Analysis
-
max time kernel
124s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/11/2024, 14:09
Static task
static1
Behavioral task
behavioral1
Sample
38d82cb9d4f183f52a16ce102ddc8d998871cb3dacf783130bb714b1fe4910f1.dll
Resource
win7-20240903-en
General
-
Target
38d82cb9d4f183f52a16ce102ddc8d998871cb3dacf783130bb714b1fe4910f1.dll
-
Size
209KB
-
MD5
cbab6524ef0e75c0a8217c59362ca02a
-
SHA1
5652552d61505f2e59da0064e6b814c8de897a92
-
SHA256
38d82cb9d4f183f52a16ce102ddc8d998871cb3dacf783130bb714b1fe4910f1
-
SHA512
b80174d796b699f848784b31884a5666d52fc09b411f5b6e587a4552512d38a56a4c605b172d716ddcbe1e3d250434a6b2d8ee396752be7ec74cc5c573dba74a
-
SSDEEP
3072:MVaYmiLp+AO2e0qqDs+/Vy+29S9b+WWbyTOn5rnJRsMiQF0Vd9EkuejapPs:ymIYAO2elvX9jbR53RFg+ejaF
Malware Config
Extracted
emotet
Epoch2
74.58.215.226:80
24.164.79.147:8080
157.245.123.197:8080
50.116.111.59:8080
173.249.20.233:443
78.188.225.105:80
75.177.207.146:80
136.244.110.184:8080
194.190.67.75:80
70.92.118.112:80
110.145.101.66:443
194.4.58.192:7080
217.20.166.178:7080
109.74.5.95:8080
110.145.11.73:80
66.57.108.14:443
78.189.148.42:80
144.217.7.207:7080
120.150.60.189:80
37.139.21.175:8080
185.94.252.104:443
74.40.205.197:443
152.170.205.73:80
190.29.166.0:80
176.111.60.55:8080
47.144.21.37:80
139.99.158.11:443
172.86.188.251:8080
123.176.25.234:80
120.150.218.241:443
121.124.124.40:7080
64.207.182.168:8080
97.120.3.198:80
24.231.88.85:80
95.213.236.64:8080
5.2.212.254:80
188.165.214.98:8080
174.118.202.24:443
190.240.194.77:443
172.104.97.173:8080
61.19.246.238:443
181.165.68.127:80
24.178.90.49:80
50.245.107.73:443
37.187.72.193:8080
209.141.54.221:7080
168.235.67.138:7080
62.30.7.67:443
5.39.91.110:7080
200.116.145.225:443
62.171.142.179:8080
185.201.9.197:8080
187.161.206.24:80
190.162.215.233:80
118.83.154.64:443
134.209.144.106:443
157.245.99.39:8080
139.59.60.244:8080
50.91.114.38:80
197.211.245.21:80
93.146.48.84:80
173.70.61.180:80
67.170.250.203:443
191.112.178.60:80
24.69.65.8:8080
89.216.122.92:80
201.241.127.190:80
142.112.10.95:20
181.171.209.241:443
87.106.139.101:8080
85.105.111.166:80
78.24.219.147:8080
95.9.5.93:80
115.94.207.99:443
110.145.77.103:80
74.208.45.104:8080
119.59.116.21:8080
172.105.13.66:443
59.21.235.119:80
62.75.141.82:80
100.37.240.62:80
139.162.60.124:8080
188.219.31.12:80
109.116.245.80:80
220.245.198.194:80
2.58.16.89:8080
178.152.87.96:80
167.114.153.111:8080
49.205.182.134:80
70.180.33.202:80
161.0.153.60:80
202.134.4.211:8080
70.183.211.3:80
51.89.36.180:443
72.186.136.247:443
79.137.83.50:443
202.141.243.254:443
46.105.131.79:8080
203.153.216.189:7080
74.128.121.17:80
202.134.4.216:8080
98.109.133.80:80
104.131.11.150:443
24.179.13.119:80
41.185.28.84:8080
138.68.87.218:443
172.125.40.123:80
94.23.237.171:443
Signatures
-
Emotet family
-
Blocklisted process makes network request 6 IoCs
flow pid Process 15 1840 rundll32.exe 33 1840 rundll32.exe 36 1840 rundll32.exe 40 1840 rundll32.exe 44 1840 rundll32.exe 46 1840 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2708 wrote to memory of 1840 2708 rundll32.exe 83 PID 2708 wrote to memory of 1840 2708 rundll32.exe 83 PID 2708 wrote to memory of 1840 2708 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\38d82cb9d4f183f52a16ce102ddc8d998871cb3dacf783130bb714b1fe4910f1.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\38d82cb9d4f183f52a16ce102ddc8d998871cb3dacf783130bb714b1fe4910f1.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1840
-