Analysis
-
max time kernel
132s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 22:43
Static task
static1
Behavioral task
behavioral1
Sample
badd9a789b5863e9c11497cc19df6bac54aea34cac9df95e823aa9bb00ea1481.dll
Resource
win7-20241010-en
General
-
Target
badd9a789b5863e9c11497cc19df6bac54aea34cac9df95e823aa9bb00ea1481.dll
-
Size
378KB
-
MD5
bd5d5c37a378cbc02189809822ce3a70
-
SHA1
200c3b936cd82e7642edcefcfecd1dba91fee770
-
SHA256
badd9a789b5863e9c11497cc19df6bac54aea34cac9df95e823aa9bb00ea1481
-
SHA512
81065619d0f2c4df7aea75f04d4492ebd1e198877dac549e26d7a148ab2b0e084c814afe43797a39df470ec96251edaed6f368ea590628dbd6f56cce39ac4eb9
-
SSDEEP
6144:zBYrPMTsY8GR3j4fubnY6Zs/Bv6y76aSTsfA2qL6jpXNcc6CEteuQJPIgtlpZ5L:yhmT4GbnYks/BJ+Wo2LjpScDEteuOIoZ
Malware Config
Extracted
emotet
Epoch4
46.55.222.11:443
104.245.52.73:8080
41.76.108.46:8080
103.8.26.103:8080
185.184.25.237:8080
103.8.26.102:8080
203.114.109.124:443
45.118.115.99:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
212.237.17.99:8080
212.237.56.116:7080
216.158.226.206:443
110.232.117.186:8080
158.69.222.101:443
107.182.225.142:8080
176.104.106.96:8080
81.0.236.90:443
50.116.54.215:443
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
Emotet family
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid Process 3 3032 rundll32.exe 5 3032 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exerundll32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
rundll32.exepid Process 3032 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
rundll32.exerundll32.exedescription pid Process procid_target PID 2904 wrote to memory of 2808 2904 rundll32.exe 29 PID 2904 wrote to memory of 2808 2904 rundll32.exe 29 PID 2904 wrote to memory of 2808 2904 rundll32.exe 29 PID 2904 wrote to memory of 2808 2904 rundll32.exe 29 PID 2904 wrote to memory of 2808 2904 rundll32.exe 29 PID 2904 wrote to memory of 2808 2904 rundll32.exe 29 PID 2904 wrote to memory of 2808 2904 rundll32.exe 29 PID 2808 wrote to memory of 3032 2808 rundll32.exe 30 PID 2808 wrote to memory of 3032 2808 rundll32.exe 30 PID 2808 wrote to memory of 3032 2808 rundll32.exe 30 PID 2808 wrote to memory of 3032 2808 rundll32.exe 30 PID 2808 wrote to memory of 3032 2808 rundll32.exe 30 PID 2808 wrote to memory of 3032 2808 rundll32.exe 30 PID 2808 wrote to memory of 3032 2808 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\badd9a789b5863e9c11497cc19df6bac54aea34cac9df95e823aa9bb00ea1481.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\badd9a789b5863e9c11497cc19df6bac54aea34cac9df95e823aa9bb00ea1481.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\badd9a789b5863e9c11497cc19df6bac54aea34cac9df95e823aa9bb00ea1481.dll",Control_RunDLL3⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3032
-
-