Analysis
-
max time kernel
89s -
max time network
120s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-12-2021 13:36
Static task
static1
General
-
Target
1b65600b49360f09e49fc647946e0155c9c033d8fdd5d3f5b5ba6a0df9ddcafa.dll
-
Size
258KB
-
MD5
3537ad7979bdcd294c534ed3fa174b34
-
SHA1
81fc323066208c9ef00b09016495c668a33b0e95
-
SHA256
1b65600b49360f09e49fc647946e0155c9c033d8fdd5d3f5b5ba6a0df9ddcafa
-
SHA512
155043d4f8201afc37b19eaf0f8a265d09e94e8e01f3ed4c86ae0b3be5b3cb23ea0bc11a587f53c89b9abb93a47220f87af22ad07109ccfe47c5a8da1005a571
Malware Config
Extracted
emotet
Epoch5
209.239.112.82:8080
116.124.128.206:8080
45.63.5.129:443
128.199.192.135:8080
51.178.61.60:443
168.197.250.14:80
177.72.80.14:7080
51.210.242.234:8080
142.4.219.173:8080
78.47.204.80:443
78.46.73.125:443
37.44.244.177:8080
37.59.209.141:8080
104.131.62.48:8080
190.90.233.66:443
185.148.168.220:8080
185.148.168.15:8080
62.171.178.147:8080
191.252.103.16:80
54.38.242.185:443
85.214.67.203:8080
217.182.143.207:443
159.69.237.188:443
210.57.209.142:8080
54.37.228.122:443
207.148.81.119:8080
195.77.239.39:8080
66.42.57.149:443
195.154.146.35:443
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2680 wrote to memory of 2752 2680 regsvr32.exe regsvr32.exe PID 2680 wrote to memory of 2752 2680 regsvr32.exe regsvr32.exe PID 2680 wrote to memory of 2752 2680 regsvr32.exe regsvr32.exe PID 2752 wrote to memory of 1988 2752 regsvr32.exe rundll32.exe PID 2752 wrote to memory of 1988 2752 regsvr32.exe rundll32.exe PID 2752 wrote to memory of 1988 2752 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1b65600b49360f09e49fc647946e0155c9c033d8fdd5d3f5b5ba6a0df9ddcafa.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\1b65600b49360f09e49fc647946e0155c9c033d8fdd5d3f5b5ba6a0df9ddcafa.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\1b65600b49360f09e49fc647946e0155c9c033d8fdd5d3f5b5ba6a0df9ddcafa.dll",DllRegisterServer3⤵