Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/11/2024, 20:46
Static task
static1
Behavioral task
behavioral1
Sample
d5ddf3c3be8c7ceda4ff62e548c711e75850820a6314da0be265691943fd57d8.dll
Resource
win7-20240903-en
General
-
Target
d5ddf3c3be8c7ceda4ff62e548c711e75850820a6314da0be265691943fd57d8.dll
-
Size
252KB
-
MD5
bde9b14c37bef92be36da5ff74b00c2e
-
SHA1
a93e2c0a197cc5bb2f49e3383194e3f4681716bf
-
SHA256
d5ddf3c3be8c7ceda4ff62e548c711e75850820a6314da0be265691943fd57d8
-
SHA512
4d8b9c93a913ebfda9c806c00656426ce44ce60ee311b91e3142ff5a7f0dead7ce12f60ded1d356023ce38aeb88939f1e3399148e08ef399283d1f8165b59229
-
SSDEEP
6144:ndH09uYgR7OJSuwuZc2HEaYTy7beWTBdxm:dHJtlec2HEaYTXWT/o
Malware Config
Extracted
emotet
Epoch4
91.200.186.228:443
191.252.196.221:8080
94.177.248.64:443
66.42.55.5:7080
103.8.26.103:8080
185.184.25.237:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
212.237.17.99:8080
212.237.56.116:7080
216.158.226.206:443
110.232.117.186:8080
158.69.222.101:443
107.182.225.142:8080
176.104.106.96:8080
81.0.236.90:443
50.116.54.215:443
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
Emotet family
-
Blocklisted process makes network request 11 IoCs
flow pid Process 4 2100 rundll32.exe 5 2100 rundll32.exe 6 2100 rundll32.exe 7 2100 rundll32.exe 8 2100 rundll32.exe 9 2100 rundll32.exe 13 2100 rundll32.exe 16 2100 rundll32.exe 17 2100 rundll32.exe 18 2100 rundll32.exe 19 2100 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2100 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2236 wrote to memory of 1792 2236 rundll32.exe 30 PID 2236 wrote to memory of 1792 2236 rundll32.exe 30 PID 2236 wrote to memory of 1792 2236 rundll32.exe 30 PID 2236 wrote to memory of 1792 2236 rundll32.exe 30 PID 2236 wrote to memory of 1792 2236 rundll32.exe 30 PID 2236 wrote to memory of 1792 2236 rundll32.exe 30 PID 2236 wrote to memory of 1792 2236 rundll32.exe 30 PID 1792 wrote to memory of 2100 1792 rundll32.exe 31 PID 1792 wrote to memory of 2100 1792 rundll32.exe 31 PID 1792 wrote to memory of 2100 1792 rundll32.exe 31 PID 1792 wrote to memory of 2100 1792 rundll32.exe 31 PID 1792 wrote to memory of 2100 1792 rundll32.exe 31 PID 1792 wrote to memory of 2100 1792 rundll32.exe 31 PID 1792 wrote to memory of 2100 1792 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d5ddf3c3be8c7ceda4ff62e548c711e75850820a6314da0be265691943fd57d8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d5ddf3c3be8c7ceda4ff62e548c711e75850820a6314da0be265691943fd57d8.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\d5ddf3c3be8c7ceda4ff62e548c711e75850820a6314da0be265691943fd57d8.dll",Control_RunDLL3⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2100
-
-