Analysis
- max time kernel
90s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
10/06/2022, 18:06
General
- Target e47ea524edb55ffe17734fea5816eb2a.dll
- Size 577KB
- Sample220610-wpqfpseabp
- SHA256 b1ea6dfcf37b87ec63ae245b21d9ba63c1dd716b8e58bcd32e5617a02f9c205c
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch5
C2
-
78.47.204.80:443
-
62.171.178.147:8080
-
165.232.185.110:8080
-
103.41.204.169:8080
-
54.37.228.122:443
-
202.29.239.162:443
-
103.71.99.57:8080
-
64.227.55.231:8080
-
85.214.67.203:8080
-
139.196.72.155:8080
-
195.77.239.39:8080
-
202.28.34.99:8080
-
54.37.106.167:8080
-
103.126.216.86:443
-
68.183.91.111:8080
-
104.244.79.94:443
-
85.25.120.45:8080
-
116.124.128.206:8080
-
210.57.209.142:8080
-
103.85.95.4:8080
ecs1.plain
eck1.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\e47ea524edb55ffe17734fea5816eb2a.dll1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\MttzJl\FmXGUWweJt.dll"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1672-130-0x0000000002290000-0x000000000233A000-memory.dmp
memory/1672-132-0x0000000180000000-0x000000018002B000-memory.dmp