Analysis
-
max time kernel
92s -
max time network
142s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
06-07-2022 04:13
General
-
Target
88cf3cef6eefd3cc643c7aa6b66813d1dcac58385eaa7866a237441e036abc2e.dll
-
Size
513KB
-
MD5
be46ef24bb270b9d6b0f04c52e263a07
-
SHA1
9a9b8d99181161e44a88e3a05112ef5f31e038c0
-
SHA256
88cf3cef6eefd3cc643c7aa6b66813d1dcac58385eaa7866a237441e036abc2e
-
SHA512
9d5751b26936e0d660e2768d67c48d791d540f46e088a1de4f3b35e866b14ea1a33ba426633c4ea3d183b9f06a1f36eaa4b2ee2364d34c0ef3162315b161494a
Malware Config
Extracted
emotet
Epoch4
94.23.45.86:4143
209.97.163.214:443
212.24.98.99:8080
103.43.75.120:443
183.111.227.137:8080
197.242.150.244:8080
129.232.188.93:443
159.65.88.10:8080
163.44.196.120:8080
51.161.73.194:443
164.90.222.65:443
159.89.202.34:443
1.234.2.232:8080
150.95.66.124:8080
51.91.76.89:8080
196.218.30.83:443
5.9.116.246:8080
146.59.226.45:443
173.212.193.249:8080
213.241.20.155:443
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\88cf3cef6eefd3cc643c7aa6b66813d1dcac58385eaa7866a237441e036abc2e.dll1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZxGyroSVEN\bitlUmk.dll"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2600-122-0x0000000000000000-mapping.dmp
-
memory/4412-117-0x0000000180000000-0x000000018002D000-memory.dmpFilesize
180KB