Analysis
-
max time kernel
120s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
08-02-2023 09:55
Static task
static1
Behavioral task
behavioral1
Sample
95700067aa7b2852e7c7ce0b827857b3231ce44afffec7b12f35faf12881b499.dll
Resource
win7-20221111-en
General
-
Target
95700067aa7b2852e7c7ce0b827857b3231ce44afffec7b12f35faf12881b499.dll
-
Size
547KB
-
MD5
5f4321d6cab1545344c0bbcbc76a0ba2
-
SHA1
0bc8f623c43bbd5f4411ca65aaeea3937f11bedd
-
SHA256
95700067aa7b2852e7c7ce0b827857b3231ce44afffec7b12f35faf12881b499
-
SHA512
21337af9fb4936bb757a344ec60778cfb10f1bc13c9bb22f9f9931be985b593d3858ca86d6ec11f1c78d517260172556bc7bc46d41df3df85a435eff0751eb32
-
SSDEEP
12288:W+JYobIU5CLB3GW6RpXoM6k8E/lnn7NAdLT1:WZ3GWm9ok8e7NA5T1
Malware Config
Extracted
emotet
Epoch5
198.199.126.144:443
103.42.57.17:8080
195.154.146.35:443
104.131.62.48:8080
116.124.128.206:8080
54.38.242.185:443
217.182.143.207:443
66.42.57.149:443
185.148.168.220:8080
37.44.244.177:8080
78.47.204.80:443
173.203.78.138:443
190.90.233.66:443
203.153.216.46:443
54.37.106.167:8080
194.9.172.107:8080
168.197.250.14:80
185.184.25.78:8080
191.252.103.16:80
159.69.237.188:443
85.214.67.203:8080
78.46.73.125:443
59.148.253.194:443
118.98.72.86:443
62.171.178.147:8080
195.77.239.39:8080
185.148.168.15:8080
139.196.72.155:8080
54.37.228.122:443
37.59.209.141:8080
198.199.98.78:8080
93.104.208.37:8080
103.41.204.169:8080
128.199.192.135:8080
210.57.209.142:8080
207.148.81.119:8080
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1976 wrote to memory of 4892 1976 regsvr32.exe regsvr32.exe PID 1976 wrote to memory of 4892 1976 regsvr32.exe regsvr32.exe PID 1976 wrote to memory of 4892 1976 regsvr32.exe regsvr32.exe PID 4892 wrote to memory of 4168 4892 regsvr32.exe rundll32.exe PID 4892 wrote to memory of 4168 4892 regsvr32.exe rundll32.exe PID 4892 wrote to memory of 4168 4892 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\95700067aa7b2852e7c7ce0b827857b3231ce44afffec7b12f35faf12881b499.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\95700067aa7b2852e7c7ce0b827857b3231ce44afffec7b12f35faf12881b499.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\95700067aa7b2852e7c7ce0b827857b3231ce44afffec7b12f35faf12881b499.dll",DllRegisterServer3⤵