Analysis
-
max time kernel
94s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 17:33
Static task
static1
Behavioral task
behavioral1
Sample
c6defbd756ff9a0d6b2c1c30ab25cc72c4f0443509b0c8439238f17924082afc.dll
Resource
win7-20240903-en
General
-
Target
c6defbd756ff9a0d6b2c1c30ab25cc72c4f0443509b0c8439238f17924082afc.dll
-
Size
780KB
-
MD5
9a27333d0818cfbac270a7424fb72cb9
-
SHA1
14ebf13525a7df62c54f2f98403276666761ccd0
-
SHA256
c6defbd756ff9a0d6b2c1c30ab25cc72c4f0443509b0c8439238f17924082afc
-
SHA512
228867cda6bdc0664f0f4aa83647a337de972388e865d836e055c3ff16eb44ae4e2760c88d552d1b9c005a5081257b531717d458223896915cd87024460e6b84
-
SSDEEP
12288:5s/YpAp2/yQ0P7BLyP70n9TkgwzDwtAs0owb8ZPnJ0l7FgDZ4liMFdajByR:5GPp2/yQ0PtC0i/w50Pb8wgDZTGMjB
Malware Config
Extracted
emotet
Epoch4
45.80.148.200:443
80.211.3.13:8080
110.232.117.186:8080
45.142.114.231:8080
131.100.24.231:80
107.182.225.142:8080
45.118.135.203:7080
164.68.99.3:8080
212.237.56.116:7080
41.76.108.46:8080
58.227.42.236:80
104.168.155.129:8080
79.172.212.216:8080
192.254.71.210:443
51.38.71.0:443
217.182.143.207:443
203.114.109.124:443
185.157.82.211:8080
173.212.193.249:8080
45.176.232.124:443
158.69.222.101:443
212.237.17.99:8080
207.38.84.195:8080
195.154.133.20:443
162.243.175.63:443
138.185.72.26:8080
103.8.26.102:8080
103.8.26.103:8080
50.116.54.215:443
178.79.147.66:8080
45.118.115.99:8080
178.63.25.185:443
46.55.222.11:443
103.75.201.2:443
81.0.236.90:443
176.104.106.96:8080
162.214.50.39:7080
212.237.5.209:443
209.59.138.75:7080
216.158.226.206:443
104.251.214.46:8080
212.24.98.99:8080
Signatures
-
Emotet family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
regsvr32.exerundll32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid Process procid_target PID 388 wrote to memory of 1568 388 regsvr32.exe 83 PID 388 wrote to memory of 1568 388 regsvr32.exe 83 PID 388 wrote to memory of 1568 388 regsvr32.exe 83 PID 1568 wrote to memory of 1376 1568 regsvr32.exe 86 PID 1568 wrote to memory of 1376 1568 regsvr32.exe 86 PID 1568 wrote to memory of 1376 1568 regsvr32.exe 86
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\c6defbd756ff9a0d6b2c1c30ab25cc72c4f0443509b0c8439238f17924082afc.dll1⤵
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\c6defbd756ff9a0d6b2c1c30ab25cc72c4f0443509b0c8439238f17924082afc.dll2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\c6defbd756ff9a0d6b2c1c30ab25cc72c4f0443509b0c8439238f17924082afc.dll",DllRegisterServer3⤵
- System Location Discovery: System Language Discovery
PID:1376
-
-