Analysis
-
max time kernel
138s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 22:29
Static task
static1
Behavioral task
behavioral1
Sample
ee47a34f10479ae198c50f3bdeaa6db39dafb051403a9932be5e05852eea468b.dll
Resource
win7-20241010-en
General
-
Target
ee47a34f10479ae198c50f3bdeaa6db39dafb051403a9932be5e05852eea468b.dll
-
Size
526KB
-
MD5
7ea764350e7c4bfde0cb9b177ae0ac16
-
SHA1
6c1cb2dcb784b310a889876ab8b2ee825aefa5fe
-
SHA256
ee47a34f10479ae198c50f3bdeaa6db39dafb051403a9932be5e05852eea468b
-
SHA512
6b62952a10ec9706a2a3032a5c69e50e3d8ed951756baf3b8b3be1a99a5875706829426d4796265bfb5cb866ff66fc8b65c1cf44391133c4695f3fb19ee7dd40
-
SSDEEP
6144:8JuLf/WAlRkVQqLyqoGN4BmbvC4zUQtIlHN3nkHDaE3P93XCJdjW4+WxnKYRRn4k:HVqLOGNVDzZtIlHN3nkjjXC/j8un/gB
Malware Config
Extracted
emotet
Epoch5
51.178.61.60:443
168.197.250.14:80
45.79.33.48:8080
196.44.98.190:8080
177.72.80.14:7080
51.210.242.234:8080
185.148.169.10:8080
142.4.219.173:8080
78.47.204.80:443
78.46.73.125:443
37.44.244.177:8080
37.59.209.141:8080
191.252.103.16:80
54.38.242.185:443
85.214.67.203:8080
54.37.228.122:443
207.148.81.119:8080
195.77.239.39:8080
66.42.57.149:443
195.154.146.35:443
Signatures
-
Emotet family
-
Blocklisted process makes network request 9 IoCs
flow pid Process 3 2920 rundll32.exe 7 2920 rundll32.exe 8 2920 rundll32.exe 9 2920 rundll32.exe 10 2920 rundll32.exe 11 2920 rundll32.exe 14 2920 rundll32.exe 18 2920 rundll32.exe 19 2920 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2920 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2052 wrote to memory of 796 2052 rundll32.exe 29 PID 2052 wrote to memory of 796 2052 rundll32.exe 29 PID 2052 wrote to memory of 796 2052 rundll32.exe 29 PID 2052 wrote to memory of 796 2052 rundll32.exe 29 PID 2052 wrote to memory of 796 2052 rundll32.exe 29 PID 2052 wrote to memory of 796 2052 rundll32.exe 29 PID 2052 wrote to memory of 796 2052 rundll32.exe 29 PID 796 wrote to memory of 2920 796 rundll32.exe 30 PID 796 wrote to memory of 2920 796 rundll32.exe 30 PID 796 wrote to memory of 2920 796 rundll32.exe 30 PID 796 wrote to memory of 2920 796 rundll32.exe 30 PID 796 wrote to memory of 2920 796 rundll32.exe 30 PID 796 wrote to memory of 2920 796 rundll32.exe 30 PID 796 wrote to memory of 2920 796 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ee47a34f10479ae198c50f3bdeaa6db39dafb051403a9932be5e05852eea468b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ee47a34f10479ae198c50f3bdeaa6db39dafb051403a9932be5e05852eea468b.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ee47a34f10479ae198c50f3bdeaa6db39dafb051403a9932be5e05852eea468b.dll",Control_RunDLL3⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2920
-
-