Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    52s
  • max time network
    102s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/11/2022, 00:35 UTC

General

  • Target

    c36b400e4aa5750e0bbd0b1ecf2666dbd6ae6d23cad083edfefcd13c7199f216.dll

  • Size

    745KB

  • MD5

    dea12ccba33b15ea9cdf862835e0dbe6

  • SHA1

    bd7bb1bc7b021a6fac50bcfd73c7c2f66d0c20ff

  • SHA256

    c36b400e4aa5750e0bbd0b1ecf2666dbd6ae6d23cad083edfefcd13c7199f216

  • SHA512

    c88c73da34e26701e2ca48dd65a9d9101c50abcc7c2a99fb6aeda0ddb628d39678430fd6495d7896debe90ca2ba5f8d887593077a2a6d85beff3775a6479009a

  • SSDEEP

    6144:i5htEuwPCwdooxhXLY/3tvDc2YLV9yWoPTvtQPZOBk8Dv1yGj/eoyOyqTJDrRtFw:EaCwpDXstOby/ZQPrTGbWEJDDFY1cA

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

45.235.8.30:8080

94.23.45.86:4143

119.59.103.152:8080

169.60.181.70:8080

164.68.99.3:8080

172.105.226.75:8080

107.170.39.149:8080

206.189.28.199:8080

1.234.2.232:8080

188.44.20.25:443

186.194.240.217:443

103.43.75.120:443

149.28.143.92:443

159.89.202.34:443

209.97.163.214:443

183.111.227.137:8080

129.232.188.93:443

139.59.126.41:443

110.232.117.186:8080

139.59.56.73:8080

eck1.plain
1
-----BEGIN PUBLIC KEY-----
2
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE86M1tQ4uK/Q1Vs0KTCk+fPEQ3cuw
3
TyCz+gIgzky2DB5Elr60DubJW5q9Tr2dj8/gEFs0TIIEJgLTuqzx+58sdg==
4
-----END PUBLIC KEY-----
ecs1.plain
1
-----BEGIN PUBLIC KEY-----
2
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEQF90tsTY3Aw9HwZ6N9y5+be9Xoov
3
pqHyD6F5DRTl9THosAoePIs/e5AdJiYxhmV8Gq3Zw1ysSPBghxjZdDxY+Q==
4
-----END PUBLIC KEY-----

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c36b400e4aa5750e0bbd0b1ecf2666dbd6ae6d23cad083edfefcd13c7199f216.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2836
    • C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MIuOPmhXhGVlbP\uQcwBgwxnldOkyO.dll"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:3388

Network

  • flag-kr
    GET
    https://182.162.143.56/
    regsvr32.exe
    Remote address:
    182.162.143.56:443
    Request
    GET / HTTP/1.1
    Connection: Keep-Alive
    Cookie: ZC=ommgjMwp5dCbBruAG/qcYL1amHltyRBRRuUZx4bi2LmWL1aZhZzW6e3la/w4RLspcoPQZV+Yi2fYlUpBr3LcB/zw/dBy/ky9hXdPbvVuwQ5odEHo09SJisWEQ683LsIs+3Xkpr8Hcruy1Buc8rnDbAp5SpFogAXhQgSuuXhRl6d9WHhXWUANkk4E+KDPwMjXgm64R0KbHJ0XwwCDh/u+niqZ
    Host: 182.162.143.56
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Fri, 04 Nov 2022 00:36:01 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • 182.162.143.56:443
    https://182.162.143.56/
    tls, http
    regsvr32.exe
    1.1kB
    2.7kB
    11
    11

    HTTP Request

    GET https://182.162.143.56/

    HTTP Response

    200
  • 52.168.117.169:443
    322 B
    7
  • 8.253.208.121:80
    322 B
    7
No results found

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2836-115-0x0000000180000000-0x000000018002F000-memory.dmp

    Filesize

    188KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.