Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
07-12-2021 12:58
Static task
static1
General
-
Target
6e4f3c45ee49f4e286637215334b117aac6725f3a44fc5447a93dcc4c6d8f62f.dll
-
Size
749KB
-
MD5
1eb9391ae76e3011fd642b28e90168eb
-
SHA1
c14fa4e0a78df26023f32aff157b5c42887e19b4
-
SHA256
6e4f3c45ee49f4e286637215334b117aac6725f3a44fc5447a93dcc4c6d8f62f
-
SHA512
4b3324e2d3eb84679669e1d33491c8957a82915f76ee10f462fc3527e52bbe9743cad64183c25cb318f1d6644103c653db5347d4e179b3232d5ffde9c386040b
Malware Config
Extracted
emotet
Epoch5
209.239.112.82:8080
116.124.128.206:8080
45.63.5.129:443
128.199.192.135:8080
51.178.61.60:443
168.197.250.14:80
177.72.80.14:7080
51.210.242.234:8080
142.4.219.173:8080
78.47.204.80:443
78.46.73.125:443
37.44.244.177:8080
37.59.209.141:8080
104.131.62.48:8080
190.90.233.66:443
185.148.168.220:8080
185.148.168.15:8080
62.171.178.147:8080
191.252.103.16:80
54.38.242.185:443
85.214.67.203:8080
217.182.143.207:443
159.69.237.188:443
210.57.209.142:8080
54.37.228.122:443
207.148.81.119:8080
195.77.239.39:8080
66.42.57.149:443
195.154.146.35:443
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2700 wrote to memory of 2776 2700 regsvr32.exe regsvr32.exe PID 2700 wrote to memory of 2776 2700 regsvr32.exe regsvr32.exe PID 2700 wrote to memory of 2776 2700 regsvr32.exe regsvr32.exe PID 2776 wrote to memory of 3892 2776 regsvr32.exe rundll32.exe PID 2776 wrote to memory of 3892 2776 regsvr32.exe rundll32.exe PID 2776 wrote to memory of 3892 2776 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\6e4f3c45ee49f4e286637215334b117aac6725f3a44fc5447a93dcc4c6d8f62f.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\6e4f3c45ee49f4e286637215334b117aac6725f3a44fc5447a93dcc4c6d8f62f.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6e4f3c45ee49f4e286637215334b117aac6725f3a44fc5447a93dcc4c6d8f62f.dll",DllRegisterServer3⤵