Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/11/2024, 14:07
Static task
static1
Behavioral task
behavioral1
Sample
c6ca220e7c03e7fdac37f636492391309f85d0ab4c3da4095cfdaffe4cd4b47a.dll
Resource
win7-20240903-en
General
-
Target
c6ca220e7c03e7fdac37f636492391309f85d0ab4c3da4095cfdaffe4cd4b47a.dll
-
Size
252KB
-
MD5
f528dde4f20323754a66b00a94544761
-
SHA1
1fbacf530a0071072301b0d925a17d3a7e078dbf
-
SHA256
c6ca220e7c03e7fdac37f636492391309f85d0ab4c3da4095cfdaffe4cd4b47a
-
SHA512
0713ae25668d7e83d201608afddb16c1c170ce0e7f1d0543d9b86dd0307d09c0fc8925d52b3a7fb4384d805e4ad6902b5fdbb1dc1b7390cfd0824267d0687b56
-
SSDEEP
6144:ndH09uYgR7OJSuwuZc2HEaYTy7beWTBdfm:dHJtlec2HEaYTXWT/+
Malware Config
Extracted
emotet
Epoch4
91.200.186.228:443
191.252.196.221:8080
94.177.248.64:443
66.42.55.5:7080
103.8.26.103:8080
185.184.25.237:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
212.237.17.99:8080
212.237.56.116:7080
216.158.226.206:443
110.232.117.186:8080
158.69.222.101:443
107.182.225.142:8080
176.104.106.96:8080
81.0.236.90:443
50.116.54.215:443
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
Emotet family
-
Blocklisted process makes network request 11 IoCs
flow pid Process 4 1888 rundll32.exe 5 1888 rundll32.exe 8 1888 rundll32.exe 9 1888 rundll32.exe 10 1888 rundll32.exe 11 1888 rundll32.exe 15 1888 rundll32.exe 18 1888 rundll32.exe 19 1888 rundll32.exe 20 1888 rundll32.exe 21 1888 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1888 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2524 wrote to memory of 1632 2524 rundll32.exe 30 PID 2524 wrote to memory of 1632 2524 rundll32.exe 30 PID 2524 wrote to memory of 1632 2524 rundll32.exe 30 PID 2524 wrote to memory of 1632 2524 rundll32.exe 30 PID 2524 wrote to memory of 1632 2524 rundll32.exe 30 PID 2524 wrote to memory of 1632 2524 rundll32.exe 30 PID 2524 wrote to memory of 1632 2524 rundll32.exe 30 PID 1632 wrote to memory of 1888 1632 rundll32.exe 31 PID 1632 wrote to memory of 1888 1632 rundll32.exe 31 PID 1632 wrote to memory of 1888 1632 rundll32.exe 31 PID 1632 wrote to memory of 1888 1632 rundll32.exe 31 PID 1632 wrote to memory of 1888 1632 rundll32.exe 31 PID 1632 wrote to memory of 1888 1632 rundll32.exe 31 PID 1632 wrote to memory of 1888 1632 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c6ca220e7c03e7fdac37f636492391309f85d0ab4c3da4095cfdaffe4cd4b47a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c6ca220e7c03e7fdac37f636492391309f85d0ab4c3da4095cfdaffe4cd4b47a.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\c6ca220e7c03e7fdac37f636492391309f85d0ab4c3da4095cfdaffe4cd4b47a.dll",Control_RunDLL3⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1888
-
-