Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20/11/2024, 20:15
General
-
Target
93f7dbd9c7702f251d17d0602d4f88f555d3fe10c0f2d9c19e0bbd74ca0884a5.dll
-
Size
837KB
-
MD5
0b257cc993c02f34b79e9f95dc469327
-
SHA1
6e70e1caf019bec89333e0d712483a1da129021f
-
SHA256
93f7dbd9c7702f251d17d0602d4f88f555d3fe10c0f2d9c19e0bbd74ca0884a5
-
SHA512
73e51a9eb96ae8a2713106424eee65e4387632a692b4fda73a3283b75fe49253671d248c747c07ac4c06b8790fa6383f80ddddb18e7f68bc7d46de20cd7105f5
-
SSDEEP
6144:O8q+c2lEiKXfsCeMi1UTETLiCoEEk4bxNiLEU99nw0HTqU1FzKYMjHjiZQ3hO5DG:O6EiGkCe11vAkyxNxsTMjHj3Apoplz6
Malware Config
Extracted
emotet
Epoch4
94.23.45.86:4143
209.97.163.214:443
212.24.98.99:8080
103.43.75.120:443
183.111.227.137:8080
197.242.150.244:8080
129.232.188.93:443
159.65.88.10:8080
163.44.196.120:8080
51.161.73.194:443
164.90.222.65:443
159.89.202.34:443
1.234.2.232:8080
150.95.66.124:8080
51.91.76.89:8080
196.218.30.83:443
5.9.116.246:8080
146.59.226.45:443
173.212.193.249:8080
213.241.20.155:443
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet family
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\93f7dbd9c7702f251d17d0602d4f88f555d3fe10c0f2d9c19e0bbd74ca0884a5.dll1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\HBhhBmvJZKANri\kjCEXFRTTiZ.dll"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
180KB
-
Filesize
860KB
-
Filesize
860KB
-
Filesize
860KB
-
Filesize
860KB
-
Filesize
860KB
-
Filesize
860KB