DllRegisterServer
Behavioral task
behavioral1
Sample
4d8fe5c15c5e1618bd104c53208b0df36a4cfcddde71f9b03b9f85004be7409b_unpacked.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4d8fe5c15c5e1618bd104c53208b0df36a4cfcddde71f9b03b9f85004be7409b_unpacked.dll
Resource
win10v2004-20220812-en
General
-
Target
4d8fe5c15c5e1618bd104c53208b0df36a4cfcddde71f9b03b9f85004be7409b_unpacked
-
Size
156KB
-
MD5
5e8b0463d4fb669ad5093489a49199c2
-
SHA1
7bdeaf8be352978d8707690c28709282713554fd
-
SHA256
54a7069cc9ac25979089e65a5d9b1c111da1114f79ff145b5a30a38c4240d968
-
SHA512
41effa07d8324108200ba681585a87200f1ec808d66084ee79f3f1981c83238a9f5f878295a829e5da4e7d944aaa21aa37b45499a51d18d2206020c6764471e4
-
SSDEEP
3072:JfbZKq3eZqRrL4dfXVd11uMOOshe/N0cvPfh+BUXvIkk:dbZK8ehdh1ujSvPfhQU/J
Malware Config
Extracted
emotet
Epoch4
138.201.142.73:8080
138.197.147.101:443
134.195.212.50:7080
104.168.154.79:8080
149.56.131.28:8080
129.232.188.93:443
212.24.98.99:8080
119.193.124.41:7080
45.118.115.99:8080
188.44.20.25:443
103.132.242.26:8080
201.94.166.162:443
1.234.21.73:7080
206.189.28.199:8080
185.8.212.130:7080
82.165.152.127:8080
176.104.106.96:8080
173.212.193.249:8080
167.99.115.35:8080
209.126.98.206:8080
185.157.82.211:8080
212.237.17.99:8080
185.4.135.165:8080
51.91.7.5:8080
187.84.80.182:443
164.68.99.3:8080
107.182.225.142:8080
58.227.42.236:80
103.75.201.2:443
101.50.0.91:8080
216.158.226.206:443
151.106.112.196:8080
45.235.8.30:8080
146.59.226.45:443
45.176.232.124:443
134.122.66.193:8080
51.254.140.238:7080
131.100.24.231:80
167.172.253.162:8080
50.30.40.196:8080
203.114.109.124:443
94.23.45.86:4143
189.126.111.200:7080
160.16.142.56:8080
27.54.89.58:8080
5.9.116.246:8080
46.55.222.11:443
209.97.163.214:443
110.232.117.186:8080
1.234.2.232:8080
153.126.146.25:7080
183.111.227.137:8080
196.218.30.83:443
103.70.28.102:8080
51.91.76.89:8080
91.207.28.33:8080
72.15.201.15:8080
103.43.46.182:443
209.250.246.206:443
197.242.150.244:8080
159.65.88.10:8080
172.104.251.154:8080
158.69.222.101:443
Signatures
-
Emotet family
Files
-
4d8fe5c15c5e1618bd104c53208b0df36a4cfcddde71f9b03b9f85004be7409b_unpacked.dll regsvr32 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
.text Size: 147KB - Virtual size: 146KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ