Analysis
-
max time kernel
93s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 23:21
Static task
static1
Behavioral task
behavioral1
Sample
98162f2648cdfad48b1aa8b2114808c1c084c11785ab287d0524df50eed7d74a.dll
Resource
win7-20241010-en
General
-
Target
98162f2648cdfad48b1aa8b2114808c1c084c11785ab287d0524df50eed7d74a.dll
-
Size
258KB
-
MD5
7bd60f719d495caadc5e1ed811a732d6
-
SHA1
fe785c963bd2e31a192a1b4d47d62dc6c3d1ace5
-
SHA256
98162f2648cdfad48b1aa8b2114808c1c084c11785ab287d0524df50eed7d74a
-
SHA512
89804eb33bfd6c0a65762c971e3fedc1b6e9872648a456b299fac2495b6f120075f1765ebd8a8a95d9623909a6030bf188a7766ab45e879fb0ca1ce6c3f0e59e
-
SSDEEP
6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBX2ypv:6jIG/pjjuLbJLmGshoCUnWTFpv
Malware Config
Extracted
emotet
Epoch5
209.239.112.82:8080
116.124.128.206:8080
45.63.5.129:443
128.199.192.135:8080
51.178.61.60:443
168.197.250.14:80
177.72.80.14:7080
51.210.242.234:8080
142.4.219.173:8080
78.47.204.80:443
78.46.73.125:443
37.44.244.177:8080
37.59.209.141:8080
104.131.62.48:8080
190.90.233.66:443
185.148.168.220:8080
185.148.168.15:8080
62.171.178.147:8080
191.252.103.16:80
54.38.242.185:443
85.214.67.203:8080
217.182.143.207:443
159.69.237.188:443
210.57.209.142:8080
54.37.228.122:443
207.148.81.119:8080
195.77.239.39:8080
66.42.57.149:443
195.154.146.35:443
Signatures
-
Emotet family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2716 3044 regsvr32.exe 82 PID 3044 wrote to memory of 2716 3044 regsvr32.exe 82 PID 3044 wrote to memory of 2716 3044 regsvr32.exe 82 PID 2716 wrote to memory of 2648 2716 regsvr32.exe 83 PID 2716 wrote to memory of 2648 2716 regsvr32.exe 83 PID 2716 wrote to memory of 2648 2716 regsvr32.exe 83
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\98162f2648cdfad48b1aa8b2114808c1c084c11785ab287d0524df50eed7d74a.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\98162f2648cdfad48b1aa8b2114808c1c084c11785ab287d0524df50eed7d74a.dll2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\98162f2648cdfad48b1aa8b2114808c1c084c11785ab287d0524df50eed7d74a.dll",DllRegisterServer3⤵
- System Location Discovery: System Language Discovery
PID:2648
-
-