Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 18:49
General
-
Target
1dd26f40fb8de877805eddfc65875a46cafc49950b93e234b08b0da7e12038eb.dll
-
Size
653KB
-
MD5
f84f6037679b13b820598a1cabe7a545
-
SHA1
0c8cd51a8c6bee429b5c51ea9c712a844d3126a6
-
SHA256
1dd26f40fb8de877805eddfc65875a46cafc49950b93e234b08b0da7e12038eb
-
SHA512
dafe6b1370aae3a648faa7f88b4954c7805411722ad3d4e9297eb84d0dcfe954f5816bc986c0c2c3962015cb2d4ebbfc5b8d520402656fd027333def4f864611
-
SSDEEP
12288:lcQKcc2Tlb6Ky9aa9lNeSrjNMYps1ribNaygIH5gHQGEAfv7lwzWTSrOpBVkU8Qn:lcQKcc2Fy9aa4Y+gYygIZgHQnoWyiOpd
Malware Config
Extracted
emotet
Epoch5
78.47.204.80:443
212.83.184.188:8080
36.67.23.59:443
128.199.217.206:443
103.56.149.105:8080
202.29.239.162:443
68.183.91.111:8080
104.244.79.94:443
64.227.55.231:8080
157.230.99.206:8080
165.232.185.110:8080
103.71.99.57:8080
103.126.216.86:443
88.217.172.165:8080
103.41.204.169:8080
87.106.97.83:7080
85.25.120.45:8080
188.225.32.231:4143
118.98.72.86:443
178.62.112.199:8080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet family
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1dd26f40fb8de877805eddfc65875a46cafc49950b93e234b08b0da7e12038eb.dll1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZgQid\tkQKURheO.dll"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
680KB