Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
18-01-2022 20:21
Static task
static1
General
-
Target
c17e9756d947e559c8e4a97fa35d490012c5ac005eef500eb0de830883e57586.dll
-
Size
408KB
-
MD5
ebdb65db12379708d88f84acf4ee6846
-
SHA1
4548fea78ab5a0b550a504800c98c2990de5cad9
-
SHA256
c17e9756d947e559c8e4a97fa35d490012c5ac005eef500eb0de830883e57586
-
SHA512
d8b16d315c2f8d710c4594b415272866a8e59e23736ff7934b2030e66eff12464be8ea4ad8766a2c6ae0207a475d8817fcd11c5eefe3a4d7dc9755e7faf36065
Malware Config
Extracted
emotet
Epoch5
45.138.98.34:80
69.16.218.101:8080
51.210.242.234:8080
185.148.168.220:8080
142.4.219.173:8080
54.38.242.185:443
191.252.103.16:80
104.131.62.48:8080
62.171.178.147:8080
217.182.143.207:443
168.197.250.14:80
37.44.244.177:8080
66.42.57.149:443
210.57.209.142:8080
159.69.237.188:443
116.124.128.206:8080
128.199.192.135:8080
195.154.146.35:443
185.148.168.15:8080
195.77.239.39:8080
207.148.81.119:8080
85.214.67.203:8080
190.90.233.66:443
78.46.73.125:443
78.47.204.80:443
37.59.209.141:8080
54.37.228.122:443
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2664 wrote to memory of 2760 2664 regsvr32.exe regsvr32.exe PID 2664 wrote to memory of 2760 2664 regsvr32.exe regsvr32.exe PID 2664 wrote to memory of 2760 2664 regsvr32.exe regsvr32.exe PID 2760 wrote to memory of 3520 2760 regsvr32.exe rundll32.exe PID 2760 wrote to memory of 3520 2760 regsvr32.exe rundll32.exe PID 2760 wrote to memory of 3520 2760 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\c17e9756d947e559c8e4a97fa35d490012c5ac005eef500eb0de830883e57586.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\c17e9756d947e559c8e4a97fa35d490012c5ac005eef500eb0de830883e57586.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\c17e9756d947e559c8e4a97fa35d490012c5ac005eef500eb0de830883e57586.dll",DllRegisterServer3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2760-115-0x0000000004D30000-0x0000000004D58000-memory.dmpFilesize
160KB