Behavioral task
behavioral1
Sample
1776_2_808613764_00d289622d36b507f878726990284e3b758fe209.dll
Resource
win10-20220414-en
General
-
Target
1776_2_808613764_00d289622d36b507f878726990284e3b758fe209
-
Size
1.7MB
-
MD5
bd3d9e6f7147ad83bc15362f9651a946
-
SHA1
00d289622d36b507f878726990284e3b758fe209
-
SHA256
35a93aea45adc0b959b3418eeea518d95d0e37d459c848815eed86274c956447
-
SHA512
4e7bea01ab6c402c3c07661310af7b6234182865fa1f253338c0b569083690230d233cb3d937b3c6a28a2b7bf0e76ac600b05f6716b1fcc40351a110ab6d2f84
-
SSDEEP
49152:auSdn3QeciPaA2H3dwqqIuwc0IZkPXxV8:auSlenluSxV8
Malware Config
Extracted
emotet
54.37.70.105:8080
178.128.82.218:443
119.59.98.59:8080
45.55.63.166:8080
139.59.60.88:443
213.32.75.32:8080
103.221.221.164:8080
82.165.145.100:8080
165.22.211.113:8080
134.209.240.102:8080
96.125.171.165:4143
91.207.181.106:8080
Extracted
emotet
Signatures
-
Emotet family
Files
-
1776_2_808613764_00d289622d36b507f878726990284e3b758fe209.dll windows x64
6a3488df45cdecbb867a4b2c265c31bd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
CryptGenRandom
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore
user32
GetUserObjectInformationW
MessageBoxW
GetProcessWindowStation
ws2_32
closesocket
WSASetLastError
send
recv
WSACleanup
shutdown
__WSAFDIsSet
ioctlsocket
WSAGetLastError
kernel32
GetTimeZoneInformation
GetCurrentDirectoryW
GetFullPathNameW
PeekNamedPipe
GetFileInformationByHandle
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
FindFirstFileExW
FindNextFileW
FindFirstFileW
FindClose
SetEndOfFile
CreateFileW
WriteConsoleW
SetEnvironmentVariableA
GetStringTypeW
LCMapStringW
CompareStringW
lstrcpynA
GetStdHandle
GetFileType
WriteFile
GetLastError
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
SwitchToFiber
DeleteFiber
CreateFiber
WideCharToMultiByte
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
QueryPerformanceCounter
GetCurrentProcessId
GetTickCount
GlobalMemoryStatus
GetEnvironmentVariableW
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
SetLastError
GetSystemTime
SystemTimeToFileTime
GetCommandLineA
GetCurrentThreadId
EncodePointer
DecodePointer
HeapFree
HeapAlloc
HeapReAlloc
ExitProcess
GetModuleHandleExW
AreFileApisANSI
SetConsoleCtrlHandler
EnterCriticalSection
LeaveCriticalSection
IsDebuggerPresent
IsProcessorFeaturePresent
ReadFile
GetProcessHeap
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlUnwindEx
HeapSize
GetModuleFileNameW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
CloseHandle
FlushFileBuffers
GetConsoleCP
SetFilePointerEx
SetStdHandle
OutputDebugStringW
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 452KB - Virtual size: 451KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 61KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ