Analysis
-
max time kernel
117s -
max time network
144s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
26-01-2022 14:12
Static task
static1
Behavioral task
behavioral1
Sample
ebfdfcf3824adea6348749e8f74cace2.dll
Resource
win7-en-20211208
General
-
Target
ebfdfcf3824adea6348749e8f74cace2.dll
-
Size
705KB
-
MD5
ebfdfcf3824adea6348749e8f74cace2
-
SHA1
a246877797f1024d0d021f56107f182d0d877ba3
-
SHA256
aed3fcc557857af2eb9cfed23658a74afd12d348d63a4666354ccaffebc1e707
-
SHA512
c29fcc5c99c7f7c0b86ea6537ee935e7046be4fa48643a7b9c400df42e5efea528077d8d0c28e499ca1be98b89a8cbbc445a3e77878ee12a97a55de67ce84e1c
Malware Config
Extracted
emotet
Epoch4
51.77.82.125:443
69.197.160.180:8080
103.75.201.2:443
173.212.193.249:8080
45.118.135.203:7080
45.118.115.99:8080
162.243.175.63:443
192.254.71.210:443
50.116.54.215:443
51.38.71.0:443
138.185.72.26:8080
131.100.24.231:80
212.237.5.209:443
209.59.138.75:7080
176.104.106.96:8080
107.182.225.142:8080
45.142.114.231:8080
212.237.56.116:7080
207.38.84.195:8080
158.69.222.101:443
104.251.214.46:8080
104.168.155.129:8080
46.55.222.11:443
103.8.26.102:8080
58.227.42.236:80
164.68.99.3:8080
203.114.109.124:443
216.158.226.206:443
178.63.25.185:443
103.8.26.103:8080
195.154.133.20:443
45.176.232.124:443
41.76.108.46:8080
81.0.236.90:443
178.79.147.66:8080
212.24.98.99:8080
217.182.143.207:443
110.232.117.186:8080
162.214.50.39:7080
212.237.17.99:8080
185.157.82.211:8080
79.172.212.216:8080
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 684 wrote to memory of 3052 684 regsvr32.exe regsvr32.exe PID 684 wrote to memory of 3052 684 regsvr32.exe regsvr32.exe PID 684 wrote to memory of 3052 684 regsvr32.exe regsvr32.exe PID 3052 wrote to memory of 3564 3052 regsvr32.exe rundll32.exe PID 3052 wrote to memory of 3564 3052 regsvr32.exe rundll32.exe PID 3052 wrote to memory of 3564 3052 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\ebfdfcf3824adea6348749e8f74cace2.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\ebfdfcf3824adea6348749e8f74cace2.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ebfdfcf3824adea6348749e8f74cace2.dll",DllRegisterServer3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3052-115-0x0000000004E80000-0x0000000004EA5000-memory.dmpFilesize
148KB