Analysis
-
max time kernel
144s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/11/2024, 21:41
Static task
static1
Behavioral task
behavioral1
Sample
26fc0d6eed9e7407645faf0efabd6fb6b5af9ccf9c386013acfaf05c5e4690a1.dll
Resource
win7-20240903-en
General
-
Target
26fc0d6eed9e7407645faf0efabd6fb6b5af9ccf9c386013acfaf05c5e4690a1.dll
-
Size
696KB
-
MD5
f222409d5fe90c9d2bb8a3862f608c4e
-
SHA1
2fb663d187bd269710b0d9bfa401f06a5bbf83be
-
SHA256
26fc0d6eed9e7407645faf0efabd6fb6b5af9ccf9c386013acfaf05c5e4690a1
-
SHA512
ac5a35933489116eee2672e84234739c9aab76144015ad327ace9bf3a6c3d0b2f28a2cc9e31e3e77903f19bd4f4b50a8bd25307f5ed2efb8493ffc1724d1697d
-
SSDEEP
12288:FqQlvIOH0GCTBHmPt4eBQhDico09cDlB4Vx/ID:0uH0GCNeQZi7H0
Malware Config
Extracted
emotet
Epoch4
91.200.186.228:443
41.76.108.46:8080
188.165.214.166:7080
191.252.196.221:8080
103.8.26.103:8080
185.184.25.237:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
212.237.17.99:8080
212.237.56.116:7080
216.158.226.206:443
110.232.117.186:8080
158.69.222.101:443
107.182.225.142:8080
176.104.106.96:8080
81.0.236.90:443
50.116.54.215:443
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
Emotet family
-
Blocklisted process makes network request 11 IoCs
flow pid Process 14 3340 rundll32.exe 21 3340 rundll32.exe 34 3340 rundll32.exe 35 3340 rundll32.exe 36 3340 rundll32.exe 37 3340 rundll32.exe 42 3340 rundll32.exe 44 3340 rundll32.exe 47 3340 rundll32.exe 48 3340 rundll32.exe 50 3340 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3340 rundll32.exe 3340 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1560 wrote to memory of 2164 1560 rundll32.exe 85 PID 1560 wrote to memory of 2164 1560 rundll32.exe 85 PID 1560 wrote to memory of 2164 1560 rundll32.exe 85 PID 2164 wrote to memory of 3340 2164 rundll32.exe 86 PID 2164 wrote to memory of 3340 2164 rundll32.exe 86 PID 2164 wrote to memory of 3340 2164 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\26fc0d6eed9e7407645faf0efabd6fb6b5af9ccf9c386013acfaf05c5e4690a1.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\26fc0d6eed9e7407645faf0efabd6fb6b5af9ccf9c386013acfaf05c5e4690a1.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\26fc0d6eed9e7407645faf0efabd6fb6b5af9ccf9c386013acfaf05c5e4690a1.dll",Control_RunDLL3⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3340
-
-