Analysis
- max time kernel
147s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
13/11/2024, 17:59
General
- Target 0542c4f7fd769069a1e6c393c7757867d479d3610c04d9ba47b5d820e508ce2d.dll
- Size 790KB
- Sample241113-wk361axall
- SHA256 0542c4f7fd769069a1e6c393c7757867d479d3610c04d9ba47b5d820e508ce2d
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch5
C2
-
178.238.225.252:8080
-
139.196.72.155:8080
-
36.67.23.59:443
-
103.56.149.105:8080
-
37.44.244.177:8080
-
85.25.120.45:8080
-
202.134.4.210:7080
-
78.47.204.80:443
-
83.229.80.93:8080
-
93.104.209.107:8080
-
80.211.107.116:8080
-
165.22.254.236:8080
-
104.244.79.94:443
-
185.148.169.10:8080
-
190.145.8.4:443
-
175.126.176.79:8080
-
139.59.80.108:8080
-
188.165.79.151:443
-
128.199.217.206:443
-
64.227.55.231:8080
ecs1.plain
eck1.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Emotet family
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0542c4f7fd769069a1e6c393c7757867d479d3610c04d9ba47b5d820e508ce2d.dll1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\GxkDBL\yaelSAnO.dll"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4904-0-0x0000000180000000-0x0000000180030000-memory.dmp
memory/4904-3-0x0000000002EE0000-0x0000000002EE1000-memory.dmp
memory/4904-7-0x0000000010000000-0x00000000100D0000-memory.dmp