Analysis
-
max time kernel
93s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/11/2024, 20:46
Static task
static1
Behavioral task
behavioral1
Sample
ad889ea0fb9c0c9cc5acf7e4ee60b11d7d3e2a57489b6037af604381219905ca.dll
Resource
win7-20240903-en
General
-
Target
ad889ea0fb9c0c9cc5acf7e4ee60b11d7d3e2a57489b6037af604381219905ca.dll
-
Size
716KB
-
MD5
f7fc22d45f3380173f8ac127175a0edb
-
SHA1
a20310381f258910e4c63e6f9f0f213ad8b45e77
-
SHA256
ad889ea0fb9c0c9cc5acf7e4ee60b11d7d3e2a57489b6037af604381219905ca
-
SHA512
e16ae294573ce5186ce1e9ab9e7197051d3b7a2fd1d26e4dc42b64d66a441ab24b0df3dd74a19d9454cd9658e02ffbc926f3ef660b611cc47495b7e5ec08dae4
-
SSDEEP
12288:uBicXbXtFSCaG1vqZR6KtfnCLiW0Of7qIPRJsRRV9S+QykE:Mnda6vqZltv3Of717sRRV9SB
Malware Config
Extracted
emotet
Epoch4
131.100.24.231:80
209.59.138.75:7080
103.8.26.103:8080
51.38.71.0:443
212.237.17.99:8080
79.172.212.216:8080
207.38.84.195:8080
104.168.155.129:8080
178.79.147.66:8080
46.55.222.11:443
103.8.26.102:8080
192.254.71.210:443
45.176.232.124:443
203.114.109.124:443
51.68.175.8:8080
58.227.42.236:80
45.142.114.231:8080
217.182.143.207:443
178.63.25.185:443
45.118.115.99:8080
103.75.201.2:443
104.251.214.46:8080
158.69.222.101:443
81.0.236.90:443
45.118.135.203:7080
176.104.106.96:8080
212.237.56.116:7080
216.158.226.206:443
173.212.193.249:8080
50.116.54.215:443
138.185.72.26:8080
41.76.108.46:8080
212.237.5.209:443
107.182.225.142:8080
195.154.133.20:443
162.214.50.39:7080
110.232.117.186:8080
Signatures
-
Emotet family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1904 wrote to memory of 3476 1904 regsvr32.exe 83 PID 1904 wrote to memory of 3476 1904 regsvr32.exe 83 PID 1904 wrote to memory of 3476 1904 regsvr32.exe 83 PID 3476 wrote to memory of 3584 3476 regsvr32.exe 87 PID 3476 wrote to memory of 3584 3476 regsvr32.exe 87 PID 3476 wrote to memory of 3584 3476 regsvr32.exe 87
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\ad889ea0fb9c0c9cc5acf7e4ee60b11d7d3e2a57489b6037af604381219905ca.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\ad889ea0fb9c0c9cc5acf7e4ee60b11d7d3e2a57489b6037af604381219905ca.dll2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ad889ea0fb9c0c9cc5acf7e4ee60b11d7d3e2a57489b6037af604381219905ca.dll",DllRegisterServer3⤵
- System Location Discovery: System Language Discovery
PID:3584
-
-