Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2023 12:42
Static task
static1
Behavioral task
behavioral1
Sample
3a4uoSOec70ypNOT1wMHzQXgn.dll
Resource
win7-20230621-en
General
-
Target
3a4uoSOec70ypNOT1wMHzQXgn.dll
-
Size
796KB
-
MD5
874b811ba8aca19ecb2c17b1fdad88b0
-
SHA1
b1af2af2bad3bb2ee6e4fbf11e50965a60f0e400
-
SHA256
13cfd306936b3cb7470eb5c5ac209437d267c3ff2875235ebc31d4d146239e4b
-
SHA512
302330b83615df66652a3974eb42a84b51a281beb0f23db49024f551e414e6ab8bd4d22275d49a22c744183b7d525dc539e5c111b934d49342726704d8d3a295
-
SSDEEP
12288:KVHML2QJe6XxhqCW4QHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqgQHXj1p0RN
Malware Config
Extracted
emotet
Epoch4
45.76.1.145:443
217.182.25.250:8080
119.193.124.41:7080
192.99.251.50:443
146.59.226.45:443
173.212.193.249:8080
207.38.84.195:8080
45.118.135.203:7080
31.24.158.56:8080
209.126.98.206:8080
212.237.17.99:8080
216.158.226.206:443
50.30.40.196:8080
82.165.152.127:8080
159.8.59.82:8080
107.182.225.142:8080
110.232.117.186:8080
72.15.201.15:8080
5.9.116.246:8080
79.172.212.216:8080
212.24.98.99:8080
188.44.20.25:443
101.50.0.91:8080
203.114.109.124:443
151.106.112.196:8080
196.218.30.83:443
176.56.128.118:443
159.65.88.10:8080
195.154.133.20:443
176.104.106.96:8080
45.118.115.99:8080
129.232.188.93:443
45.176.232.124:443
158.69.222.101:443
45.142.114.231:8080
103.221.221.247:8080
103.43.46.182:443
185.157.82.211:8080
51.91.7.5:8080
103.75.201.2:443
167.99.115.35:8080
185.8.212.130:7080
46.55.222.11:443
197.242.150.244:8080
58.227.42.236:80
195.201.151.129:8080
51.254.140.238:7080
50.116.54.215:443
138.185.72.26:8080
178.79.147.66:8080
189.126.111.200:7080
153.126.146.25:7080
103.75.201.4:443
164.68.99.3:8080
131.100.24.231:80
1.234.2.232:8080
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 2420 regsvr32.exe -
Drops file in System32 directory 1 IoCs
Processes:
regsvr32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Yzmrvmywz\ojjiyuzieime.xrk regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 2420 regsvr32.exe 2420 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 1228 regsvr32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2300 wrote to memory of 1228 2300 regsvr32.exe regsvr32.exe PID 2300 wrote to memory of 1228 2300 regsvr32.exe regsvr32.exe PID 2300 wrote to memory of 1228 2300 regsvr32.exe regsvr32.exe PID 1228 wrote to memory of 2420 1228 regsvr32.exe regsvr32.exe PID 1228 wrote to memory of 2420 1228 regsvr32.exe regsvr32.exe PID 1228 wrote to memory of 2420 1228 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\3a4uoSOec70ypNOT1wMHzQXgn.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\3a4uoSOec70ypNOT1wMHzQXgn.dll2⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Yzmrvmywz\ojjiyuzieime.xrk"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\Yzmrvmywz\ojjiyuzieime.xrkFilesize
796KB
MD5874b811ba8aca19ecb2c17b1fdad88b0
SHA1b1af2af2bad3bb2ee6e4fbf11e50965a60f0e400
SHA25613cfd306936b3cb7470eb5c5ac209437d267c3ff2875235ebc31d4d146239e4b
SHA512302330b83615df66652a3974eb42a84b51a281beb0f23db49024f551e414e6ab8bd4d22275d49a22c744183b7d525dc539e5c111b934d49342726704d8d3a295
-
memory/1228-133-0x0000000002660000-0x00000000026AD000-memory.dmpFilesize
308KB
-
memory/2420-138-0x0000000002DB0000-0x0000000002DFD000-memory.dmpFilesize
308KB