Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/11/2024, 14:07
Static task
static1
Behavioral task
behavioral1
Sample
08111cbfee05bb99a99073e760bf09e53a9cdb627189de0030b89f7853174529.dll
Resource
win7-20241010-en
General
-
Target
08111cbfee05bb99a99073e760bf09e53a9cdb627189de0030b89f7853174529.dll
-
Size
596KB
-
MD5
f12af11ac600e396c476f87fb488a989
-
SHA1
764495ca03102698480ad18a6a5bead430be46ca
-
SHA256
08111cbfee05bb99a99073e760bf09e53a9cdb627189de0030b89f7853174529
-
SHA512
5c762bec9198258ef014dc6d2687dfdb1c8a0b36ebf8986bb12056d23453cca8a0453b313f4f61a595364c8d3644115c1e7942d54666482232672ad86c18db27
-
SSDEEP
6144:8B4oWMvCBs0YaUG7qJFzR4Dpw0yHz4MmjOfg54hOSRhnID3FQizX5+IgtidXX5+o:8uLMviuaUsqTd45yHz4Mmj/STe5
Malware Config
Extracted
emotet
Epoch5
185.244.166.137:443
185.168.130.138:443
59.148.253.194:443
78.46.73.125:443
195.77.239.39:8080
104.131.62.48:8080
69.16.218.101:8080
203.153.216.46:443
195.154.146.35:443
190.90.233.66:443
191.252.103.16:80
37.44.244.177:8080
168.197.250.14:80
116.124.128.206:8080
54.37.228.122:443
159.69.237.188:443
85.214.67.203:8080
210.57.209.142:8080
78.47.204.80:443
185.148.168.220:8080
142.4.219.173:8080
85.25.120.45:8080
128.199.192.135:8080
66.42.57.149:443
62.171.178.147:8080
54.38.242.185:443
217.182.143.207:443
185.148.168.15:8080
37.59.209.141:8080
207.148.81.119:8080
Signatures
-
Emotet family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3892 wrote to memory of 5100 3892 regsvr32.exe 83 PID 3892 wrote to memory of 5100 3892 regsvr32.exe 83 PID 3892 wrote to memory of 5100 3892 regsvr32.exe 83 PID 5100 wrote to memory of 812 5100 regsvr32.exe 87 PID 5100 wrote to memory of 812 5100 regsvr32.exe 87 PID 5100 wrote to memory of 812 5100 regsvr32.exe 87
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\08111cbfee05bb99a99073e760bf09e53a9cdb627189de0030b89f7853174529.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\08111cbfee05bb99a99073e760bf09e53a9cdb627189de0030b89f7853174529.dll2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\08111cbfee05bb99a99073e760bf09e53a9cdb627189de0030b89f7853174529.dll",DllRegisterServer3⤵
- System Location Discovery: System Language Discovery
PID:812
-
-