Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-02-2024 21:32
Static task
static1
Behavioral task
behavioral1
Sample
7ee13284da9a82280ea50ad590f0a1f835c5bc4ab2f1b679a22164d5a9cc43ce.dll
Resource
win7-20240221-en
General
-
Target
7ee13284da9a82280ea50ad590f0a1f835c5bc4ab2f1b679a22164d5a9cc43ce.dll
-
Size
745KB
-
MD5
decb82105944f63eca54a091f644a38d
-
SHA1
0091fcaeb94ebf1a542b75ee2a161c91aa528b50
-
SHA256
7ee13284da9a82280ea50ad590f0a1f835c5bc4ab2f1b679a22164d5a9cc43ce
-
SHA512
31360f77f4da97fb50a866f7994bccfa39330426a111705d6a495243eef6876b08e0e5e8c013a3be04a890abab62bbb91763dc568e11cba65f619377c0f250f1
-
SSDEEP
12288:pw/seyLAdTA2tSgy/O+TSKZUWozyFl/ygOdIh2t+ZxmmPqVZ7Y1nrJS:i/18kTAY72TSYB/ygt2Xma7+rM
Malware Config
Extracted
emotet
Epoch5
45.138.98.34:80
69.16.218.101:8080
51.210.242.234:8080
185.148.168.220:8080
142.4.219.173:8080
54.38.242.185:443
191.252.103.16:80
104.131.62.48:8080
62.171.178.147:8080
217.182.143.207:443
168.197.250.14:80
37.44.244.177:8080
66.42.57.149:443
210.57.209.142:8080
159.69.237.188:443
116.124.128.206:8080
128.199.192.135:8080
195.154.146.35:443
185.148.168.15:8080
195.77.239.39:8080
207.148.81.119:8080
85.214.67.203:8080
190.90.233.66:443
78.46.73.125:443
78.47.204.80:443
37.59.209.141:8080
54.37.228.122:443
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 2228 wrote to memory of 1820 2228 regsvr32.exe regsvr32.exe PID 2228 wrote to memory of 1820 2228 regsvr32.exe regsvr32.exe PID 2228 wrote to memory of 1820 2228 regsvr32.exe regsvr32.exe PID 2228 wrote to memory of 1820 2228 regsvr32.exe regsvr32.exe PID 2228 wrote to memory of 1820 2228 regsvr32.exe regsvr32.exe PID 2228 wrote to memory of 1820 2228 regsvr32.exe regsvr32.exe PID 2228 wrote to memory of 1820 2228 regsvr32.exe regsvr32.exe PID 1820 wrote to memory of 2052 1820 regsvr32.exe rundll32.exe PID 1820 wrote to memory of 2052 1820 regsvr32.exe rundll32.exe PID 1820 wrote to memory of 2052 1820 regsvr32.exe rundll32.exe PID 1820 wrote to memory of 2052 1820 regsvr32.exe rundll32.exe PID 1820 wrote to memory of 2052 1820 regsvr32.exe rundll32.exe PID 1820 wrote to memory of 2052 1820 regsvr32.exe rundll32.exe PID 1820 wrote to memory of 2052 1820 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\7ee13284da9a82280ea50ad590f0a1f835c5bc4ab2f1b679a22164d5a9cc43ce.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\7ee13284da9a82280ea50ad590f0a1f835c5bc4ab2f1b679a22164d5a9cc43ce.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\7ee13284da9a82280ea50ad590f0a1f835c5bc4ab2f1b679a22164d5a9cc43ce.dll",DllRegisterServer3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1820-0-0x0000000000270000-0x0000000000298000-memory.dmpFilesize
160KB