Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/11/2024, 20:46
Static task
static1
Behavioral task
behavioral1
Sample
e7d3e7ff082d1fb73f9f0a85195a55c24cb86ac69f9230e8401cfacbc5429173.dll
Resource
win7-20240903-en
General
-
Target
e7d3e7ff082d1fb73f9f0a85195a55c24cb86ac69f9230e8401cfacbc5429173.dll
-
Size
810KB
-
MD5
3f0b89ae913d51909eff97dba88c7293
-
SHA1
e1fa4fd22da29c9d9bb1fc6d09bbf2b57cd7c05c
-
SHA256
e7d3e7ff082d1fb73f9f0a85195a55c24cb86ac69f9230e8401cfacbc5429173
-
SHA512
7c945f4d0ef84449cd2c1704ee0b266e8f75cbb6d2e3ff589e38e71723f922fdc196905f8e890392659976c841ef4c29fc641f626a3185d892c276897eb2b68c
-
SSDEEP
12288:5e62IbUp6cgHVysjTEs0auETHl4GbOX4NNVjmFuu4I7Sk4BwhWyy6W0WTbhRQ:5e6T06hHXEYHl4GbOX4NN0V77syET9R
Malware Config
Extracted
emotet
Epoch4
172.104.227.98:443
31.207.89.74:8080
46.55.222.11:443
41.76.108.46:8080
103.8.26.103:8080
185.184.25.237:8080
103.8.26.102:8080
203.114.109.124:443
45.118.115.99:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
192.254.71.210:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
212.237.17.99:8080
212.237.56.116:7080
216.158.226.206:443
110.232.117.186:8080
158.69.222.101:443
107.182.225.142:8080
176.104.106.96:8080
81.0.236.90:443
50.116.54.215:443
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
Emotet family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2656 2112 regsvr32.exe 30 PID 2112 wrote to memory of 2656 2112 regsvr32.exe 30 PID 2112 wrote to memory of 2656 2112 regsvr32.exe 30 PID 2112 wrote to memory of 2656 2112 regsvr32.exe 30 PID 2112 wrote to memory of 2656 2112 regsvr32.exe 30 PID 2112 wrote to memory of 2656 2112 regsvr32.exe 30 PID 2112 wrote to memory of 2656 2112 regsvr32.exe 30 PID 2656 wrote to memory of 2416 2656 regsvr32.exe 31 PID 2656 wrote to memory of 2416 2656 regsvr32.exe 31 PID 2656 wrote to memory of 2416 2656 regsvr32.exe 31 PID 2656 wrote to memory of 2416 2656 regsvr32.exe 31 PID 2656 wrote to memory of 2416 2656 regsvr32.exe 31 PID 2656 wrote to memory of 2416 2656 regsvr32.exe 31 PID 2656 wrote to memory of 2416 2656 regsvr32.exe 31
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\e7d3e7ff082d1fb73f9f0a85195a55c24cb86ac69f9230e8401cfacbc5429173.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\e7d3e7ff082d1fb73f9f0a85195a55c24cb86ac69f9230e8401cfacbc5429173.dll2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\e7d3e7ff082d1fb73f9f0a85195a55c24cb86ac69f9230e8401cfacbc5429173.dll",DllRegisterServer3⤵
- System Location Discovery: System Language Discovery
PID:2416
-
-