Analysis
-
max time kernel
94s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 18:09
Static task
static1
Behavioral task
behavioral1
Sample
140de0a043443737b504a3a0502717d93db9282de5a582deb800aadcc8d9b912.dll
Resource
win7-20240903-en
General
-
Target
140de0a043443737b504a3a0502717d93db9282de5a582deb800aadcc8d9b912.dll
-
Size
615KB
-
MD5
dbc20e7e28a3c1b6927b8ad27e85eb47
-
SHA1
a077cd79b29ab808f6596baf80fb94e75793ee9f
-
SHA256
140de0a043443737b504a3a0502717d93db9282de5a582deb800aadcc8d9b912
-
SHA512
718b6eb0a542df29e00f37d2a4ec18c072a768cb2e78dcca1b6863f7d19840df6248ff8a317fd49b86aabc271cb63b9c810b8b5f09ef1a57cacf23c72d3830c7
-
SSDEEP
12288:dOzFuk7dA19ZCOo6AI/2NLaQLHkMZR+TTD7vgEPej:0hn7dA19ZCOyDaQjkqkXa
Malware Config
Extracted
emotet
Epoch4
131.100.24.231:80
209.59.138.75:7080
103.8.26.103:8080
51.38.71.0:443
212.237.17.99:8080
79.172.212.216:8080
207.38.84.195:8080
104.168.155.129:8080
178.79.147.66:8080
46.55.222.11:443
103.8.26.102:8080
192.254.71.210:443
45.176.232.124:443
203.114.109.124:443
51.68.175.8:8080
58.227.42.236:80
45.142.114.231:8080
217.182.143.207:443
178.63.25.185:443
45.118.115.99:8080
103.75.201.2:443
104.251.214.46:8080
158.69.222.101:443
81.0.236.90:443
45.118.135.203:7080
176.104.106.96:8080
212.237.56.116:7080
216.158.226.206:443
173.212.193.249:8080
50.116.54.215:443
138.185.72.26:8080
41.76.108.46:8080
212.237.5.209:443
107.182.225.142:8080
195.154.133.20:443
162.214.50.39:7080
110.232.117.186:8080
Signatures
-
Emotet family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
regsvr32.exerundll32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid Process procid_target PID 3592 wrote to memory of 2120 3592 regsvr32.exe 83 PID 3592 wrote to memory of 2120 3592 regsvr32.exe 83 PID 3592 wrote to memory of 2120 3592 regsvr32.exe 83 PID 2120 wrote to memory of 2796 2120 regsvr32.exe 86 PID 2120 wrote to memory of 2796 2120 regsvr32.exe 86 PID 2120 wrote to memory of 2796 2120 regsvr32.exe 86
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\140de0a043443737b504a3a0502717d93db9282de5a582deb800aadcc8d9b912.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\140de0a043443737b504a3a0502717d93db9282de5a582deb800aadcc8d9b912.dll2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\140de0a043443737b504a3a0502717d93db9282de5a582deb800aadcc8d9b912.dll",DllRegisterServer3⤵
- System Location Discovery: System Language Discovery
PID:2796
-
-