Analysis
-
max time kernel
142s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26-02-2024 21:34
Static task
static1
Behavioral task
behavioral1
Sample
87ba201306f7278942243210f607cbaaa54ee015f412b40c36d7177f0b126dd2.dll
Resource
win7-20240221-en
General
-
Target
87ba201306f7278942243210f607cbaaa54ee015f412b40c36d7177f0b126dd2.dll
-
Size
684KB
-
MD5
99eb89aaa5e81d5270a5c04fbb580481
-
SHA1
a430b4d9067a9e0704bc13c399146a611638f612
-
SHA256
87ba201306f7278942243210f607cbaaa54ee015f412b40c36d7177f0b126dd2
-
SHA512
6ffeda782de0e91710a42209fe8904f3b5d1c893456f87e4af1070479385b41323f7bdae2ae86e09345eca00ab8cc266bb8fe38c3370365b6348b4839142f772
-
SSDEEP
6144:F/aZgRXcZdinj5y1baFLk5Dw2jb7t3mJXzQbaCIXilmj2cO8h35jnL/nvYwFaRVb:BamncoLAbcduxmSc/Jf/ngwFGMD0sg
Malware Config
Extracted
emotet
Epoch5
51.75.33.122:443
186.250.48.5:80
168.119.39.118:443
207.148.81.119:8080
194.9.172.107:8080
139.196.72.155:8080
78.47.204.80:443
159.69.237.188:443
45.71.195.104:8080
54.37.106.167:8080
185.168.130.138:443
37.44.244.177:8080
185.184.25.78:8080
185.148.168.15:8080
128.199.192.135:8080
37.59.209.141:8080
103.41.204.169:8080
185.148.168.220:8080
103.42.58.120:7080
78.46.73.125:443
68.183.93.250:443
190.90.233.66:443
5.56.132.177:8080
62.171.178.147:8080
196.44.98.190:8080
168.197.250.14:80
66.42.57.149:443
59.148.253.194:443
104.131.62.48:8080
191.252.103.16:80
54.37.228.122:443
88.217.172.165:8080
195.77.239.39:8080
116.124.128.206:8080
93.104.209.107:8080
118.98.72.86:443
217.182.143.207:443
87.106.97.83:7080
210.57.209.142:8080
54.38.242.185:443
195.154.146.35:443
203.153.216.46:443
198.199.98.78:8080
85.214.67.203:8080
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1644 regsvr32.exe -
Drops file in System32 directory 1 IoCs
Processes:
regsvr32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Osdgzgdy\cornf.mcv regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 1644 regsvr32.exe 1644 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 2248 regsvr32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 984 wrote to memory of 2248 984 regsvr32.exe regsvr32.exe PID 984 wrote to memory of 2248 984 regsvr32.exe regsvr32.exe PID 984 wrote to memory of 2248 984 regsvr32.exe regsvr32.exe PID 2248 wrote to memory of 1644 2248 regsvr32.exe regsvr32.exe PID 2248 wrote to memory of 1644 2248 regsvr32.exe regsvr32.exe PID 2248 wrote to memory of 1644 2248 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\87ba201306f7278942243210f607cbaaa54ee015f412b40c36d7177f0b126dd2.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\87ba201306f7278942243210f607cbaaa54ee015f412b40c36d7177f0b126dd2.dll2⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Osdgzgdy\cornf.mcv"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3972 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\Osdgzgdy\cornf.mcvFilesize
684KB
MD599eb89aaa5e81d5270a5c04fbb580481
SHA1a430b4d9067a9e0704bc13c399146a611638f612
SHA25687ba201306f7278942243210f607cbaaa54ee015f412b40c36d7177f0b126dd2
SHA5126ffeda782de0e91710a42209fe8904f3b5d1c893456f87e4af1070479385b41323f7bdae2ae86e09345eca00ab8cc266bb8fe38c3370365b6348b4839142f772
-
memory/1644-4-0x0000000001190000-0x00000000011B7000-memory.dmpFilesize
156KB
-
memory/2248-0-0x00000000010E0000-0x0000000001107000-memory.dmpFilesize
156KB