Analysis
-
max time kernel
137s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
17-06-2022 11:24
General
-
Target
B6WKOjnuXAYdMsKINoPp4KZA7IPg.dll
-
Size
518KB
-
MD5
b38d88e3af1b47c90358f3a47f90a3db
-
SHA1
143478e2d859486522db651777ed6cfba1c2d5c8
-
SHA256
cd54167bf79900d2875cbd985d19fe4016bbb5af517280e9d705bdb885bd2300
-
SHA512
9ac499034d3e6211c24854bc91dc4c65976c36de0843c7e94118b153fce00c105c5c634f5c4f42d48908c7930d826f7f4d11be09fae1b96968e9722cdb81f3bc
Malware Config
Extracted
emotet
149.56.131.28:8080
72.15.201.15:8080
207.148.79.14:8080
82.165.152.127:8080
46.55.222.11:443
213.241.20.155:443
163.44.196.120:8080
51.254.140.238:7080
107.170.39.149:8080
188.44.20.25:443
82.223.21.224:8080
172.104.251.154:8080
164.68.99.3:8080
101.50.0.91:8080
129.232.188.93:443
173.212.193.249:8080
103.132.242.26:8080
186.194.240.217:443
37.187.115.122:8080
91.207.28.33:8080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\B6WKOjnuXAYdMsKINoPp4KZA7IPg.dll1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\LPnVBiFbyhUURour\ruDDOtZXimy.dll"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB