8064d87e14c2e9e59b7bc7ebfd59d404a9e8ffb504c763e0444988aa5b717a30.dll
314KB
23-06-2022 15:15
behavioral1
50983cd6b8fd7e984a9a29c7d14073ab
4f9bb4c88455820177a16fd3c107a84859523741
8064d87e14c2e9e59b7bc7ebfd59d404a9e8ffb504c763e0444988aa5b717a30
2efda19a3dd161bb7a1dbc90c517f11d1acb49ec05cfd881ca3b786d09006d777cc5b06436b3d434586c8c239d2992cc86e130fb833e9e7662c6a3e85c986727
Extracted
Family | emotet |
Botnet | Epoch4 |
C2 |
82.165.152.127:8080 51.161.73.194:443 103.75.201.2:443 5.9.116.246:8080 213.241.20.155:443 79.137.35.198:8080 119.193.124.41:7080 186.194.240.217:443 172.105.226.75:8080 150.95.66.124:8080 131.100.24.231:80 94.23.45.86:4143 209.97.163.214:443 206.189.28.199:8080 173.212.193.249:8080 153.126.146.25:7080 51.91.76.89:8080 1.234.2.232:8080 163.44.196.120:8080 149.56.131.28:8080 146.59.226.45:443 45.118.115.99:8080 139.162.113.169:8080 196.218.30.83:443 212.24.98.99:8080 115.68.227.76:8080 64.227.100.222:8080 207.148.79.14:8080 209.126.98.206:8080 151.106.112.196:8080 45.186.16.18:443 167.172.253.162:8080 160.16.142.56:8080 72.15.201.15:8080 158.69.222.101:443 91.207.28.33:8080 103.70.28.102:8080 185.4.135.165:8080 144.91.78.55:443 82.223.21.224:8080 45.235.8.30:8080 135.148.6.80:443 188.44.20.25:443 101.50.0.91:8080 46.55.222.11:443 159.89.202.34:443 134.122.66.193:8080 45.176.232.124:443 164.68.99.3:8080 103.43.75.120:443 |
eck1.plain |
|
ecs1.plain |
|
Filter: none
-
Emotet
Description
Emotet is a trojan that is primarily spread through spam emails.
Tags
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
Description
suricata: ET MALWARE W32/Emotet CnC Beacon 3
Tags
-
Suspicious behavior: EnumeratesProcessesregsvr32.exeregsvr32.exe
Reported IOCs
pid process 2504 regsvr32.exe 2504 regsvr32.exe 2780 regsvr32.exe 2780 regsvr32.exe 2780 regsvr32.exe 2780 regsvr32.exe -
Suspicious behavior: RenamesItselfregsvr32.exe
Reported IOCs
pid process 2504 regsvr32.exe -
Suspicious use of WriteProcessMemoryregsvr32.exe
Reported IOCs
description pid process target process PID 2504 wrote to memory of 2780 2504 regsvr32.exe regsvr32.exe PID 2504 wrote to memory of 2780 2504 regsvr32.exe regsvr32.exe
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\8064d87e14c2e9e59b7bc7ebfd59d404a9e8ffb504c763e0444988aa5b717a30.dllSuspicious behavior: EnumeratesProcessesSuspicious behavior: RenamesItselfSuspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\FrbDfyJmuTqIAv\YvDIHsR.dll"Suspicious behavior: EnumeratesProcesses
-
memory/2504-118-0x0000000180000000-0x000000018002B000-memory.dmp
-
memory/2780-123-0x0000000000000000-mapping.dmp