Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
12/11/2024, 21:43
Static task
static1
Behavioral task
behavioral1
Sample
49031194b9118808d2a599fe6a1465f043eecee714d12cf3ff84f5e6af1c681a.dll
Resource
win7-20241010-en
General
-
Target
49031194b9118808d2a599fe6a1465f043eecee714d12cf3ff84f5e6af1c681a.dll
-
Size
705KB
-
MD5
19be31f164def65f950382fc9a09218d
-
SHA1
e42e38720d3f911d441d914c93c8ff2ce61dffe1
-
SHA256
49031194b9118808d2a599fe6a1465f043eecee714d12cf3ff84f5e6af1c681a
-
SHA512
a5b8da4eb8099e791e2c40bcca4796f25fa1f418b3981fa044fa6234f1c64f7912e79f09e833341d56e486e327aadcefc147cc941246a8b82e1a481b2f15bfec
-
SSDEEP
12288:+AnhPnRuQ422ZA2uWwMaJsN6Q7z0CUWe0orIxG0Bv1tgV:RpncLJZA2LwpJsNtZUWeGoOg
Malware Config
Extracted
emotet
Epoch4
51.77.82.125:443
69.197.160.180:8080
103.75.201.2:443
173.212.193.249:8080
45.118.135.203:7080
45.118.115.99:8080
162.243.175.63:443
192.254.71.210:443
50.116.54.215:443
51.38.71.0:443
138.185.72.26:8080
131.100.24.231:80
212.237.5.209:443
209.59.138.75:7080
176.104.106.96:8080
107.182.225.142:8080
45.142.114.231:8080
212.237.56.116:7080
207.38.84.195:8080
158.69.222.101:443
104.251.214.46:8080
104.168.155.129:8080
46.55.222.11:443
103.8.26.102:8080
58.227.42.236:80
164.68.99.3:8080
203.114.109.124:443
216.158.226.206:443
178.63.25.185:443
103.8.26.103:8080
195.154.133.20:443
45.176.232.124:443
41.76.108.46:8080
81.0.236.90:443
178.79.147.66:8080
212.24.98.99:8080
217.182.143.207:443
110.232.117.186:8080
162.214.50.39:7080
212.237.17.99:8080
185.157.82.211:8080
79.172.212.216:8080
Signatures
-
Emotet family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1840 wrote to memory of 2296 1840 regsvr32.exe 31 PID 1840 wrote to memory of 2296 1840 regsvr32.exe 31 PID 1840 wrote to memory of 2296 1840 regsvr32.exe 31 PID 1840 wrote to memory of 2296 1840 regsvr32.exe 31 PID 1840 wrote to memory of 2296 1840 regsvr32.exe 31 PID 1840 wrote to memory of 2296 1840 regsvr32.exe 31 PID 1840 wrote to memory of 2296 1840 regsvr32.exe 31 PID 2296 wrote to memory of 2536 2296 regsvr32.exe 32 PID 2296 wrote to memory of 2536 2296 regsvr32.exe 32 PID 2296 wrote to memory of 2536 2296 regsvr32.exe 32 PID 2296 wrote to memory of 2536 2296 regsvr32.exe 32 PID 2296 wrote to memory of 2536 2296 regsvr32.exe 32 PID 2296 wrote to memory of 2536 2296 regsvr32.exe 32 PID 2296 wrote to memory of 2536 2296 regsvr32.exe 32
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\49031194b9118808d2a599fe6a1465f043eecee714d12cf3ff84f5e6af1c681a.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\49031194b9118808d2a599fe6a1465f043eecee714d12cf3ff84f5e6af1c681a.dll2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\49031194b9118808d2a599fe6a1465f043eecee714d12cf3ff84f5e6af1c681a.dll",DllRegisterServer3⤵
- System Location Discovery: System Language Discovery
PID:2536
-
-