Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-02-2024 21:57
Static task
static1
Behavioral task
behavioral1
Sample
a51d37ca247a557b10b0392a1e2d9a3c2a9808f0346e2a56c145aa091edbe7a6.dll
Resource
win7-20240221-en
General
-
Target
a51d37ca247a557b10b0392a1e2d9a3c2a9808f0346e2a56c145aa091edbe7a6.dll
-
Size
380KB
-
MD5
7d553192201f0f9500ebbe24ee0ff1a5
-
SHA1
8d653752409bac25759183ce9a5032f87f637525
-
SHA256
a51d37ca247a557b10b0392a1e2d9a3c2a9808f0346e2a56c145aa091edbe7a6
-
SHA512
24271cba7b7718819e5fbe77e5c65aa1f87fa73db73203072b7bf40377b2a73fb409b9a44ad638562ab8e0f35d8475e8abe8afbb4d7e17a1d8ca107b7c41a10a
-
SSDEEP
6144:wcvynX8aBmTd9m6qH4YCfPvogjav1iP/I4y8OQLZxUHfy11:/vynLkTbm2og7HHZ6y
Malware Config
Extracted
emotet
Epoch4
104.131.11.205:443
138.197.109.175:8080
187.84.80.182:443
79.143.187.147:443
189.232.46.161:443
51.91.76.89:8080
103.43.46.182:443
206.189.28.199:8080
45.176.232.124:443
107.182.225.142:8080
72.15.201.15:8080
209.250.246.206:443
164.68.99.3:8080
160.16.142.56:8080
134.122.66.193:8080
45.118.115.99:8080
183.111.227.137:8080
209.126.98.206:8080
1.234.2.232:8080
159.65.88.10:8080
5.9.116.246:8080
82.165.152.127:8080
197.242.150.244:8080
212.24.98.99:8080
185.8.212.130:7080
51.254.140.238:7080
119.193.124.41:7080
103.132.242.26:8080
50.30.40.196:8080
188.44.20.25:443
101.50.0.91:8080
167.172.253.162:8080
185.157.82.211:8080
167.99.115.35:8080
196.218.30.83:443
216.158.226.206:443
176.56.128.118:443
146.59.226.45:443
212.237.17.99:8080
129.232.188.93:443
173.212.193.249:8080
189.126.111.200:7080
103.70.28.102:8080
46.55.222.11:443
158.69.222.101:443
79.172.212.216:8080
151.106.112.196:8080
192.99.251.50:443
103.75.201.2:443
51.91.7.5:8080
1.234.21.73:7080
58.227.42.236:80
153.126.146.25:7080
201.94.166.162:443
172.104.251.154:8080
110.232.117.186:8080
159.8.59.82:8080
176.104.106.96:8080
203.114.109.124:443
131.100.24.231:80
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
regsvr32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Ujobeofss\tjjgbite.zyo regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
regsvr32.exepid process 1312 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 2216 regsvr32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1736 wrote to memory of 2216 1736 regsvr32.exe regsvr32.exe PID 1736 wrote to memory of 2216 1736 regsvr32.exe regsvr32.exe PID 1736 wrote to memory of 2216 1736 regsvr32.exe regsvr32.exe PID 1736 wrote to memory of 2216 1736 regsvr32.exe regsvr32.exe PID 1736 wrote to memory of 2216 1736 regsvr32.exe regsvr32.exe PID 1736 wrote to memory of 2216 1736 regsvr32.exe regsvr32.exe PID 1736 wrote to memory of 2216 1736 regsvr32.exe regsvr32.exe PID 2216 wrote to memory of 1312 2216 regsvr32.exe regsvr32.exe PID 2216 wrote to memory of 1312 2216 regsvr32.exe regsvr32.exe PID 2216 wrote to memory of 1312 2216 regsvr32.exe regsvr32.exe PID 2216 wrote to memory of 1312 2216 regsvr32.exe regsvr32.exe PID 2216 wrote to memory of 1312 2216 regsvr32.exe regsvr32.exe PID 2216 wrote to memory of 1312 2216 regsvr32.exe regsvr32.exe PID 2216 wrote to memory of 1312 2216 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\a51d37ca247a557b10b0392a1e2d9a3c2a9808f0346e2a56c145aa091edbe7a6.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\a51d37ca247a557b10b0392a1e2d9a3c2a9808f0346e2a56c145aa091edbe7a6.dll2⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Ujobeofss\tjjgbite.zyo"3⤵
- Suspicious behavior: EnumeratesProcesses