Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
13-01-2022 23:11
Static task
static1
Behavioral task
behavioral1
Sample
2054474965.dll
Resource
win7-en-20211208
General
-
Target
2054474965.dll
-
Size
805KB
-
MD5
f2eae85e0cb5640e1c51e2e1e9e01606
-
SHA1
e17b2e1c08b9676f5ab30018b59301aacdeb534f
-
SHA256
3d46d69a3cb137e443329c73e8551dcfaa471bc271d891703850a0c931faacd8
-
SHA512
71c04507e5f549fe59b6e6b56d6fa5c4b347839a26ddeb45d3198bc7e38622a22ac3330d407b86421fc4cf618464f357a12639c2e6e96fd3683c470d0ff9e4e9
Malware Config
Extracted
emotet
Epoch5
209.239.112.82:8080
116.124.128.206:8080
45.63.5.129:443
128.199.192.135:8080
51.178.61.60:443
168.197.250.14:80
177.72.80.14:7080
51.210.242.234:8080
142.4.219.173:8080
78.47.204.80:443
78.46.73.125:443
37.44.244.177:8080
37.59.209.141:8080
104.131.62.48:8080
190.90.233.66:443
185.148.168.220:8080
185.148.168.15:8080
62.171.178.147:8080
191.252.103.16:80
54.38.242.185:443
85.214.67.203:8080
217.182.143.207:443
159.69.237.188:443
210.57.209.142:8080
54.37.228.122:443
207.148.81.119:8080
195.77.239.39:8080
66.42.57.149:443
195.154.146.35:443
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 660 wrote to memory of 1008 660 regsvr32.exe regsvr32.exe PID 660 wrote to memory of 1008 660 regsvr32.exe regsvr32.exe PID 660 wrote to memory of 1008 660 regsvr32.exe regsvr32.exe PID 1008 wrote to memory of 808 1008 regsvr32.exe rundll32.exe PID 1008 wrote to memory of 808 1008 regsvr32.exe rundll32.exe PID 1008 wrote to memory of 808 1008 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2054474965.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\2054474965.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\2054474965.dll",DllRegisterServer3⤵