Analysis
- max time kernel
156s - max time network
165s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
07/12/2022, 16:14
General
- Target 08b6fb7223b01f7691702bb9dd8322f04e0af6ea6676bf710353031a6f3ab02f.dll
- Size 549KB
- Sample221207-tpxtnsfd42
- SHA256 08b6fb7223b01f7691702bb9dd8322f04e0af6ea6676bf710353031a6f3ab02f
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch4
C2
-
176.31.73.90:443
-
45.76.159.214:8080
-
138.197.147.101:443
-
104.168.154.79:8080
-
149.56.131.28:8080
-
5.9.116.246:8080
-
77.81.247.144:8080
-
172.104.251.154:8080
-
50.30.40.196:8080
-
173.212.193.249:8080
-
51.91.76.89:8080
-
197.242.150.244:8080
-
103.75.201.2:443
-
51.254.140.238:7080
-
79.137.35.198:8080
-
72.15.201.15:8080
-
27.54.89.58:8080
-
189.126.111.200:7080
-
196.218.30.83:443
-
82.165.152.127:8080
eck1.plain
ecs1.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\08b6fb7223b01f7691702bb9dd8322f04e0af6ea6676bf710353031a6f3ab02f.dll1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2676-132-0x0000000002610000-0x000000000263B000-memory.dmp