Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/11/2024, 20:46
Static task
static1
Behavioral task
behavioral1
Sample
d5ddf3c3be8c7ceda4ff62e548c711e75850820a6314da0be265691943fd57d8.dll
Resource
win7-20240903-en
General
-
Target
d5ddf3c3be8c7ceda4ff62e548c711e75850820a6314da0be265691943fd57d8.dll
-
Size
252KB
-
MD5
bde9b14c37bef92be36da5ff74b00c2e
-
SHA1
a93e2c0a197cc5bb2f49e3383194e3f4681716bf
-
SHA256
d5ddf3c3be8c7ceda4ff62e548c711e75850820a6314da0be265691943fd57d8
-
SHA512
4d8b9c93a913ebfda9c806c00656426ce44ce60ee311b91e3142ff5a7f0dead7ce12f60ded1d356023ce38aeb88939f1e3399148e08ef399283d1f8165b59229
-
SSDEEP
6144:ndH09uYgR7OJSuwuZc2HEaYTy7beWTBdxm:dHJtlec2HEaYTXWT/o
Malware Config
Extracted
emotet
Epoch4
91.200.186.228:443
191.252.196.221:8080
94.177.248.64:443
66.42.55.5:7080
103.8.26.103:8080
185.184.25.237:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
212.237.17.99:8080
212.237.56.116:7080
216.158.226.206:443
110.232.117.186:8080
158.69.222.101:443
107.182.225.142:8080
176.104.106.96:8080
81.0.236.90:443
50.116.54.215:443
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
Emotet family
-
Blocklisted process makes network request 10 IoCs
flow pid Process 15 3116 rundll32.exe 21 3116 rundll32.exe 22 3116 rundll32.exe 36 3116 rundll32.exe 40 3116 rundll32.exe 41 3116 rundll32.exe 45 3116 rundll32.exe 46 3116 rundll32.exe 47 3116 rundll32.exe 48 3116 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3116 rundll32.exe 3116 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3380 wrote to memory of 2388 3380 rundll32.exe 85 PID 3380 wrote to memory of 2388 3380 rundll32.exe 85 PID 3380 wrote to memory of 2388 3380 rundll32.exe 85 PID 2388 wrote to memory of 3116 2388 rundll32.exe 86 PID 2388 wrote to memory of 3116 2388 rundll32.exe 86 PID 2388 wrote to memory of 3116 2388 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d5ddf3c3be8c7ceda4ff62e548c711e75850820a6314da0be265691943fd57d8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d5ddf3c3be8c7ceda4ff62e548c711e75850820a6314da0be265691943fd57d8.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\d5ddf3c3be8c7ceda4ff62e548c711e75850820a6314da0be265691943fd57d8.dll",Control_RunDLL3⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3116
-
-