Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
30-09-2023 10:20
Static task
static1
Behavioral task
behavioral1
Sample
ec645d72efbe52fba3fd84a30004b6e35c693463a0eed9d8349975646b88aedb.dll
Resource
win7-20230831-en
General
-
Target
ec645d72efbe52fba3fd84a30004b6e35c693463a0eed9d8349975646b88aedb.dll
-
Size
469KB
-
MD5
38df12964f43135d80e874c814a09c2c
-
SHA1
f39fbcbf25cef37854e1c456959945c4a154c958
-
SHA256
ec645d72efbe52fba3fd84a30004b6e35c693463a0eed9d8349975646b88aedb
-
SHA512
0213428516481769c1a4373788ec1222d405e0d98e9bf665470fa6c2d7ad43f8e52a12cb6451561b5daeb9adc36b864207143b2efa76b4442a9083b0532d49ed
-
SSDEEP
12288:rs+k+BhmNW5gjmFloqiiiYoWoXvJMTCW648U4h5+I:rJbmNWhFloqiiiYoWoXvJM+fU4K
Malware Config
Extracted
emotet
Epoch4
131.100.24.231:80
209.59.138.75:7080
103.8.26.103:8080
51.38.71.0:443
212.237.17.99:8080
79.172.212.216:8080
207.38.84.195:8080
104.168.155.129:8080
178.79.147.66:8080
46.55.222.11:443
103.8.26.102:8080
192.254.71.210:443
45.176.232.124:443
203.114.109.124:443
51.68.175.8:8080
58.227.42.236:80
45.142.114.231:8080
217.182.143.207:443
178.63.25.185:443
45.118.115.99:8080
103.75.201.2:443
104.251.214.46:8080
158.69.222.101:443
81.0.236.90:443
45.118.135.203:7080
176.104.106.96:8080
212.237.56.116:7080
216.158.226.206:443
173.212.193.249:8080
50.116.54.215:443
138.185.72.26:8080
41.76.108.46:8080
212.237.5.209:443
107.182.225.142:8080
195.154.133.20:443
162.214.50.39:7080
110.232.117.186:8080
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 3868 wrote to memory of 3648 3868 regsvr32.exe regsvr32.exe PID 3868 wrote to memory of 3648 3868 regsvr32.exe regsvr32.exe PID 3868 wrote to memory of 3648 3868 regsvr32.exe regsvr32.exe PID 3648 wrote to memory of 1992 3648 regsvr32.exe rundll32.exe PID 3648 wrote to memory of 1992 3648 regsvr32.exe rundll32.exe PID 3648 wrote to memory of 1992 3648 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\ec645d72efbe52fba3fd84a30004b6e35c693463a0eed9d8349975646b88aedb.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\ec645d72efbe52fba3fd84a30004b6e35c693463a0eed9d8349975646b88aedb.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ec645d72efbe52fba3fd84a30004b6e35c693463a0eed9d8349975646b88aedb.dll",DllRegisterServer3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3648-0-0x0000000002FF0000-0x0000000003016000-memory.dmpFilesize
152KB