Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
07-12-2021 12:58
Static task
static1
General
-
Target
203df7960dd7a0f1c8cc77b4e9eb84486d9b0e447e658444c3c7700d5a29e718.dll
-
Size
749KB
-
MD5
bc097c7537cc0b6756950d190c6b2f9a
-
SHA1
4577890226b13444ff659647f8d5a3f1a1e7f789
-
SHA256
203df7960dd7a0f1c8cc77b4e9eb84486d9b0e447e658444c3c7700d5a29e718
-
SHA512
f88766620da875a8ca9599ac21fbb427b8bdd4bdd343f6044e3f431a2d16488af51fbfa856138966c8bc7d5c7d7e60e9311aae24417dd6ee95af6f1623fda961
Malware Config
Extracted
emotet
Epoch5
209.239.112.82:8080
116.124.128.206:8080
45.63.5.129:443
128.199.192.135:8080
51.178.61.60:443
168.197.250.14:80
177.72.80.14:7080
51.210.242.234:8080
142.4.219.173:8080
78.47.204.80:443
78.46.73.125:443
37.44.244.177:8080
37.59.209.141:8080
104.131.62.48:8080
190.90.233.66:443
185.148.168.220:8080
185.148.168.15:8080
62.171.178.147:8080
191.252.103.16:80
54.38.242.185:443
85.214.67.203:8080
217.182.143.207:443
159.69.237.188:443
210.57.209.142:8080
54.37.228.122:443
207.148.81.119:8080
195.77.239.39:8080
66.42.57.149:443
195.154.146.35:443
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 3112 wrote to memory of 3404 3112 regsvr32.exe regsvr32.exe PID 3112 wrote to memory of 3404 3112 regsvr32.exe regsvr32.exe PID 3112 wrote to memory of 3404 3112 regsvr32.exe regsvr32.exe PID 3404 wrote to memory of 3788 3404 regsvr32.exe rundll32.exe PID 3404 wrote to memory of 3788 3404 regsvr32.exe rundll32.exe PID 3404 wrote to memory of 3788 3404 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\203df7960dd7a0f1c8cc77b4e9eb84486d9b0e447e658444c3c7700d5a29e718.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\203df7960dd7a0f1c8cc77b4e9eb84486d9b0e447e658444c3c7700d5a29e718.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\203df7960dd7a0f1c8cc77b4e9eb84486d9b0e447e658444c3c7700d5a29e718.dll",DllRegisterServer3⤵