Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 22:58
Static task
static1
Behavioral task
behavioral1
Sample
a76d4fd688b3ea6533de8844f3ee6b94bffe6e840aa728e77f864be2a5c2dc6d.dll
Resource
win7-20240903-en
General
-
Target
a76d4fd688b3ea6533de8844f3ee6b94bffe6e840aa728e77f864be2a5c2dc6d.dll
-
Size
378KB
-
MD5
7ac2c1b2569de82fc2c448175a3edef5
-
SHA1
ae17d4888726ebe74197108476d1cae9f5bb496e
-
SHA256
a76d4fd688b3ea6533de8844f3ee6b94bffe6e840aa728e77f864be2a5c2dc6d
-
SHA512
63ea1878ef60c099c3b7000ca02ccb7d97eec1e86a0799b31b838dd1b46cfbc2776b701f17f75ecc3a53187773c8a35c83c56f7ad4329bbd0f7979d6ad9a8d3f
-
SSDEEP
6144:zBYrPMTsY8GR3j4fubnY6Zs/Bv6yu6aSTsfA2qL6jpXNcc6CEteuQJPIgtlpZ5L:yhmT4GbnYks/BJvWo2LjpScDEteuOIoZ
Malware Config
Extracted
emotet
Epoch4
46.55.222.11:443
104.245.52.73:8080
41.76.108.46:8080
103.8.26.103:8080
185.184.25.237:8080
103.8.26.102:8080
203.114.109.124:443
45.118.115.99:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
212.237.17.99:8080
212.237.56.116:7080
216.158.226.206:443
110.232.117.186:8080
158.69.222.101:443
107.182.225.142:8080
176.104.106.96:8080
81.0.236.90:443
50.116.54.215:443
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
Emotet family
-
Blocklisted process makes network request 7 IoCs
flow pid Process 30 1944 rundll32.exe 34 1944 rundll32.exe 36 1944 rundll32.exe 40 1944 rundll32.exe 41 1944 rundll32.exe 42 1944 rundll32.exe 43 1944 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1944 rundll32.exe 1944 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 452 wrote to memory of 2728 452 rundll32.exe 83 PID 452 wrote to memory of 2728 452 rundll32.exe 83 PID 452 wrote to memory of 2728 452 rundll32.exe 83 PID 2728 wrote to memory of 1944 2728 rundll32.exe 95 PID 2728 wrote to memory of 1944 2728 rundll32.exe 95 PID 2728 wrote to memory of 1944 2728 rundll32.exe 95
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a76d4fd688b3ea6533de8844f3ee6b94bffe6e840aa728e77f864be2a5c2dc6d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a76d4fd688b3ea6533de8844f3ee6b94bffe6e840aa728e77f864be2a5c2dc6d.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\a76d4fd688b3ea6533de8844f3ee6b94bffe6e840aa728e77f864be2a5c2dc6d.dll",Control_RunDLL3⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1944
-
-