Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 23:00
Static task
static1
Behavioral task
behavioral1
Sample
ee45f61f822a4c13f34e31b34f3aafaf1191c8fe867c09ff889b429c49b41593.dll
Resource
win7-20240903-en
General
-
Target
ee45f61f822a4c13f34e31b34f3aafaf1191c8fe867c09ff889b429c49b41593.dll
-
Size
696KB
-
MD5
097e46f149ea28d85f00b2e5eb558897
-
SHA1
05c6fb8aaebdc0dc8f6f312b26a4c5c44e31a185
-
SHA256
ee45f61f822a4c13f34e31b34f3aafaf1191c8fe867c09ff889b429c49b41593
-
SHA512
10ffa686a2a5ec7a635a5fecbb5d1de6975b1e51b4dc46c06d479b1fff80b27f1c37a7fc87385f936f5473a313c58ffd95396f3239834f6a2dbb1b7a1099c738
-
SSDEEP
12288:FqQlvIOH0GCTBHmPt4eBQhTico09cDlB4Vx/ID:0uH0GCNeQJi7H0
Malware Config
Extracted
emotet
Epoch4
91.200.186.228:443
41.76.108.46:8080
188.165.214.166:7080
191.252.196.221:8080
103.8.26.103:8080
185.184.25.237:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
212.237.17.99:8080
212.237.56.116:7080
216.158.226.206:443
110.232.117.186:8080
158.69.222.101:443
107.182.225.142:8080
176.104.106.96:8080
81.0.236.90:443
50.116.54.215:443
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
Emotet family
-
Blocklisted process makes network request 15 IoCs
flow pid Process 4 2328 rundll32.exe 7 2328 rundll32.exe 8 2328 rundll32.exe 9 2328 rundll32.exe 12 2328 rundll32.exe 13 2328 rundll32.exe 14 2328 rundll32.exe 16 2328 rundll32.exe 17 2328 rundll32.exe 18 2328 rundll32.exe 19 2328 rundll32.exe 22 2328 rundll32.exe 24 2328 rundll32.exe 25 2328 rundll32.exe 26 2328 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2328 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2888 wrote to memory of 2244 2888 rundll32.exe 31 PID 2888 wrote to memory of 2244 2888 rundll32.exe 31 PID 2888 wrote to memory of 2244 2888 rundll32.exe 31 PID 2888 wrote to memory of 2244 2888 rundll32.exe 31 PID 2888 wrote to memory of 2244 2888 rundll32.exe 31 PID 2888 wrote to memory of 2244 2888 rundll32.exe 31 PID 2888 wrote to memory of 2244 2888 rundll32.exe 31 PID 2244 wrote to memory of 2328 2244 rundll32.exe 32 PID 2244 wrote to memory of 2328 2244 rundll32.exe 32 PID 2244 wrote to memory of 2328 2244 rundll32.exe 32 PID 2244 wrote to memory of 2328 2244 rundll32.exe 32 PID 2244 wrote to memory of 2328 2244 rundll32.exe 32 PID 2244 wrote to memory of 2328 2244 rundll32.exe 32 PID 2244 wrote to memory of 2328 2244 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ee45f61f822a4c13f34e31b34f3aafaf1191c8fe867c09ff889b429c49b41593.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ee45f61f822a4c13f34e31b34f3aafaf1191c8fe867c09ff889b429c49b41593.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ee45f61f822a4c13f34e31b34f3aafaf1191c8fe867c09ff889b429c49b41593.dll",Control_RunDLL3⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2328
-
-