Analysis
-
max time kernel
97s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 22:40
Static task
static1
Behavioral task
behavioral1
Sample
d7ae7e954da46c87f5b94598af338ae146d04f39b7dd10fe7d9a68be678b557a.dll
Resource
win7-20240903-en
General
-
Target
d7ae7e954da46c87f5b94598af338ae146d04f39b7dd10fe7d9a68be678b557a.dll
-
Size
780KB
-
MD5
09cc5ef425a2adfd55af09b38d66c8a6
-
SHA1
1e58389656bbcaf7a80540c7af28da3ecc935d8b
-
SHA256
d7ae7e954da46c87f5b94598af338ae146d04f39b7dd10fe7d9a68be678b557a
-
SHA512
ec71d617d22cb96002ccd3976f5756a56b7f7375b8895f5b2e75e850dec5fde1367e64c78c9e310dd15413e91ab9dd90d7eec9d290c54e3fca96463abb0f185a
-
SSDEEP
12288:5s/YpAp2/yQ0P7BLyP70nLTkgwzDwtAs0owb8ZPnJ0l7FgDZ4liMFdajByR:5GPp2/yQ0PtC08/w50Pb8wgDZTGMjB
Malware Config
Extracted
emotet
Epoch4
45.80.148.200:443
80.211.3.13:8080
110.232.117.186:8080
45.142.114.231:8080
131.100.24.231:80
107.182.225.142:8080
45.118.135.203:7080
164.68.99.3:8080
212.237.56.116:7080
41.76.108.46:8080
58.227.42.236:80
104.168.155.129:8080
79.172.212.216:8080
192.254.71.210:443
51.38.71.0:443
217.182.143.207:443
203.114.109.124:443
185.157.82.211:8080
173.212.193.249:8080
45.176.232.124:443
158.69.222.101:443
212.237.17.99:8080
207.38.84.195:8080
195.154.133.20:443
162.243.175.63:443
138.185.72.26:8080
103.8.26.102:8080
103.8.26.103:8080
50.116.54.215:443
178.79.147.66:8080
45.118.115.99:8080
178.63.25.185:443
46.55.222.11:443
103.75.201.2:443
81.0.236.90:443
176.104.106.96:8080
162.214.50.39:7080
212.237.5.209:443
209.59.138.75:7080
216.158.226.206:443
104.251.214.46:8080
212.24.98.99:8080
Signatures
-
Emotet family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2672 wrote to memory of 4816 2672 regsvr32.exe 83 PID 2672 wrote to memory of 4816 2672 regsvr32.exe 83 PID 2672 wrote to memory of 4816 2672 regsvr32.exe 83 PID 4816 wrote to memory of 1140 4816 regsvr32.exe 84 PID 4816 wrote to memory of 1140 4816 regsvr32.exe 84 PID 4816 wrote to memory of 1140 4816 regsvr32.exe 84
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\d7ae7e954da46c87f5b94598af338ae146d04f39b7dd10fe7d9a68be678b557a.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\d7ae7e954da46c87f5b94598af338ae146d04f39b7dd10fe7d9a68be678b557a.dll2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\d7ae7e954da46c87f5b94598af338ae146d04f39b7dd10fe7d9a68be678b557a.dll",DllRegisterServer3⤵
- System Location Discovery: System Language Discovery
PID:1140
-
-