Analysis
-
max time kernel
110s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-12-2021 02:07
Static task
static1
Behavioral task
behavioral1
Sample
emotet_exe_e5_bd8f9a106ac22cf1fe69baeead4f6aa01d198d1e7c3709686aeee56cc493a3af_2021-12-24__020617.exe.dll
Resource
win7-en-20211208
General
-
Target
emotet_exe_e5_bd8f9a106ac22cf1fe69baeead4f6aa01d198d1e7c3709686aeee56cc493a3af_2021-12-24__020617.exe.dll
-
Size
258KB
-
MD5
c65a94937f722e40575638479887427a
-
SHA1
7bce6681dbaab416ec780b6e04db3c7bea7e251e
-
SHA256
bd8f9a106ac22cf1fe69baeead4f6aa01d198d1e7c3709686aeee56cc493a3af
-
SHA512
9e00cdfdd114c5922a329dd8507210a5c91887b96b9f6008a2351772568872d4b6091118b177383561105c8843216ff96f4b5029c65107a0617c0ee690ef2e9e
Malware Config
Extracted
emotet
Epoch5
209.239.112.82:8080
116.124.128.206:8080
45.63.5.129:443
128.199.192.135:8080
51.178.61.60:443
168.197.250.14:80
177.72.80.14:7080
51.210.242.234:8080
142.4.219.173:8080
78.47.204.80:443
78.46.73.125:443
37.44.244.177:8080
37.59.209.141:8080
104.131.62.48:8080
190.90.233.66:443
185.148.168.220:8080
185.148.168.15:8080
62.171.178.147:8080
191.252.103.16:80
54.38.242.185:443
85.214.67.203:8080
217.182.143.207:443
159.69.237.188:443
210.57.209.142:8080
54.37.228.122:443
207.148.81.119:8080
195.77.239.39:8080
66.42.57.149:443
195.154.146.35:443
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2684 wrote to memory of 2760 2684 regsvr32.exe regsvr32.exe PID 2684 wrote to memory of 2760 2684 regsvr32.exe regsvr32.exe PID 2684 wrote to memory of 2760 2684 regsvr32.exe regsvr32.exe PID 2760 wrote to memory of 3128 2760 regsvr32.exe rundll32.exe PID 2760 wrote to memory of 3128 2760 regsvr32.exe rundll32.exe PID 2760 wrote to memory of 3128 2760 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bd8f9a106ac22cf1fe69baeead4f6aa01d198d1e7c3709686aeee56cc493a3af_2021-12-24__020617.exe.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bd8f9a106ac22cf1fe69baeead4f6aa01d198d1e7c3709686aeee56cc493a3af_2021-12-24__020617.exe.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bd8f9a106ac22cf1fe69baeead4f6aa01d198d1e7c3709686aeee56cc493a3af_2021-12-24__020617.exe.dll",DllRegisterServer3⤵