Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/11/2024, 20:45
Static task
static1
Behavioral task
behavioral1
Sample
bd2b0e07d426fc30d36dba99c9a26c0f98f0161484bc0920e70c12d49e0ecea3.dll
Resource
win7-20240903-en
General
-
Target
bd2b0e07d426fc30d36dba99c9a26c0f98f0161484bc0920e70c12d49e0ecea3.dll
-
Size
209KB
-
MD5
9ef1f63016e843cf4e84a860491d121b
-
SHA1
a1cdb331bd2abe8b643360984d5feff0a4c4520a
-
SHA256
bd2b0e07d426fc30d36dba99c9a26c0f98f0161484bc0920e70c12d49e0ecea3
-
SHA512
3b3acb875a8346715fa024c798c8d78f15c47bd807be0dda7d0c763ae4ec712b30340ed248c1a943e5dff0d8aad83c247f87ce2e4a315ce3a7e55596e0a6e3ea
-
SSDEEP
3072:MVaYmiLp+AO2e0qtDs+/Vy+29S9b+WWbyTOn5rnJRsMiQF0Vd9EkuejapPs:ymIYAO2ekvX9jbR53RFg+ejaF
Malware Config
Extracted
emotet
Epoch2
74.58.215.226:80
24.164.79.147:8080
157.245.123.197:8080
50.116.111.59:8080
173.249.20.233:443
78.188.225.105:80
75.177.207.146:80
136.244.110.184:8080
194.190.67.75:80
70.92.118.112:80
110.145.101.66:443
194.4.58.192:7080
217.20.166.178:7080
109.74.5.95:8080
110.145.11.73:80
66.57.108.14:443
78.189.148.42:80
144.217.7.207:7080
120.150.60.189:80
37.139.21.175:8080
185.94.252.104:443
74.40.205.197:443
152.170.205.73:80
190.29.166.0:80
176.111.60.55:8080
47.144.21.37:80
139.99.158.11:443
172.86.188.251:8080
123.176.25.234:80
120.150.218.241:443
121.124.124.40:7080
64.207.182.168:8080
97.120.3.198:80
24.231.88.85:80
95.213.236.64:8080
5.2.212.254:80
188.165.214.98:8080
174.118.202.24:443
190.240.194.77:443
172.104.97.173:8080
61.19.246.238:443
181.165.68.127:80
24.178.90.49:80
50.245.107.73:443
37.187.72.193:8080
209.141.54.221:7080
168.235.67.138:7080
62.30.7.67:443
5.39.91.110:7080
200.116.145.225:443
62.171.142.179:8080
185.201.9.197:8080
187.161.206.24:80
190.162.215.233:80
118.83.154.64:443
134.209.144.106:443
157.245.99.39:8080
139.59.60.244:8080
50.91.114.38:80
197.211.245.21:80
93.146.48.84:80
173.70.61.180:80
67.170.250.203:443
191.112.178.60:80
24.69.65.8:8080
89.216.122.92:80
201.241.127.190:80
142.112.10.95:20
181.171.209.241:443
87.106.139.101:8080
85.105.111.166:80
78.24.219.147:8080
95.9.5.93:80
115.94.207.99:443
110.145.77.103:80
74.208.45.104:8080
119.59.116.21:8080
172.105.13.66:443
59.21.235.119:80
62.75.141.82:80
100.37.240.62:80
139.162.60.124:8080
188.219.31.12:80
109.116.245.80:80
220.245.198.194:80
2.58.16.89:8080
178.152.87.96:80
167.114.153.111:8080
49.205.182.134:80
70.180.33.202:80
161.0.153.60:80
202.134.4.211:8080
70.183.211.3:80
51.89.36.180:443
72.186.136.247:443
79.137.83.50:443
202.141.243.254:443
46.105.131.79:8080
203.153.216.189:7080
74.128.121.17:80
202.134.4.216:8080
98.109.133.80:80
104.131.11.150:443
24.179.13.119:80
41.185.28.84:8080
138.68.87.218:443
172.125.40.123:80
94.23.237.171:443
Signatures
-
Emotet family
-
Blocklisted process makes network request 6 IoCs
flow pid Process 4 2040 rundll32.exe 7 2040 rundll32.exe 8 2040 rundll32.exe 9 2040 rundll32.exe 12 2040 rundll32.exe 15 2040 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2040 2364 rundll32.exe 30 PID 2364 wrote to memory of 2040 2364 rundll32.exe 30 PID 2364 wrote to memory of 2040 2364 rundll32.exe 30 PID 2364 wrote to memory of 2040 2364 rundll32.exe 30 PID 2364 wrote to memory of 2040 2364 rundll32.exe 30 PID 2364 wrote to memory of 2040 2364 rundll32.exe 30 PID 2364 wrote to memory of 2040 2364 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bd2b0e07d426fc30d36dba99c9a26c0f98f0161484bc0920e70c12d49e0ecea3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bd2b0e07d426fc30d36dba99c9a26c0f98f0161484bc0920e70c12d49e0ecea3.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2040
-