Analysis
-
max time kernel
131s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
13/11/2024, 14:17
Static task
static1
Behavioral task
behavioral1
Sample
564114973f01f2fb82840c513a00e3d5b09e8fb8de50e0c00f47189e6814def3.dll
Resource
win7-20241023-en
General
-
Target
564114973f01f2fb82840c513a00e3d5b09e8fb8de50e0c00f47189e6814def3.dll
-
Size
364KB
-
MD5
37fc36143af63f5f3ba7ccefa484e884
-
SHA1
4ce03969e43b4c6251b21a76d968a9badd576eb1
-
SHA256
564114973f01f2fb82840c513a00e3d5b09e8fb8de50e0c00f47189e6814def3
-
SHA512
20e6c6f6542c7161caae8e414804ac45a181157fb361996bbb52691b877d7241a29cbac0e87c4f32ff41c87fa6e9e6c1aebebe128a3919d36cc2253f539ef6a0
-
SSDEEP
6144:qRsMh9YQWtcgA70wgF7nJy76CQK+kIVDRjudJMrt32fFcRmXIeJXjWMmAD:cvm9Y0HFLKRQKqV4epRmxAvAD
Malware Config
Extracted
emotet
Epoch5
45.63.5.129:443
128.199.192.135:8080
51.178.61.60:443
168.197.250.14:80
177.72.80.14:7080
51.210.242.234:8080
142.4.219.173:8080
78.47.204.80:443
78.46.73.125:443
37.44.244.177:8080
37.59.209.141:8080
191.252.103.16:80
54.38.242.185:443
85.214.67.203:8080
217.182.143.207:443
159.69.237.188:443
210.57.209.142:8080
54.37.228.122:443
207.148.81.119:8080
195.77.239.39:8080
66.42.57.149:443
195.154.146.35:443
Signatures
-
Emotet family
-
Blocklisted process makes network request 6 IoCs
flow pid Process 4 2900 rundll32.exe 7 2900 rundll32.exe 8 2900 rundll32.exe 9 2900 rundll32.exe 10 2900 rundll32.exe 11 2900 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2900 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2600 wrote to memory of 684 2600 rundll32.exe 30 PID 2600 wrote to memory of 684 2600 rundll32.exe 30 PID 2600 wrote to memory of 684 2600 rundll32.exe 30 PID 2600 wrote to memory of 684 2600 rundll32.exe 30 PID 2600 wrote to memory of 684 2600 rundll32.exe 30 PID 2600 wrote to memory of 684 2600 rundll32.exe 30 PID 2600 wrote to memory of 684 2600 rundll32.exe 30 PID 684 wrote to memory of 2900 684 rundll32.exe 32 PID 684 wrote to memory of 2900 684 rundll32.exe 32 PID 684 wrote to memory of 2900 684 rundll32.exe 32 PID 684 wrote to memory of 2900 684 rundll32.exe 32 PID 684 wrote to memory of 2900 684 rundll32.exe 32 PID 684 wrote to memory of 2900 684 rundll32.exe 32 PID 684 wrote to memory of 2900 684 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\564114973f01f2fb82840c513a00e3d5b09e8fb8de50e0c00f47189e6814def3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\564114973f01f2fb82840c513a00e3d5b09e8fb8de50e0c00f47189e6814def3.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\564114973f01f2fb82840c513a00e3d5b09e8fb8de50e0c00f47189e6814def3.dll",Control_RunDLL3⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2900
-
-