Analysis
-
max time kernel
109s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-06-2022 16:18
General
-
Target
qwbofuiz.dll
-
Size
664KB
-
MD5
5c8b15dfdd2f021a32f8f0372bd11c3e
-
SHA1
cb9ee23e2870751cfda17a689b8bddace918d506
-
SHA256
f7ab0e91e0a5e8b63612255501ef463653879d563a0672e892755ddf3bda0fd0
-
SHA512
e93ebaac8548e07a32e63f35e25aec5e531116f3d40e04fda059793ec78ed3b49ffe23e34732e74fa6aeeeaa4944bfab298844828fabe84fb131c022161e92de
Malware Config
Extracted
emotet
Epoch4
149.56.128.192:443
120.50.40.183:80
160.16.218.63:8080
217.182.25.250:8080
119.193.124.41:7080
103.75.201.2:443
195.201.151.129:8080
131.100.24.231:80
159.65.88.10:8080
1.234.21.73:7080
5.9.116.246:8080
103.75.201.4:443
176.104.106.96:8080
138.185.72.26:8080
212.237.17.99:8080
72.15.201.15:8080
103.43.46.182:443
207.38.84.195:8080
46.55.222.11:443
1.234.2.232:8080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\qwbofuiz.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\qwbofuiz.dll2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
160KB
-
Filesize
144KB
-
Filesize
8KB