Analysis
-
max time kernel
144s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06-04-2023 05:47
Static task
static1
Behavioral task
behavioral1
Sample
P0JtPRKKCREP.dll
Resource
win7-20230220-en
General
-
Target
P0JtPRKKCREP.dll
-
Size
525.5MB
-
MD5
1b90c8c4f02ecc6637186127ed3d10b9
-
SHA1
6422278a0347e618c4e9936fd95182389b3b7ef6
-
SHA256
3cb46a4056e6ac1c5f605003334e215526c4cb6d07da1eca187c620e958eaf2a
-
SHA512
e89e4b4e3d217e61480aeb307097e40b62b137b5824ccf7b1ed923f13a00f3d1703a45c030973918b35787621c93f9e3127cd4f6e56a78275e63727519010383
-
SSDEEP
6144:ZS+strpYZOLnN6zBiWmLcipbxTV5bEgWrhTmi3ve2vof2PPMIf39yeuLcLwdi:ZbapYTiDcidxTJUdpe2vofQMIfUb
Malware Config
Extracted
emotet
Epoch4
164.68.99.3:8080
164.90.222.65:443
186.194.240.217:443
1.234.2.232:8080
103.75.201.2:443
187.63.160.88:80
147.139.166.154:8080
91.207.28.33:8080
5.135.159.50:443
153.92.5.27:8080
213.239.212.5:443
103.43.75.120:443
159.65.88.10:8080
167.172.253.162:8080
153.126.146.25:7080
119.59.103.152:8080
107.170.39.149:8080
183.111.227.137:8080
159.89.202.34:443
110.232.117.186:8080
129.232.188.93:443
172.105.226.75:8080
197.242.150.244:8080
188.44.20.25:443
66.228.32.31:7080
91.121.146.47:8080
202.129.205.3:8080
45.176.232.124:443
160.16.142.56:8080
94.23.45.86:4143
95.217.221.146:8080
72.15.201.15:8080
167.172.199.165:8080
115.68.227.76:8080
139.59.126.41:443
185.4.135.165:8080
79.137.35.198:8080
206.189.28.199:8080
163.44.196.120:8080
201.94.166.162:443
104.168.155.143:8080
173.212.193.249:8080
45.235.8.30:8080
169.57.156.166:8080
149.56.131.28:8080
182.162.143.56:443
103.132.242.26:8080
82.223.21.224:8080
Signatures
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 2000 regsvr32.exe 1148 regsvr32.exe 1148 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 2000 regsvr32.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
regsvr32.exedescription pid process target process PID 2000 wrote to memory of 1148 2000 regsvr32.exe regsvr32.exe PID 2000 wrote to memory of 1148 2000 regsvr32.exe regsvr32.exe PID 2000 wrote to memory of 1148 2000 regsvr32.exe regsvr32.exe PID 2000 wrote to memory of 1148 2000 regsvr32.exe regsvr32.exe PID 2000 wrote to memory of 1148 2000 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\P0JtPRKKCREP.dll1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\XDtVntURcAKobXJ\qvjYorNRV.dll"2⤵
- Suspicious behavior: EnumeratesProcesses