Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
18-01-2022 20:51
Static task
static1
General
-
Target
5d360d7dfe5fb498c5c004209ef728720e07b68d06053d0ed07d6f66008a4d81.dll
-
Size
408KB
-
MD5
e606a394aa21d1be271dba6feaacfbcd
-
SHA1
61ea13c7b69a5c16c754686e1523e2e4335786ad
-
SHA256
5d360d7dfe5fb498c5c004209ef728720e07b68d06053d0ed07d6f66008a4d81
-
SHA512
ee3b20bf755dfbede5373605b70167d622c42f76b2daac1cd43c3ebd44888cd8bb636979fa0c31a0745f044e51258e878de62c37170d8bf21ace65997501600f
Malware Config
Extracted
emotet
Epoch5
45.138.98.34:80
69.16.218.101:8080
51.210.242.234:8080
185.148.168.220:8080
142.4.219.173:8080
54.38.242.185:443
191.252.103.16:80
104.131.62.48:8080
62.171.178.147:8080
217.182.143.207:443
168.197.250.14:80
37.44.244.177:8080
66.42.57.149:443
210.57.209.142:8080
159.69.237.188:443
116.124.128.206:8080
128.199.192.135:8080
195.154.146.35:443
185.148.168.15:8080
195.77.239.39:8080
207.148.81.119:8080
85.214.67.203:8080
190.90.233.66:443
78.46.73.125:443
78.47.204.80:443
37.59.209.141:8080
54.37.228.122:443
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2940 wrote to memory of 3984 2940 regsvr32.exe regsvr32.exe PID 2940 wrote to memory of 3984 2940 regsvr32.exe regsvr32.exe PID 2940 wrote to memory of 3984 2940 regsvr32.exe regsvr32.exe PID 3984 wrote to memory of 3860 3984 regsvr32.exe rundll32.exe PID 3984 wrote to memory of 3860 3984 regsvr32.exe rundll32.exe PID 3984 wrote to memory of 3860 3984 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\5d360d7dfe5fb498c5c004209ef728720e07b68d06053d0ed07d6f66008a4d81.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\5d360d7dfe5fb498c5c004209ef728720e07b68d06053d0ed07d6f66008a4d81.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\5d360d7dfe5fb498c5c004209ef728720e07b68d06053d0ed07d6f66008a4d81.dll",DllRegisterServer3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3984-115-0x0000000003530000-0x0000000003558000-memory.dmpFilesize
160KB