Analysis
-
max time kernel
63s -
max time network
62s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
25-07-2022 02:08
Static task
static1
Behavioral task
behavioral1
Sample
tncwuhQg.dll
Resource
win7-20220718-en
General
-
Target
tncwuhQg.dll
-
Size
831KB
-
MD5
5db19f199060ec4c4764b153564802fa
-
SHA1
f76467826dd3cf9425d3e4f61ea7e5d3b31ce61f
-
SHA256
0345962776ac02ef8713840de7fb82d81b8e786d4a9a5c14c4d3cd1f8618bb4d
-
SHA512
d52297dbdf70d784f3d1576ad7c7897caa069c4cfb4e6de4fefdfb78fe63ae5920d141cac90ef4d3e327669ba7380af91b9abc289e2faa12121740e014c57cb8
Malware Config
Extracted
emotet
Epoch5
103.71.99.57:8080
103.224.241.74:8080
157.245.111.0:8080
37.44.244.177:8080
103.41.204.169:8080
64.227.55.231:8080
103.254.12.236:7080
103.85.95.4:8080
157.230.99.206:8080
165.22.254.236:8080
85.214.67.203:8080
54.37.228.122:443
195.77.239.39:8080
128.199.217.206:443
190.145.8.4:443
165.232.185.110:8080
188.165.79.151:443
178.62.112.199:8080
54.37.106.167:8080
104.244.79.94:443
43.129.209.178:443
87.106.97.83:7080
202.134.4.210:7080
178.238.225.252:8080
198.199.70.22:8080
62.171.178.147:8080
175.126.176.79:8080
128.199.242.164:8080
88.217.172.165:8080
104.248.225.227:8080
85.25.120.45:8080
139.196.72.155:8080
188.225.32.231:4143
202.29.239.162:443
103.126.216.86:443
210.57.209.142:8080
93.104.209.107:8080
196.44.98.190:8080
5.253.30.17:7080
46.101.98.60:8080
103.56.149.105:8080
190.107.19.179:443
139.59.80.108:8080
36.67.23.59:443
78.47.204.80:443
83.229.80.93:8080
174.138.33.49:7080
118.98.72.86:443
37.187.114.15:8080
202.28.34.99:8080
Signatures
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 1660 regsvr32.exe 1152 regsvr32.exe 1152 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 1660 regsvr32.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1660 wrote to memory of 1152 1660 regsvr32.exe regsvr32.exe PID 1660 wrote to memory of 1152 1660 regsvr32.exe regsvr32.exe PID 1660 wrote to memory of 1152 1660 regsvr32.exe regsvr32.exe PID 1660 wrote to memory of 1152 1660 regsvr32.exe regsvr32.exe PID 1660 wrote to memory of 1152 1660 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\tncwuhQg.dll1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\XFPGKCJsBrn\bVVSuHN.dll"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1152