DllRegisterServer
Behavioral task
behavioral1
Sample
dbec6d4c12131b3a54f10fb91b2a7304aa70a6f5c9825db06e747c4e931e2b80_unpacked.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dbec6d4c12131b3a54f10fb91b2a7304aa70a6f5c9825db06e747c4e931e2b80_unpacked.dll
Resource
win10v2004-20220901-en
General
-
Target
dbec6d4c12131b3a54f10fb91b2a7304aa70a6f5c9825db06e747c4e931e2b80_unpacked
-
Size
157KB
-
MD5
686642d32c2abae37eb73dd0328bc351
-
SHA1
3b9e2ea8943755606584682771b5989cc11502c1
-
SHA256
0bb139d07530187a45c98eac42c4ddb48297bd75ee0172c12795f5a159fab136
-
SHA512
f2c56b51a6e1adfe16bcc03e81e46fa480d06e0d14e6df583d042400f987c6e2634e3b8b0ec8ca236cf4fa2f27189c429952aea07b8b464652cebbc77416c84e
-
SSDEEP
3072:Lab7vV5re+DRIIp9wymcfU3R9/mhUcdgmUHtrDGEEEf:2bbV5S+IDIfU3S2FN+c
Malware Config
Extracted
emotet
Epoch5
68.183.91.111:8080
164.52.194.45:8080
202.29.239.162:443
54.38.143.246:7080
54.37.106.167:8080
185.148.168.220:8080
196.44.98.190:8080
175.126.176.79:8080
207.148.81.119:8080
37.59.209.141:8080
103.42.58.120:7080
54.37.228.122:443
68.183.93.250:443
66.42.57.149:443
45.71.195.104:8080
78.47.204.80:443
128.199.192.135:8080
195.154.146.35:443
118.98.72.86:443
116.124.128.206:8080
190.90.233.66:443
78.46.73.125:443
210.57.209.142:8080
203.153.216.46:443
103.82.248.59:7080
217.182.143.207:443
159.69.237.188:443
85.214.67.203:8080
194.9.172.107:8080
104.131.62.48:8080
51.68.141.164:8080
93.104.209.107:8080
103.41.204.169:8080
103.56.149.105:8080
103.133.214.242:8080
5.56.132.177:8080
59.148.253.194:443
85.25.120.45:8080
62.171.178.147:8080
37.44.244.177:8080
36.67.23.59:443
87.106.97.83:7080
54.38.242.185:443
139.196.72.155:8080
88.217.172.165:8080
202.28.34.99:8080
202.134.4.210:7080
195.77.239.39:8080
Signatures
-
Emotet family
Files
-
dbec6d4c12131b3a54f10fb91b2a7304aa70a6f5c9825db06e747c4e931e2b80_unpacked.dll regsvr32 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
.text Size: 142KB - Virtual size: 144KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ