Analysis
-
max time kernel
121s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 03:20
Static task
static1
General
-
Target
0df0b91057bc97ce3f6c5d122496e0404cc4a06f1f2c1636f1faf33d22b1a3c5.dll
-
Size
520KB
-
MD5
352ca0f6157ea3aa5158abeb5f9658a0
-
SHA1
1654e5752f9fc0370522b50fc41dd9816a8d5af1
-
SHA256
0df0b91057bc97ce3f6c5d122496e0404cc4a06f1f2c1636f1faf33d22b1a3c5
-
SHA512
a45fc6870a56d553f5675f6ca8c3072c827df2c9feec3925c89e5ffeb983ecabb51d93e06929f85d5dede7dcd48a5dffed94db4fbb2f6ca5c0d44a8c65e31c5b
Malware Config
Extracted
emotet
Epoch5
159.69.43.124:8080
45.79.80.198:443
207.148.81.119:8080
128.199.192.135:8080
118.98.72.86:443
217.182.143.207:443
168.197.250.14:80
116.124.128.206:8080
78.46.73.125:443
185.148.168.15:8080
195.154.146.35:443
85.214.67.203:8080
194.9.172.107:8080
59.148.253.194:443
210.57.209.142:8080
54.38.242.185:443
195.77.239.39:8080
159.69.237.188:443
104.131.62.48:8080
62.171.178.147:8080
142.4.219.173:8080
66.42.57.149:443
78.47.204.80:443
190.90.233.66:443
54.37.228.122:443
185.168.130.138:443
191.252.103.16:80
37.59.209.141:8080
185.148.168.220:8080
37.44.244.177:8080
203.153.216.46:443
45.13.132.26:8080
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2740 wrote to memory of 3372 2740 regsvr32.exe regsvr32.exe PID 2740 wrote to memory of 3372 2740 regsvr32.exe regsvr32.exe PID 2740 wrote to memory of 3372 2740 regsvr32.exe regsvr32.exe PID 3372 wrote to memory of 2248 3372 regsvr32.exe rundll32.exe PID 3372 wrote to memory of 2248 3372 regsvr32.exe rundll32.exe PID 3372 wrote to memory of 2248 3372 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0df0b91057bc97ce3f6c5d122496e0404cc4a06f1f2c1636f1faf33d22b1a3c5.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\0df0b91057bc97ce3f6c5d122496e0404cc4a06f1f2c1636f1faf33d22b1a3c5.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\0df0b91057bc97ce3f6c5d122496e0404cc4a06f1f2c1636f1faf33d22b1a3c5.dll",DllRegisterServer3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3372-115-0x00000000036A0000-0x00000000036C7000-memory.dmpFilesize
156KB