Analysis
-
max time kernel
139s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/11/2024, 14:17
Static task
static1
Behavioral task
behavioral1
Sample
564114973f01f2fb82840c513a00e3d5b09e8fb8de50e0c00f47189e6814def3.dll
Resource
win7-20241023-en
General
-
Target
564114973f01f2fb82840c513a00e3d5b09e8fb8de50e0c00f47189e6814def3.dll
-
Size
364KB
-
MD5
37fc36143af63f5f3ba7ccefa484e884
-
SHA1
4ce03969e43b4c6251b21a76d968a9badd576eb1
-
SHA256
564114973f01f2fb82840c513a00e3d5b09e8fb8de50e0c00f47189e6814def3
-
SHA512
20e6c6f6542c7161caae8e414804ac45a181157fb361996bbb52691b877d7241a29cbac0e87c4f32ff41c87fa6e9e6c1aebebe128a3919d36cc2253f539ef6a0
-
SSDEEP
6144:qRsMh9YQWtcgA70wgF7nJy76CQK+kIVDRjudJMrt32fFcRmXIeJXjWMmAD:cvm9Y0HFLKRQKqV4epRmxAvAD
Malware Config
Extracted
emotet
Epoch5
45.63.5.129:443
128.199.192.135:8080
51.178.61.60:443
168.197.250.14:80
177.72.80.14:7080
51.210.242.234:8080
142.4.219.173:8080
78.47.204.80:443
78.46.73.125:443
37.44.244.177:8080
37.59.209.141:8080
191.252.103.16:80
54.38.242.185:443
85.214.67.203:8080
217.182.143.207:443
159.69.237.188:443
210.57.209.142:8080
54.37.228.122:443
207.148.81.119:8080
195.77.239.39:8080
66.42.57.149:443
195.154.146.35:443
Signatures
-
Emotet family
-
Blocklisted process makes network request 8 IoCs
flow pid Process 32 3008 rundll32.exe 35 3008 rundll32.exe 36 3008 rundll32.exe 39 3008 rundll32.exe 44 3008 rundll32.exe 45 3008 rundll32.exe 46 3008 rundll32.exe 47 3008 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3008 rundll32.exe 3008 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2064 wrote to memory of 2760 2064 rundll32.exe 83 PID 2064 wrote to memory of 2760 2064 rundll32.exe 83 PID 2064 wrote to memory of 2760 2064 rundll32.exe 83 PID 2760 wrote to memory of 3008 2760 rundll32.exe 97 PID 2760 wrote to memory of 3008 2760 rundll32.exe 97 PID 2760 wrote to memory of 3008 2760 rundll32.exe 97
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\564114973f01f2fb82840c513a00e3d5b09e8fb8de50e0c00f47189e6814def3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\564114973f01f2fb82840c513a00e3d5b09e8fb8de50e0c00f47189e6814def3.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\564114973f01f2fb82840c513a00e3d5b09e8fb8de50e0c00f47189e6814def3.dll",Control_RunDLL3⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3008
-
-