Analysis

  • max time kernel
    144s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12/11/2024, 21:34

General

  • Target

    332e58d7465ea8abc96045258bc5412b942813c98b1a4acc1d6ec402bac79f05.dll

  • Size

    516KB

  • MD5

    ec0da4e4e6121507e18a4244c0a58656

  • SHA1

    2808e9cf1524fb6046e52ad57e7e6d9219affa63

  • SHA256

    332e58d7465ea8abc96045258bc5412b942813c98b1a4acc1d6ec402bac79f05

  • SHA512

    5d3a8af341d99aff4a6fcd9d6e5ef641b385b00b6d5d8726079c1d0a302e6ad7c66f342cd1e33c9ad00215cb6c1806f128b112116af8ad64e6df8d83a24d721e

  • SSDEEP

    6144:mW1239bnTe+0Qv7NSEBj43USaI6Y/jOpxHRikSYI+QALgIJ1divndEXQn:mW1e9PeexPBjvKSpuvYI+TLgs1dcEXQ

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

202.28.34.99:8080

80.211.107.116:8080

175.126.176.79:8080

218.38.121.17:443

139.196.72.155:8080

103.71.99.57:8080

87.106.97.83:7080

178.62.112.199:8080

64.227.55.231:8080

46.101.98.60:8080

54.37.228.122:443

128.199.217.206:443

190.145.8.4:443

209.239.112.82:8080

85.214.67.203:8080

198.199.70.22:8080

128.199.242.164:8080

178.238.225.252:8080

103.85.95.4:8080

103.126.216.86:443

eck1.plain
ecs1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet family
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\332e58d7465ea8abc96045258bc5412b942813c98b1a4acc1d6ec402bac79f05.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2496
    • C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe "C:\Windows\system32\QsYDpcuiHGtq\xFNDT.dll"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2992

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2496-1-0x0000000180000000-0x000000018002E000-memory.dmp

          Filesize

          184KB

        • memory/2496-0-0x00000000003F0000-0x00000000003F1000-memory.dmp

          Filesize

          4KB

        • memory/2496-7-0x000007FEF6FA0000-0x000007FEF7029000-memory.dmp

          Filesize

          548KB

        • memory/2992-8-0x000007FEF6FA0000-0x000007FEF7029000-memory.dmp

          Filesize

          548KB

        • memory/2992-11-0x000007FEF6FA0000-0x000007FEF7029000-memory.dmp

          Filesize

          548KB

        • memory/2992-18-0x000007FEF6FA0000-0x000007FEF7029000-memory.dmp

          Filesize

          548KB