Analysis
-
max time kernel
73s -
max time network
142s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
07-06-2022 12:43
General
-
Target
45a71f475b855fe65a1001d116ee57cc70ad9c3d95de7d3162a27c65d8033ebe.dll
-
Size
649KB
-
MD5
85dce7dad1d6d93cab5e8485861a1916
-
SHA1
c1e409584c0f6e997aa0d11f5853f2c97eb14a01
-
SHA256
45a71f475b855fe65a1001d116ee57cc70ad9c3d95de7d3162a27c65d8033ebe
-
SHA512
eeac8d23d1b6cce8cce43f1e6715cb7789a3244e612bb2ca255d82a1dadb93e59e174743133e6fa177f2c286eb20bf9aeaa399b1c95b47f1a7e721de6b36acf6
Malware Config
Extracted
emotet
Epoch4
94.23.45.86:4143
129.232.188.93:443
213.241.20.155:443
197.242.150.244:8080
172.104.251.154:8080
46.55.222.11:443
82.223.21.224:8080
5.9.116.246:8080
1.234.2.232:8080
146.59.226.45:443
160.16.142.56:8080
115.68.227.76:8080
72.15.201.15:8080
188.44.20.25:443
185.4.135.165:8080
103.132.242.26:8080
173.212.193.249:8080
163.44.196.120:8080
183.111.227.137:8080
149.56.131.28:8080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\45a71f475b855fe65a1001d116ee57cc70ad9c3d95de7d3162a27c65d8033ebe.dll1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\PdIfnWOV\esrYhkmbvQqJna.dll"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
676KB
-
Filesize
168KB
-