Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/11/2024, 21:45
Static task
static1
Behavioral task
behavioral1
Sample
239e2b84c96b9995dcd468ff482b0214a70c93f0a2d354ac49b5e51384cea69f.dll
Resource
win7-20240903-en
General
-
Target
239e2b84c96b9995dcd468ff482b0214a70c93f0a2d354ac49b5e51384cea69f.dll
-
Size
696KB
-
MD5
b8c1dc8f61eb4f0d9ab6e4bb4d351c60
-
SHA1
b51c48229bfb288a35e49c40268734995214877e
-
SHA256
239e2b84c96b9995dcd468ff482b0214a70c93f0a2d354ac49b5e51384cea69f
-
SHA512
2b61db2ac8ac9d492dd94fd8d5bf1cd913aff229e613671ead7bf8ec1ee81807d86fe224136a271fd216086b5bd712ccb97b2c56f8a4ebd6fe686fbb695b49c5
-
SSDEEP
12288:FqQlvIOH0GCTBHmPt4eBQhdico09cDlB4Vx/ID:0uH0GCNeQLi7H0
Malware Config
Extracted
emotet
Epoch4
91.200.186.228:443
41.76.108.46:8080
188.165.214.166:7080
191.252.196.221:8080
103.8.26.103:8080
185.184.25.237:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
212.237.17.99:8080
212.237.56.116:7080
216.158.226.206:443
110.232.117.186:8080
158.69.222.101:443
107.182.225.142:8080
176.104.106.96:8080
81.0.236.90:443
50.116.54.215:443
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
Emotet family
-
Blocklisted process makes network request 11 IoCs
flow pid Process 15 4148 rundll32.exe 20 4148 rundll32.exe 34 4148 rundll32.exe 35 4148 rundll32.exe 36 4148 rundll32.exe 37 4148 rundll32.exe 41 4148 rundll32.exe 42 4148 rundll32.exe 48 4148 rundll32.exe 49 4148 rundll32.exe 51 4148 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4148 rundll32.exe 4148 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1808 wrote to memory of 4672 1808 rundll32.exe 83 PID 1808 wrote to memory of 4672 1808 rundll32.exe 83 PID 1808 wrote to memory of 4672 1808 rundll32.exe 83 PID 4672 wrote to memory of 4148 4672 rundll32.exe 85 PID 4672 wrote to memory of 4148 4672 rundll32.exe 85 PID 4672 wrote to memory of 4148 4672 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\239e2b84c96b9995dcd468ff482b0214a70c93f0a2d354ac49b5e51384cea69f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\239e2b84c96b9995dcd468ff482b0214a70c93f0a2d354ac49b5e51384cea69f.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\239e2b84c96b9995dcd468ff482b0214a70c93f0a2d354ac49b5e51384cea69f.dll",Control_RunDLL3⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4148
-
-