Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
13-01-2022 23:11
Static task
static1
Behavioral task
behavioral1
Sample
2054474965.dll
Resource
win7-en-20211208
General
-
Target
2054474965.dll
-
Size
805KB
-
MD5
f2eae85e0cb5640e1c51e2e1e9e01606
-
SHA1
e17b2e1c08b9676f5ab30018b59301aacdeb534f
-
SHA256
3d46d69a3cb137e443329c73e8551dcfaa471bc271d891703850a0c931faacd8
-
SHA512
71c04507e5f549fe59b6e6b56d6fa5c4b347839a26ddeb45d3198bc7e38622a22ac3330d407b86421fc4cf618464f357a12639c2e6e96fd3683c470d0ff9e4e9
Malware Config
Extracted
emotet
Epoch5
209.239.112.82:8080
116.124.128.206:8080
45.63.5.129:443
128.199.192.135:8080
51.178.61.60:443
168.197.250.14:80
177.72.80.14:7080
51.210.242.234:8080
142.4.219.173:8080
78.47.204.80:443
78.46.73.125:443
37.44.244.177:8080
37.59.209.141:8080
104.131.62.48:8080
190.90.233.66:443
185.148.168.220:8080
185.148.168.15:8080
62.171.178.147:8080
191.252.103.16:80
54.38.242.185:443
85.214.67.203:8080
217.182.143.207:443
159.69.237.188:443
210.57.209.142:8080
54.37.228.122:443
207.148.81.119:8080
195.77.239.39:8080
66.42.57.149:443
195.154.146.35:443
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1760 wrote to memory of 1820 1760 regsvr32.exe regsvr32.exe PID 1760 wrote to memory of 1820 1760 regsvr32.exe regsvr32.exe PID 1760 wrote to memory of 1820 1760 regsvr32.exe regsvr32.exe PID 1760 wrote to memory of 1820 1760 regsvr32.exe regsvr32.exe PID 1760 wrote to memory of 1820 1760 regsvr32.exe regsvr32.exe PID 1760 wrote to memory of 1820 1760 regsvr32.exe regsvr32.exe PID 1760 wrote to memory of 1820 1760 regsvr32.exe regsvr32.exe PID 1820 wrote to memory of 1096 1820 regsvr32.exe rundll32.exe PID 1820 wrote to memory of 1096 1820 regsvr32.exe rundll32.exe PID 1820 wrote to memory of 1096 1820 regsvr32.exe rundll32.exe PID 1820 wrote to memory of 1096 1820 regsvr32.exe rundll32.exe PID 1820 wrote to memory of 1096 1820 regsvr32.exe rundll32.exe PID 1820 wrote to memory of 1096 1820 regsvr32.exe rundll32.exe PID 1820 wrote to memory of 1096 1820 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2054474965.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\2054474965.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\2054474965.dll",DllRegisterServer3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1096-57-0x0000000000000000-mapping.dmp
-
memory/1760-54-0x000007FEFBAD1000-0x000007FEFBAD3000-memory.dmpFilesize
8KB
-
memory/1820-55-0x0000000000000000-mapping.dmp
-
memory/1820-56-0x0000000075341000-0x0000000075343000-memory.dmpFilesize
8KB
-
memory/1820-59-0x0000000010000000-0x0000000010025000-memory.dmpFilesize
148KB