Analysis
-
max time kernel
92s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/11/2024, 20:52
Static task
static1
Behavioral task
behavioral1
Sample
cf9e5e307935c66273195c4feeca46cc53e9b347ec6eeca90b9026fb37165481.dll
Resource
win7-20241010-en
General
-
Target
cf9e5e307935c66273195c4feeca46cc53e9b347ec6eeca90b9026fb37165481.dll
-
Size
615KB
-
MD5
49ed18f74cfc15134e89371b43086ff6
-
SHA1
3f92fa5fbe4cf659f1925e11b04bb58ab091091d
-
SHA256
cf9e5e307935c66273195c4feeca46cc53e9b347ec6eeca90b9026fb37165481
-
SHA512
526772de85bf61d45ce9a7ff6435ce6807db79a68ec86dbd2eaf39b535e20ad9275469df6ad2fdcc7f566ebb772f521e56d617f30b08516b2261bcce9f56ed1c
-
SSDEEP
12288:dOzFuk7dA19ZCOo6AI/2NLaQLakMZR+TTD7vgEPej:0hn7dA19ZCOyDaQ2kqkXa
Malware Config
Extracted
emotet
Epoch4
131.100.24.231:80
209.59.138.75:7080
103.8.26.103:8080
51.38.71.0:443
212.237.17.99:8080
79.172.212.216:8080
207.38.84.195:8080
104.168.155.129:8080
178.79.147.66:8080
46.55.222.11:443
103.8.26.102:8080
192.254.71.210:443
45.176.232.124:443
203.114.109.124:443
51.68.175.8:8080
58.227.42.236:80
45.142.114.231:8080
217.182.143.207:443
178.63.25.185:443
45.118.115.99:8080
103.75.201.2:443
104.251.214.46:8080
158.69.222.101:443
81.0.236.90:443
45.118.135.203:7080
176.104.106.96:8080
212.237.56.116:7080
216.158.226.206:443
173.212.193.249:8080
50.116.54.215:443
138.185.72.26:8080
41.76.108.46:8080
212.237.5.209:443
107.182.225.142:8080
195.154.133.20:443
162.214.50.39:7080
110.232.117.186:8080
Signatures
-
Emotet family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4104 wrote to memory of 4772 4104 regsvr32.exe 83 PID 4104 wrote to memory of 4772 4104 regsvr32.exe 83 PID 4104 wrote to memory of 4772 4104 regsvr32.exe 83 PID 4772 wrote to memory of 700 4772 regsvr32.exe 86 PID 4772 wrote to memory of 700 4772 regsvr32.exe 86 PID 4772 wrote to memory of 700 4772 regsvr32.exe 86
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\cf9e5e307935c66273195c4feeca46cc53e9b347ec6eeca90b9026fb37165481.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\cf9e5e307935c66273195c4feeca46cc53e9b347ec6eeca90b9026fb37165481.dll2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\cf9e5e307935c66273195c4feeca46cc53e9b347ec6eeca90b9026fb37165481.dll",DllRegisterServer3⤵
- System Location Discovery: System Language Discovery
PID:700
-
-