Analysis
-
max time kernel
86s -
max time network
146s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 03:20
Static task
static1
General
-
Target
23e13c578f3d81a5fd13097849ec25b706e5c8b65ec7035b5c03a4f4f1eb8953.dll
-
Size
520KB
-
MD5
89ffd939b51ad1848e51329073135b50
-
SHA1
12b52180191b2291590e422ddcefed8ecad20bee
-
SHA256
23e13c578f3d81a5fd13097849ec25b706e5c8b65ec7035b5c03a4f4f1eb8953
-
SHA512
76f07a98b69dbd2f3aae868954c70f21b1293be24e9b40a07db0ad10121fd4fa0fb2686001039779a2726b868a7c5c4a3633723fa4d377279d34d5ea363b560a
Malware Config
Extracted
emotet
Epoch5
159.69.43.124:8080
45.79.80.198:443
207.148.81.119:8080
128.199.192.135:8080
118.98.72.86:443
217.182.143.207:443
168.197.250.14:80
116.124.128.206:8080
78.46.73.125:443
185.148.168.15:8080
195.154.146.35:443
85.214.67.203:8080
194.9.172.107:8080
59.148.253.194:443
210.57.209.142:8080
54.38.242.185:443
195.77.239.39:8080
159.69.237.188:443
104.131.62.48:8080
62.171.178.147:8080
142.4.219.173:8080
66.42.57.149:443
78.47.204.80:443
190.90.233.66:443
54.37.228.122:443
185.168.130.138:443
191.252.103.16:80
37.59.209.141:8080
185.148.168.220:8080
37.44.244.177:8080
203.153.216.46:443
45.13.132.26:8080
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2180 wrote to memory of 2704 2180 regsvr32.exe regsvr32.exe PID 2180 wrote to memory of 2704 2180 regsvr32.exe regsvr32.exe PID 2180 wrote to memory of 2704 2180 regsvr32.exe regsvr32.exe PID 2704 wrote to memory of 3924 2704 regsvr32.exe rundll32.exe PID 2704 wrote to memory of 3924 2704 regsvr32.exe rundll32.exe PID 2704 wrote to memory of 3924 2704 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\23e13c578f3d81a5fd13097849ec25b706e5c8b65ec7035b5c03a4f4f1eb8953.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\23e13c578f3d81a5fd13097849ec25b706e5c8b65ec7035b5c03a4f4f1eb8953.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\23e13c578f3d81a5fd13097849ec25b706e5c8b65ec7035b5c03a4f4f1eb8953.dll",DllRegisterServer3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2704-118-0x00000000044B0000-0x00000000044D7000-memory.dmpFilesize
156KB