Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 03:20
Static task
static1
General
-
Target
9985079bc058eea24c1f91a90f5a8daa3c9731fdf524ae5e36830823b52d0bf4.dll
-
Size
520KB
-
MD5
25d2d7d35b1dd89ebed8f7c95d9f1397
-
SHA1
839e287e2cd8e1cbeb44642193b54f0de8e5a886
-
SHA256
9985079bc058eea24c1f91a90f5a8daa3c9731fdf524ae5e36830823b52d0bf4
-
SHA512
699499d812e40153a1b282aaa059f2687501e475a04629f2c1ad6ea3e24a44a6fe31c85ade66b79b6f330f519ce73c6b5a8d52427caf753162cc3d89e07ed4f7
Malware Config
Extracted
emotet
Epoch5
159.69.43.124:8080
45.79.80.198:443
207.148.81.119:8080
128.199.192.135:8080
118.98.72.86:443
217.182.143.207:443
168.197.250.14:80
116.124.128.206:8080
78.46.73.125:443
185.148.168.15:8080
195.154.146.35:443
85.214.67.203:8080
194.9.172.107:8080
59.148.253.194:443
210.57.209.142:8080
54.38.242.185:443
195.77.239.39:8080
159.69.237.188:443
104.131.62.48:8080
62.171.178.147:8080
142.4.219.173:8080
66.42.57.149:443
78.47.204.80:443
190.90.233.66:443
54.37.228.122:443
185.168.130.138:443
191.252.103.16:80
37.59.209.141:8080
185.148.168.220:8080
37.44.244.177:8080
203.153.216.46:443
45.13.132.26:8080
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 3828 wrote to memory of 3996 3828 regsvr32.exe regsvr32.exe PID 3828 wrote to memory of 3996 3828 regsvr32.exe regsvr32.exe PID 3828 wrote to memory of 3996 3828 regsvr32.exe regsvr32.exe PID 3996 wrote to memory of 3520 3996 regsvr32.exe rundll32.exe PID 3996 wrote to memory of 3520 3996 regsvr32.exe rundll32.exe PID 3996 wrote to memory of 3520 3996 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\9985079bc058eea24c1f91a90f5a8daa3c9731fdf524ae5e36830823b52d0bf4.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\9985079bc058eea24c1f91a90f5a8daa3c9731fdf524ae5e36830823b52d0bf4.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\9985079bc058eea24c1f91a90f5a8daa3c9731fdf524ae5e36830823b52d0bf4.dll",DllRegisterServer3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3996-115-0x0000000004300000-0x0000000004327000-memory.dmpFilesize
156KB