Analysis
-
max time kernel
74s -
max time network
147s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
09-06-2022 23:29
General
-
Target
ccb76fc936bef489d1a947e675ec9b3ea9800ddabf7a888c24f4386927a3daaf.dll
-
Size
664KB
-
MD5
945958b58306617cde346d9ed4f8c33c
-
SHA1
cd25656822e24856692e3ab9c54ccfe18a334f7d
-
SHA256
ccb76fc936bef489d1a947e675ec9b3ea9800ddabf7a888c24f4386927a3daaf
-
SHA512
9e0c8e9cac1a808849de37d1fc6ca2d82a941eeaeb2772bea61a15429c889e1f798b53e30cf5911fbe846ee73345c79f8a104f2f84211a011883c069f7cec73a
Malware Config
Extracted
emotet
Epoch4
149.56.128.192:443
120.50.40.183:80
160.16.218.63:8080
217.182.25.250:8080
119.193.124.41:7080
103.75.201.2:443
195.201.151.129:8080
131.100.24.231:80
159.65.88.10:8080
1.234.21.73:7080
5.9.116.246:8080
103.75.201.4:443
176.104.106.96:8080
138.185.72.26:8080
212.237.17.99:8080
72.15.201.15:8080
103.43.46.182:443
207.38.84.195:8080
46.55.222.11:443
1.234.2.232:8080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\ccb76fc936bef489d1a947e675ec9b3ea9800ddabf7a888c24f4386927a3daaf.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\ccb76fc936bef489d1a947e675ec9b3ea9800ddabf7a888c24f4386927a3daaf.dll2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
160KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB