesItself
regsvr32.exe

Reported IOCs

pid process

3932 regsvr32.exe

pid	process
1392	regsvr32.exe
1392	regsvr32.exe

pid	process
3932	regsvr32.exe

Suspicious use of WriteProcessMemory

regsvr32.exe

Reported IOCs

description	pid	process	target process
PID 3932 wrote to memory of 1392	3932	regsvr32.exe	regsvr32.exe
PID 3932 wrote to memory of 1392	3932	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\da95fae94aebb122318447f4d19a14c90d557e23d58b0b7a6b35d88e3b2b0a58.dll

Suspicious behavior: RenamesItself
Suspicious use of WriteProcessMemory

PID:3932

C:\Windows\system32\regsvr32.exe

C:\Windows\system32\regsvr32.exe "C:\Windows\system32\TUOPyJDHFfLhsDn\bTbfEbmHW.dll"

Suspicious behavior: EnumeratesProcesses

PID:1392

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

00:00 00:00

memory/1392-121-0x0000000000000000-mapping.dmp

Download
memory/3932-116-0x0000000180000000-0x000000018002F000-memory.dmp

Download

Extracted

Filter: none

Description

Tags

Description

Tags

Reported IOCs

Reported IOCs

Reported IOCs

Title