Analysis

  • max time kernel
    124s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/11/2024, 14:16

General

  • Target

    60a9aa192729ae78d49f44b843a7e055e7d0b71323107b32a8657c5d0713375f.dll

  • Size

    532KB

  • MD5

    266a57a45c0d175d92ec8a6adccb6c82

  • SHA1

    8c48b636458c2c3387be7c83f38f71384429a619

  • SHA256

    60a9aa192729ae78d49f44b843a7e055e7d0b71323107b32a8657c5d0713375f

  • SHA512

    f2c3d1acb8ddc884b5e0386ae2e9c4e96c9544e277fd6dec02f1d958cd7e906ddec1cdf57c0113b3865c5a1f0e24de297d1373ea335c56f8be3ea4d211a02dc9

  • SSDEEP

    12288:B4UJY9B+TenWsSEPHjMOUP9uXdt7JpfYNVr9RM54RutCTdJGqIoTCZ4eEsZlHxHy:B4UJY9BSenZSEPHjMOUP9Udt7JpfYNVp

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

131.100.24.231:80

103.132.242.26:8080

167.172.253.162:8080

149.56.131.28:8080

209.126.98.206:8080

188.44.20.25:443

212.237.17.99:8080

129.232.188.93:443

160.16.142.56:8080

46.55.222.11:443

1.234.2.232:8080

45.235.8.30:8080

185.157.82.211:8080

158.69.222.101:443

185.4.135.165:8080

27.54.89.58:8080

197.242.150.244:8080

153.126.146.25:7080

183.111.227.137:8080

103.75.201.2:443

ecs1.plain
eck1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet family
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\60a9aa192729ae78d49f44b843a7e055e7d0b71323107b32a8657c5d0713375f.dll
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2960
    • C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KHJZgnDcI\ZczzeAvAnEfdwJX.dll"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3972

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2960-1-0x0000000180000000-0x0000000180030000-memory.dmp

          Filesize

          192KB

        • memory/2960-0-0x0000000000C30000-0x0000000000C31000-memory.dmp

          Filesize

          4KB

        • memory/2960-4-0x00007FFAFE600000-0x00007FFAFE689000-memory.dmp

          Filesize

          548KB

        • memory/3972-8-0x0000000180000000-0x0000000180030000-memory.dmp

          Filesize

          192KB