Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/11/2024, 21:35
Static task
static1
Behavioral task
behavioral1
Sample
c0c8c68c743d6aa42eb72a0e0fc46baea28ef86858e7670ba39f0a1d7690bf36.dll
Resource
win7-20240903-en
General
-
Target
c0c8c68c743d6aa42eb72a0e0fc46baea28ef86858e7670ba39f0a1d7690bf36.dll
-
Size
176KB
-
MD5
11f440ea7e935b2e72e9a5f6182c60f2
-
SHA1
36da681821858afd12ab4cab8b734ff1db02c97f
-
SHA256
c0c8c68c743d6aa42eb72a0e0fc46baea28ef86858e7670ba39f0a1d7690bf36
-
SHA512
d155c49a94e451623d4e219da7e6d9f4227762cc675d421955fd99ba0f6da2aea41027bda9463bb73127a0599d3d4f4537bdbb48b66489321d8554bcdbfc1a4b
-
SSDEEP
3072:VpjftHFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRVi1/wm//KgWeIkGwCN
Malware Config
Extracted
emotet
Epoch4
94.23.45.86:4143
129.232.188.93:443
213.241.20.155:443
197.242.150.244:8080
172.104.251.154:8080
46.55.222.11:443
82.223.21.224:8080
5.9.116.246:8080
1.234.2.232:8080
146.59.226.45:443
160.16.142.56:8080
115.68.227.76:8080
72.15.201.15:8080
188.44.20.25:443
185.4.135.165:8080
103.132.242.26:8080
173.212.193.249:8080
163.44.196.120:8080
183.111.227.137:8080
149.56.131.28:8080
212.24.98.99:8080
159.65.140.115:443
150.95.66.124:8080
107.170.39.149:8080
203.114.109.124:443
41.73.252.195:443
37.187.115.122:8080
82.165.152.127:8080
119.193.124.41:7080
103.75.201.2:443
79.137.35.198:8080
159.65.88.10:8080
209.126.98.206:8080
167.172.253.162:8080
186.194.240.217:443
51.254.140.238:7080
51.91.76.89:8080
153.126.146.25:7080
207.180.241.186:8080
206.189.28.199:8080
45.176.232.124:443
103.70.28.102:8080
158.69.222.101:443
151.106.112.196:8080
103.43.75.120:443
91.207.28.33:8080
159.89.202.34:443
45.186.16.18:443
45.235.8.30:8080
201.94.166.162:443
164.68.99.3:8080
110.232.117.186:8080
45.118.115.99:8080
207.148.79.14:8080
131.100.24.231:80
31.22.4.160:8080
134.122.66.193:8080
196.218.30.83:443
209.97.163.214:443
1.234.21.73:7080
101.50.0.91:8080
Signatures
-
Emotet family
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2112 regsvr32.exe 2808 regsvr32.exe 2808 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2112 regsvr32.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2808 2112 regsvr32.exe 30 PID 2112 wrote to memory of 2808 2112 regsvr32.exe 30 PID 2112 wrote to memory of 2808 2112 regsvr32.exe 30 PID 2112 wrote to memory of 2808 2112 regsvr32.exe 30 PID 2112 wrote to memory of 2808 2112 regsvr32.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\c0c8c68c743d6aa42eb72a0e0fc46baea28ef86858e7670ba39f0a1d7690bf36.dll1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\WPevGGNrJ\VghSsIDiljqODp.dll"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2808
-