Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
03-12-2021 13:27
Static task
static1
Behavioral task
behavioral1
Sample
e4-20211203-01.dll
Resource
win7-en-20211014
General
-
Target
e4-20211203-01.dll
-
Size
1.1MB
-
MD5
2f93cb3701205b257b8ef5e76545923b
-
SHA1
c53d45e900d52a0a4802f858ac94a10bdbff3d15
-
SHA256
16211b428f9d5da08b3a0d77589bf217f34558388d52d294f7d37dfe5e44b2e0
-
SHA512
2c095cce1927a872f66457b18d4f8d71cb62af05dbfd8fef930959f9cebeada93557acf11218b5d9798f59f4de565cec7b86c03410d7bf68249ccd5f86625095
Malware Config
Extracted
emotet
Epoch4
172.104.227.98:443
31.207.89.74:8080
46.55.222.11:443
41.76.108.46:8080
103.8.26.103:8080
185.184.25.237:8080
103.8.26.102:8080
203.114.109.124:443
45.118.115.99:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
192.254.71.210:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
212.237.17.99:8080
212.237.56.116:7080
216.158.226.206:443
110.232.117.186:8080
158.69.222.101:443
107.182.225.142:8080
176.104.106.96:8080
81.0.236.90:443
50.116.54.215:443
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 268 wrote to memory of 432 268 regsvr32.exe regsvr32.exe PID 268 wrote to memory of 432 268 regsvr32.exe regsvr32.exe PID 268 wrote to memory of 432 268 regsvr32.exe regsvr32.exe PID 268 wrote to memory of 432 268 regsvr32.exe regsvr32.exe PID 268 wrote to memory of 432 268 regsvr32.exe regsvr32.exe PID 268 wrote to memory of 432 268 regsvr32.exe regsvr32.exe PID 268 wrote to memory of 432 268 regsvr32.exe regsvr32.exe PID 432 wrote to memory of 1120 432 regsvr32.exe rundll32.exe PID 432 wrote to memory of 1120 432 regsvr32.exe rundll32.exe PID 432 wrote to memory of 1120 432 regsvr32.exe rundll32.exe PID 432 wrote to memory of 1120 432 regsvr32.exe rundll32.exe PID 432 wrote to memory of 1120 432 regsvr32.exe rundll32.exe PID 432 wrote to memory of 1120 432 regsvr32.exe rundll32.exe PID 432 wrote to memory of 1120 432 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\e4-20211203-01.dll1⤵
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\e4-20211203-01.dll2⤵
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\e4-20211203-01.dll",DllRegisterServer3⤵PID:1120
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/268-55-0x000007FEFBB21000-0x000007FEFBB23000-memory.dmpFilesize
8KB
-
memory/432-56-0x0000000000000000-mapping.dmp
-
memory/432-57-0x0000000076431000-0x0000000076433000-memory.dmpFilesize
8KB
-
memory/432-60-0x0000000010000000-0x0000000010027000-memory.dmpFilesize
156KB
-
memory/1120-58-0x0000000000000000-mapping.dmp