Analysis
-
max time kernel
109s -
max time network
113s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
23-05-2023 20:02
Static task
static1
Behavioral task
behavioral1
Sample
14b57211308ac8ad2a63c965783d9ba1c2d1930d0cafd884374d143a481f9bf3.dll
Resource
win7-20230220-en
General
-
Target
14b57211308ac8ad2a63c965783d9ba1c2d1930d0cafd884374d143a481f9bf3.dll
-
Size
580KB
-
MD5
57595f82e73bed372c669e907d4db642
-
SHA1
78f18ab091be74f0cf4002d5f452d1856ae33790
-
SHA256
14b57211308ac8ad2a63c965783d9ba1c2d1930d0cafd884374d143a481f9bf3
-
SHA512
2a2c24006ce009a9ce303cc703d9a9a975a153b02c8719ff7604672af8656bcbc2794b6bf67f9d7ede26161cb1a4d118644130108800b40717ab4c5b22a46ce5
-
SSDEEP
12288:eEETvW7M4xbC9V1Fj4ttR5bMzlTkPKO0kZ:eEEi7Myb4V34rXMpo0y
Malware Config
Extracted
emotet
Epoch4
135.148.121.246:8080
213.190.4.223:7080
175.107.196.192:80
46.55.222.11:443
153.126.203.229:8080
138.185.72.26:8080
45.118.135.203:7080
107.182.225.142:8080
195.154.133.20:443
79.172.212.216:8080
129.232.188.93:443
50.30.40.196:8080
131.100.24.231:80
58.227.42.236:80
216.158.226.206:443
45.118.115.99:8080
51.254.140.238:7080
173.212.193.249:8080
110.232.117.186:8080
81.0.236.90:443
158.69.222.101:443
103.75.201.2:443
185.157.82.211:8080
176.104.106.96:8080
82.165.152.127:8080
156.67.219.84:7080
212.237.17.99:8080
178.128.83.165:80
162.243.175.63:443
45.142.114.231:8080
103.134.85.85:80
178.79.147.66:8080
31.24.158.56:8080
103.75.201.4:443
217.182.143.207:443
159.8.59.82:8080
164.68.99.3:8080
209.126.98.206:8080
207.38.84.195:8080
119.235.255.201:8080
212.24.98.99:8080
212.237.56.116:7080
50.116.54.215:443
45.176.232.124:443
203.114.109.124:443
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
regsvr32.exepid process 676 regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 592 wrote to memory of 676 592 regsvr32.exe regsvr32.exe PID 592 wrote to memory of 676 592 regsvr32.exe regsvr32.exe PID 592 wrote to memory of 676 592 regsvr32.exe regsvr32.exe PID 592 wrote to memory of 676 592 regsvr32.exe regsvr32.exe PID 592 wrote to memory of 676 592 regsvr32.exe regsvr32.exe PID 592 wrote to memory of 676 592 regsvr32.exe regsvr32.exe PID 592 wrote to memory of 676 592 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\14b57211308ac8ad2a63c965783d9ba1c2d1930d0cafd884374d143a481f9bf3.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\14b57211308ac8ad2a63c965783d9ba1c2d1930d0cafd884374d143a481f9bf3.dll2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/676-54-0x0000000000280000-0x00000000002A6000-memory.dmpFilesize
152KB