DllRegisterServer
Behavioral task
behavioral1
Sample
70ece5ae78f8dd1c2735fcdae1bc47e31e51d9d269b566739fdfdd4e8d0a6a01_unpacked.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
70ece5ae78f8dd1c2735fcdae1bc47e31e51d9d269b566739fdfdd4e8d0a6a01_unpacked.dll
Resource
win10v2004-20220812-en
General
-
Target
70ece5ae78f8dd1c2735fcdae1bc47e31e51d9d269b566739fdfdd4e8d0a6a01_unpacked
-
Size
164KB
-
MD5
652cb04e3d6f4e98c15be4b24491746d
-
SHA1
6674de424c35f60ce4ec0de0748f42cd9358e13a
-
SHA256
e205555fbd6d109a9a32431382bd8745d71179fbe14fb76f9ab828d9ebe7d613
-
SHA512
a1ff962344c3033dd564f32427becd3f3229069421495531b454256f8b5157fa70568892c145a5b7c2ce3f90e7abdf5c3a1c176e32d3889d7b6fc8bb7554f6c6
-
SSDEEP
3072:lynJKNEl7ch0OsPmznxv8yNZzeH0+Q+6c5an7utrE91r6:lOKQw0qnxvOH0+x6cE7v912
Malware Config
Extracted
emotet
Epoch5
175.126.176.79:8080
165.22.254.68:443
116.124.128.206:8080
202.29.239.162:443
103.71.99.57:8080
88.217.172.165:8080
93.104.209.107:8080
104.244.79.94:443
196.44.98.190:8080
85.214.67.203:8080
85.25.120.45:8080
54.37.228.122:443
103.41.204.169:8080
165.232.185.110:8080
195.77.239.39:8080
36.67.23.59:443
59.148.253.194:443
103.85.95.4:8080
157.230.99.206:8080
139.196.72.155:8080
54.37.106.167:8080
118.98.72.86:443
188.225.32.231:4143
103.126.216.86:443
78.47.204.80:443
103.56.149.105:8080
202.28.34.99:8080
210.57.209.142:8080
165.22.254.236:8080
87.106.97.83:7080
198.199.70.22:8080
37.44.244.177:8080
104.248.225.227:8080
68.183.91.111:8080
64.227.55.231:8080
157.245.111.0:8080
62.171.178.147:8080
103.254.12.236:7080
202.134.4.210:7080
103.224.241.74:8080
178.62.112.199:8080
128.199.217.206:443
Signatures
-
Emotet family
Files
-
70ece5ae78f8dd1c2735fcdae1bc47e31e51d9d269b566739fdfdd4e8d0a6a01_unpacked.dll regsvr32 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
.text Size: 154KB - Virtual size: 154KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 816B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ