da95fae94aebb122318447f4d19a14c90d557e23d58b0b7a6b35d88e3b2b0a58.dll
356KB
21-05-2022 19:41
behavioral1
094ce225b0efad269ff86bedaa4ce8ae
0237b25e1f775c9b0c4e9849ac01ca20b5fbfd2b
da95fae94aebb122318447f4d19a14c90d557e23d58b0b7a6b35d88e3b2b0a58
b1aeee08559442215d52e816c708345cea7b358d7ad8948754d1ccfc15e9cc5aa2e2ce5110a158129b8442ad7727dbb3d8aad8c026444e5348851d3e68daae13
Extracted
Family | emotet |
Botnet | Epoch4 |
C2 |
212.24.98.99:8080 51.91.76.89:8080 94.23.45.86:4143 101.50.0.91:8080 103.43.75.120:443 212.237.17.99:8080 158.69.222.101:443 51.254.140.238:7080 1.234.2.232:8080 91.207.28.33:8080 167.172.253.162:8080 45.235.8.30:8080 115.68.227.76:8080 134.122.66.193:8080 89.29.244.7:443 197.242.150.244:8080 164.68.99.3:8080 5.9.116.246:8080 1.234.21.73:7080 131.100.24.231:80 185.4.135.165:8080 72.15.201.15:8080 206.189.28.199:8080 203.114.109.124:443 149.56.131.28:8080 45.176.232.124:443 103.75.201.2:443 58.227.42.236:80 53.61.228.110:19290 172.104.251.154:8080 82.165.152.127:8080 45.118.115.99:8080 201.94.166.162:443 103.70.28.102:8080 213.241.20.155:443 129.232.188.93:443 146.59.226.45:443 173.82.82.196:8080 209.97.163.214:443 159.65.88.10:8080 159.65.140.115:443 160.16.142.56:8080 151.106.112.196:8080 107.170.39.149:8080 77.81.247.144:8080 173.239.37.178:8080 173.212.193.249:8080 163.44.196.120:8080 150.95.66.124:8080 152.136.229.39:8080 |
eck1.plain |
|
eck1.plain |
|
Filter: none
-
Emotet
Description
Emotet is a trojan that is primarily spread through spam emails.
Tags
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
Description
suricata: ET MALWARE W32/Emotet CnC Beacon 3
Tags
-
Suspicious behavior: EnumeratesProcessesregsvr32.exe
Reported IOCs
pid process 1392 regsvr32.exe 1392 regsvr32.exe -
Suspicious behavior: RenamesItselfregsvr32.exe
Reported IOCs
pid process 3932 regsvr32.exe -
Suspicious use of WriteProcessMemoryregsvr32.exe
Reported IOCs
description pid process target process PID 3932 wrote to memory of 1392 3932 regsvr32.exe regsvr32.exe PID 3932 wrote to memory of 1392 3932 regsvr32.exe regsvr32.exe
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\da95fae94aebb122318447f4d19a14c90d557e23d58b0b7a6b35d88e3b2b0a58.dllSuspicious behavior: RenamesItselfSuspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\TUOPyJDHFfLhsDn\bTbfEbmHW.dll"Suspicious behavior: EnumeratesProcesses
-
memory/1392-121-0x0000000000000000-mapping.dmp
-
memory/3932-116-0x0000000180000000-0x000000018002F000-memory.dmp