Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
30-06-2022 16:10
Static task
static1
General
-
Target
d18742da424c59822f560c48ef07ccaa98f5d0a77d25b37f5643e1945b7cabf4.dll
-
Size
444KB
-
MD5
c8328db050bd6d4aeaa5ea790996ad47
-
SHA1
43d16a3fc7bac41ccc970ef3eeb913181bcf67aa
-
SHA256
d18742da424c59822f560c48ef07ccaa98f5d0a77d25b37f5643e1945b7cabf4
-
SHA512
610e0598dd3cb65c137a2ebffb8f266a85dc74d693fc214b62551c95eb2e660cfb30f64e10628c947dfbadee030a061de070c712c068009805e4e95449c3d801
Malware Config
Extracted
emotet
Epoch4
45.176.232.125:443
138.197.109.175:8080
187.84.80.182:443
79.143.187.147:443
189.232.46.161:443
103.70.28.102:8080
134.122.66.193:8080
151.106.112.196:8080
160.16.142.56:8080
212.24.98.99:8080
188.44.20.25:443
197.242.150.244:8080
206.189.28.199:8080
172.104.251.154:8080
103.43.46.182:443
203.114.109.124:443
103.75.201.2:443
58.227.42.236:80
201.94.166.162:443
189.126.111.200:7080
185.8.212.130:7080
167.99.115.35:8080
129.232.188.93:443
1.234.2.232:8080
153.126.146.25:7080
185.157.82.211:8080
131.100.24.231:80
1.234.21.73:7080
192.99.251.50:443
119.193.124.41:7080
159.8.59.82:8080
158.69.222.101:443
51.254.140.238:7080
5.9.116.246:8080
45.176.232.124:443
159.65.88.10:8080
101.50.0.91:8080
107.182.225.142:8080
167.172.253.162:8080
79.172.212.216:8080
50.30.40.196:8080
196.218.30.83:443
51.91.7.5:8080
212.237.17.99:8080
72.15.201.15:8080
183.111.227.137:8080
51.91.76.89:8080
209.250.246.206:443
176.104.106.96:8080
46.55.222.11:443
209.126.98.206:8080
164.68.99.3:8080
176.56.128.118:443
103.132.242.26:8080
110.232.117.186:8080
146.59.226.45:443
173.212.193.249:8080
82.165.152.127:8080
45.118.115.99:8080
216.158.226.206:443
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 848 regsvr32.exe 848 regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 3768 wrote to memory of 848 3768 regsvr32.exe regsvr32.exe PID 3768 wrote to memory of 848 3768 regsvr32.exe regsvr32.exe PID 3768 wrote to memory of 848 3768 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\d18742da424c59822f560c48ef07ccaa98f5d0a77d25b37f5643e1945b7cabf4.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\d18742da424c59822f560c48ef07ccaa98f5d0a77d25b37f5643e1945b7cabf4.dll2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/848-117-0x0000000000000000-mapping.dmp
-
memory/848-118-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-119-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-120-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-121-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-122-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-123-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-124-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-125-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-126-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-127-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-128-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-129-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-130-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-131-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-132-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-133-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-134-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-135-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-136-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-137-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-138-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-139-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-140-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-141-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-142-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-143-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-144-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-145-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-146-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-147-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-148-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-149-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-150-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-151-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-152-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-153-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-154-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-155-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-156-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-157-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-158-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-159-0x0000000000920000-0x0000000000944000-memory.dmpFilesize
144KB
-
memory/848-162-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-163-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-164-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-165-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-166-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-167-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-168-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-169-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-170-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-171-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-172-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-173-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-174-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-175-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/848-176-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB