ef9c972e3960794289a1f79098aa7f3d959b29ffce0be9a2d6858a755a2171c3.dll
314KB
23-06-2022 15:06
behavioral1
0f2eee2f055783636d6cf640e148d95b
f1a0a2fc147fad58e57c4d74f8ed768afbc7fc4d
ef9c972e3960794289a1f79098aa7f3d959b29ffce0be9a2d6858a755a2171c3
3cc11426e4d8ca9ba061b040906039d9c0cfd43af988e4df420c5c403de080c19f7e69cfe8014f2ad58d1f2872d2d3229a8ebd3859f6c8f07bf191c68a2e502c
Extracted
Family | emotet |
Botnet | Epoch4 |
C2 |
82.165.152.127:8080 51.161.73.194:443 103.75.201.2:443 5.9.116.246:8080 213.241.20.155:443 79.137.35.198:8080 119.193.124.41:7080 186.194.240.217:443 172.105.226.75:8080 150.95.66.124:8080 131.100.24.231:80 94.23.45.86:4143 209.97.163.214:443 206.189.28.199:8080 173.212.193.249:8080 153.126.146.25:7080 51.91.76.89:8080 1.234.2.232:8080 163.44.196.120:8080 149.56.131.28:8080 146.59.226.45:443 45.118.115.99:8080 139.162.113.169:8080 196.218.30.83:443 212.24.98.99:8080 115.68.227.76:8080 64.227.100.222:8080 207.148.79.14:8080 209.126.98.206:8080 151.106.112.196:8080 45.186.16.18:443 167.172.253.162:8080 160.16.142.56:8080 72.15.201.15:8080 158.69.222.101:443 91.207.28.33:8080 103.70.28.102:8080 185.4.135.165:8080 144.91.78.55:443 82.223.21.224:8080 45.235.8.30:8080 135.148.6.80:443 188.44.20.25:443 101.50.0.91:8080 46.55.222.11:443 159.89.202.34:443 134.122.66.193:8080 45.176.232.124:443 164.68.99.3:8080 103.43.75.120:443 |
eck1.plain |
|
ecs1.plain |
|
Filter: none
-
Emotet
Description
Emotet is a trojan that is primarily spread through spam emails.
Tags
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
Description
suricata: ET MALWARE W32/Emotet CnC Beacon 3
Tags
-
Suspicious behavior: EnumeratesProcessesregsvr32.exeregsvr32.exe
Reported IOCs
pid process 2372 regsvr32.exe 2372 regsvr32.exe 2712 regsvr32.exe 2712 regsvr32.exe 2712 regsvr32.exe 2712 regsvr32.exe -
Suspicious behavior: RenamesItselfregsvr32.exe
Reported IOCs
pid process 2372 regsvr32.exe -
Suspicious use of WriteProcessMemoryregsvr32.exe
Reported IOCs
description pid process target process PID 2372 wrote to memory of 2712 2372 regsvr32.exe regsvr32.exe PID 2372 wrote to memory of 2712 2372 regsvr32.exe regsvr32.exe
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\ef9c972e3960794289a1f79098aa7f3d959b29ffce0be9a2d6858a755a2171c3.dllSuspicious behavior: EnumeratesProcessesSuspicious behavior: RenamesItselfSuspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\DpeAvoR\DSRrXdVPAMGZs.dll"Suspicious behavior: EnumeratesProcesses
-
memory/2372-118-0x0000000180000000-0x000000018002B000-memory.dmp
-
memory/2712-123-0x0000000000000000-mapping.dmp