DllRegisterServer
Behavioral task
behavioral1
Sample
572848a65a3b259c93d66dff7d96179f1a20aecc7fae496e04f8f49305f981ac_unpacked.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
572848a65a3b259c93d66dff7d96179f1a20aecc7fae496e04f8f49305f981ac_unpacked.dll
Resource
win10v2004-20220812-en
General
-
Target
572848a65a3b259c93d66dff7d96179f1a20aecc7fae496e04f8f49305f981ac_unpacked
-
Size
160KB
-
MD5
898d44479ab9a5533e871485a0d0bf30
-
SHA1
e459befc63f1cf11ffa1de55cb0a5a72b2155374
-
SHA256
b62c1c1955bd49ad67e54ddbfe6eda415e4ce60429bb10826701730705a1df88
-
SHA512
5247898bb8902d12130077720a6f8148da4164609f58c43d0339566da35b10046a718e48bb2c0a90148196271af998bad5c64f93d4b523b924b1f53f05dc70d4
-
SSDEEP
3072:2GRnqAyF6bk7wpdfuDmo0c2JulHeND9PWRknkO9DH:2GRqAu6bIwL85mKenRB9D
Malware Config
Extracted
emotet
Epoch5
78.47.204.80:443
62.171.178.147:8080
165.232.185.110:8080
103.41.204.169:8080
54.37.228.122:443
202.29.239.162:443
103.71.99.57:8080
64.227.55.231:8080
85.214.67.203:8080
139.196.72.155:8080
195.77.239.39:8080
202.28.34.99:8080
54.37.106.167:8080
103.126.216.86:443
68.183.91.111:8080
104.244.79.94:443
85.25.120.45:8080
116.124.128.206:8080
210.57.209.142:8080
103.85.95.4:8080
188.225.32.231:4143
118.98.72.86:443
37.44.244.177:8080
87.106.97.83:7080
103.56.149.105:8080
128.199.217.206:443
103.254.12.236:7080
59.148.253.194:443
36.67.23.59:443
202.134.4.210:7080
196.44.98.190:8080
178.62.112.199:8080
103.224.241.74:8080
157.245.111.0:8080
104.248.225.227:8080
93.104.209.107:8080
88.217.172.165:8080
175.126.176.79:8080
157.230.99.206:8080
Signatures
-
Emotet family
Files
-
572848a65a3b259c93d66dff7d96179f1a20aecc7fae496e04f8f49305f981ac_unpacked.dll regsvr32 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
.text Size: 153KB - Virtual size: 152KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 840B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ