Analysis
-
max time kernel
172s -
max time network
195s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 03:20
Static task
static1
General
-
Target
30bda360bab679711664d32d74dd4b3b66761b09f07aae8cf1155616d9a3c248.dll
-
Size
512KB
-
MD5
5fa111112145c23c5df4f23f93f71bf8
-
SHA1
3a5b0d4be652bd7a969a75f4e69afa1cf37b5fe6
-
SHA256
30bda360bab679711664d32d74dd4b3b66761b09f07aae8cf1155616d9a3c248
-
SHA512
e53e2b03f29fb2d2f2b2b90ff9073e373c0fed59bd25ebba8231842a04245e3cee1a1cd89dba6cd4efba235f7140db98f3ecf7e8fe23cf9328a0427d2353cd92
Malware Config
Extracted
emotet
Epoch4
51.15.4.22:443
173.214.173.220:8080
212.237.5.209:443
192.254.71.210:443
216.158.226.206:443
162.243.175.63:443
212.24.98.99:8080
58.227.42.236:80
45.118.115.99:8080
104.251.214.46:8080
185.157.82.209:8080
46.55.222.11:443
188.40.137.206:8080
81.0.236.90:443
103.75.201.2:443
129.232.188.93:443
195.154.133.20:443
159.8.59.82:8080
79.172.212.216:8080
138.185.72.26:8080
200.17.134.35:7080
185.157.82.211:8080
209.59.138.75:7080
178.63.25.185:443
45.176.232.124:443
45.118.135.203:7080
164.68.99.3:8080
203.114.109.124:443
212.237.17.99:8080
50.116.54.215:443
131.100.24.231:80
212.237.56.116:7080
45.142.114.231:8080
162.214.50.39:7080
51.38.71.0:443
104.168.155.129:8080
107.182.225.142:8080
217.182.143.207:443
158.69.222.101:443
176.104.106.96:8080
207.38.84.195:8080
41.76.108.46:8080
110.232.117.186:8080
178.79.147.66:8080
173.212.193.249:8080
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1064 wrote to memory of 2320 1064 regsvr32.exe regsvr32.exe PID 1064 wrote to memory of 2320 1064 regsvr32.exe regsvr32.exe PID 1064 wrote to memory of 2320 1064 regsvr32.exe regsvr32.exe PID 2320 wrote to memory of 3200 2320 regsvr32.exe rundll32.exe PID 2320 wrote to memory of 3200 2320 regsvr32.exe rundll32.exe PID 2320 wrote to memory of 3200 2320 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\30bda360bab679711664d32d74dd4b3b66761b09f07aae8cf1155616d9a3c248.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\30bda360bab679711664d32d74dd4b3b66761b09f07aae8cf1155616d9a3c248.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\30bda360bab679711664d32d74dd4b3b66761b09f07aae8cf1155616d9a3c248.dll",DllRegisterServer3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2320-118-0x0000000000D10000-0x0000000000D35000-memory.dmpFilesize
148KB