Analysis
-
max time kernel
110s -
max time network
110s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
11-12-2021 07:02
Static task
static1
General
-
Target
328c3b29b881ca5e2caf86e985afdbdb6744d5b001ee870289c8618e20768b2d.dll
-
Size
258KB
-
MD5
866c846484eefd65d94304ae4b2b47e5
-
SHA1
4876963d00fd177fe636b669396c2b330ffc6b4b
-
SHA256
328c3b29b881ca5e2caf86e985afdbdb6744d5b001ee870289c8618e20768b2d
-
SHA512
107ca74c52785154618d10c9956286b5760b81b6bb09e26b16833c865a9bb776d09239009c0fb20db7656ce66d19542e847dd49f7edc30d28700c199ee25f58c
Malware Config
Extracted
emotet
Epoch5
209.239.112.82:8080
116.124.128.206:8080
45.63.5.129:443
128.199.192.135:8080
51.178.61.60:443
168.197.250.14:80
177.72.80.14:7080
51.210.242.234:8080
142.4.219.173:8080
78.47.204.80:443
78.46.73.125:443
37.44.244.177:8080
37.59.209.141:8080
104.131.62.48:8080
190.90.233.66:443
185.148.168.220:8080
185.148.168.15:8080
62.171.178.147:8080
191.252.103.16:80
54.38.242.185:443
85.214.67.203:8080
217.182.143.207:443
159.69.237.188:443
210.57.209.142:8080
54.37.228.122:443
207.148.81.119:8080
195.77.239.39:8080
66.42.57.149:443
195.154.146.35:443
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2684 wrote to memory of 3208 2684 regsvr32.exe regsvr32.exe PID 2684 wrote to memory of 3208 2684 regsvr32.exe regsvr32.exe PID 2684 wrote to memory of 3208 2684 regsvr32.exe regsvr32.exe PID 3208 wrote to memory of 1332 3208 regsvr32.exe rundll32.exe PID 3208 wrote to memory of 1332 3208 regsvr32.exe rundll32.exe PID 3208 wrote to memory of 1332 3208 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\328c3b29b881ca5e2caf86e985afdbdb6744d5b001ee870289c8618e20768b2d.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\328c3b29b881ca5e2caf86e985afdbdb6744d5b001ee870289c8618e20768b2d.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\328c3b29b881ca5e2caf86e985afdbdb6744d5b001ee870289c8618e20768b2d.dll",DllRegisterServer3⤵