Analysis
- max time kernel
142s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
07/06/2022, 17:14
General
- Target 4cbb2b31d6e254496f9c75ffad0c7298.dll
- Size 653KB
- Sample220607-vrzaysdfb8
- SHA256 ab50facc4cc5c3b5d8e7f2ceb3bf956fe6cd5e2d5c469b033345573c657d2cab
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch5
C2
-
78.47.204.80:443
-
212.83.184.188:8080
-
36.67.23.59:443
-
128.199.217.206:443
-
103.56.149.105:8080
-
202.29.239.162:443
-
68.183.91.111:8080
-
104.244.79.94:443
-
64.227.55.231:8080
-
157.230.99.206:8080
-
165.232.185.110:8080
-
103.71.99.57:8080
-
103.126.216.86:443
-
88.217.172.165:8080
-
103.41.204.169:8080
-
87.106.97.83:7080
-
85.25.120.45:8080
-
188.225.32.231:4143
-
118.98.72.86:443
-
178.62.112.199:8080
eck1.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\4cbb2b31d6e254496f9c75ffad0c7298.dll1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\JEJXachxYEj\TFpnDsqta.dll"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/536-136-0x0000000001E90000-0x0000000001F3A000-memory.dmp
memory/3192-130-0x00000000020A0000-0x000000000214A000-memory.dmp
memory/3192-132-0x0000000180000000-0x000000018002B000-memory.dmp