Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
30-06-2023 12:42
Static task
static1
Behavioral task
behavioral1
Sample
3a4uoSOec70ypNOT1wMHzQXgn.dll
Resource
win7-20230621-en
General
-
Target
3a4uoSOec70ypNOT1wMHzQXgn.dll
-
Size
796KB
-
MD5
874b811ba8aca19ecb2c17b1fdad88b0
-
SHA1
b1af2af2bad3bb2ee6e4fbf11e50965a60f0e400
-
SHA256
13cfd306936b3cb7470eb5c5ac209437d267c3ff2875235ebc31d4d146239e4b
-
SHA512
302330b83615df66652a3974eb42a84b51a281beb0f23db49024f551e414e6ab8bd4d22275d49a22c744183b7d525dc539e5c111b934d49342726704d8d3a295
-
SSDEEP
12288:KVHML2QJe6XxhqCW4QHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqgQHXj1p0RN
Malware Config
Extracted
emotet
Epoch4
45.76.1.145:443
217.182.25.250:8080
119.193.124.41:7080
192.99.251.50:443
146.59.226.45:443
173.212.193.249:8080
207.38.84.195:8080
45.118.135.203:7080
31.24.158.56:8080
209.126.98.206:8080
212.237.17.99:8080
216.158.226.206:443
50.30.40.196:8080
82.165.152.127:8080
159.8.59.82:8080
107.182.225.142:8080
110.232.117.186:8080
72.15.201.15:8080
5.9.116.246:8080
79.172.212.216:8080
212.24.98.99:8080
188.44.20.25:443
101.50.0.91:8080
203.114.109.124:443
151.106.112.196:8080
196.218.30.83:443
176.56.128.118:443
159.65.88.10:8080
195.154.133.20:443
176.104.106.96:8080
45.118.115.99:8080
129.232.188.93:443
45.176.232.124:443
158.69.222.101:443
45.142.114.231:8080
103.221.221.247:8080
103.43.46.182:443
185.157.82.211:8080
51.91.7.5:8080
103.75.201.2:443
167.99.115.35:8080
185.8.212.130:7080
46.55.222.11:443
197.242.150.244:8080
58.227.42.236:80
195.201.151.129:8080
51.254.140.238:7080
50.116.54.215:443
138.185.72.26:8080
178.79.147.66:8080
189.126.111.200:7080
153.126.146.25:7080
103.75.201.4:443
164.68.99.3:8080
131.100.24.231:80
1.234.2.232:8080
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
regsvr32.exepid process 1228 regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1556 wrote to memory of 1228 1556 regsvr32.exe regsvr32.exe PID 1556 wrote to memory of 1228 1556 regsvr32.exe regsvr32.exe PID 1556 wrote to memory of 1228 1556 regsvr32.exe regsvr32.exe PID 1556 wrote to memory of 1228 1556 regsvr32.exe regsvr32.exe PID 1556 wrote to memory of 1228 1556 regsvr32.exe regsvr32.exe PID 1556 wrote to memory of 1228 1556 regsvr32.exe regsvr32.exe PID 1556 wrote to memory of 1228 1556 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\3a4uoSOec70ypNOT1wMHzQXgn.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\3a4uoSOec70ypNOT1wMHzQXgn.dll2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1228-54-0x00000000006B0000-0x00000000006FD000-memory.dmpFilesize
308KB