Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26-02-2024 21:32
Static task
static1
Behavioral task
behavioral1
Sample
2f65aaa1cd38a4f10ab6bb47f25c8e622cd5e2c2f688e1c56425b999dcbbf9b7.dll
Resource
win7-20240221-en
General
-
Target
2f65aaa1cd38a4f10ab6bb47f25c8e622cd5e2c2f688e1c56425b999dcbbf9b7.dll
-
Size
807KB
-
MD5
1ccf3a827f442a334ae169ab192b35aa
-
SHA1
a8c82063cb9ce425f089f7dc3bd57dd7b8de104a
-
SHA256
2f65aaa1cd38a4f10ab6bb47f25c8e622cd5e2c2f688e1c56425b999dcbbf9b7
-
SHA512
49dae9d048fa785ee9b7a9e72ac3e4f329416224b7770889d22d165450cd26ac1b3c4723c33ef56950f735583dcfb1bcd54cf6c2d11031bfd39f4ad5fce166d9
-
SSDEEP
12288:e0cIaDb/1wUCBVpjl18kVtLga3xjZHySM+tbpZx9PIQOlp2m:ewwZBSG+3/HySVbJ9LOIm
Malware Config
Extracted
emotet
Epoch4
217.182.143.248:8080
185.4.135.27:8080
192.99.251.50:443
146.59.226.45:443
162.214.118.104:8080
195.154.133.20:443
103.75.201.2:443
5.9.116.246:8080
177.87.70.10:8080
31.24.158.56:8080
103.75.201.4:443
158.69.222.101:443
185.157.82.211:8080
185.8.212.130:7080
186.250.48.117:7080
110.232.117.186:8080
46.55.222.11:443
196.218.30.83:443
51.91.7.5:8080
176.56.128.118:443
207.38.84.195:8080
173.212.193.249:8080
45.118.135.203:7080
164.68.99.3:8080
209.126.98.206:8080
212.24.98.99:8080
151.106.112.196:8080
45.176.232.124:443
153.126.146.25:7080
212.237.17.99:8080
45.142.114.231:8080
107.182.225.142:8080
45.118.115.99:8080
79.172.212.216:8080
50.30.40.196:8080
82.165.152.127:8080
50.116.54.215:443
1.234.2.232:8080
58.227.42.236:80
216.158.226.206:443
159.8.59.82:8080
129.232.188.93:443
189.126.111.200:7080
138.185.72.26:8080
159.65.88.10:8080
103.221.221.247:8080
188.44.20.25:443
203.114.109.124:443
197.242.150.244:8080
51.254.140.238:7080
176.104.106.96:8080
178.79.147.66:8080
131.100.24.231:80
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 832 regsvr32.exe -
Drops file in System32 directory 1 IoCs
Processes:
regsvr32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Nxbhqwjzlr\eriekdwki.rwq regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 832 regsvr32.exe 832 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 2320 regsvr32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 3288 wrote to memory of 2320 3288 regsvr32.exe regsvr32.exe PID 3288 wrote to memory of 2320 3288 regsvr32.exe regsvr32.exe PID 3288 wrote to memory of 2320 3288 regsvr32.exe regsvr32.exe PID 2320 wrote to memory of 832 2320 regsvr32.exe regsvr32.exe PID 2320 wrote to memory of 832 2320 regsvr32.exe regsvr32.exe PID 2320 wrote to memory of 832 2320 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2f65aaa1cd38a4f10ab6bb47f25c8e622cd5e2c2f688e1c56425b999dcbbf9b7.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\2f65aaa1cd38a4f10ab6bb47f25c8e622cd5e2c2f688e1c56425b999dcbbf9b7.dll2⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Nxbhqwjzlr\eriekdwki.rwq"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4100 --field-trial-handle=3084,i,11997299123381683778,5904351605020331957,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\Nxbhqwjzlr\eriekdwki.rwqFilesize
807KB
MD51ccf3a827f442a334ae169ab192b35aa
SHA1a8c82063cb9ce425f089f7dc3bd57dd7b8de104a
SHA2562f65aaa1cd38a4f10ab6bb47f25c8e622cd5e2c2f688e1c56425b999dcbbf9b7
SHA51249dae9d048fa785ee9b7a9e72ac3e4f329416224b7770889d22d165450cd26ac1b3c4723c33ef56950f735583dcfb1bcd54cf6c2d11031bfd39f4ad5fce166d9
-
memory/2320-0-0x0000000010000000-0x0000000010028000-memory.dmpFilesize
160KB