Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 21:21
Static task
static1
Behavioral task
behavioral1
Sample
0d9c855ea4e5a0dfeac488a97846b8f780c5eb55a0e52fcdd0f0cee8bff70082.dll
Resource
win7-20241010-en
General
-
Target
0d9c855ea4e5a0dfeac488a97846b8f780c5eb55a0e52fcdd0f0cee8bff70082.dll
-
Size
465KB
-
MD5
2ab59c44ed4b4dc4e8924ee34dabb02c
-
SHA1
0721952dabd2a56e58699d0214d0748cb3574a81
-
SHA256
0d9c855ea4e5a0dfeac488a97846b8f780c5eb55a0e52fcdd0f0cee8bff70082
-
SHA512
6af523418ccf865a692f8f7c81633273dc17a5c36cae40d42d7717b0b257763ffc0bcf152f7ae164fa37b75310b972b06c60c841fcd0939c8c7885a6f7094b50
-
SSDEEP
12288:uS4BnAed8BK2o0aIa5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANK3a34dmyL0E3Q
Malware Config
Extracted
emotet
Epoch5
210.57.209.142:8080
103.56.149.105:8080
104.248.225.227:8080
103.41.204.169:8080
175.126.176.79:8080
207.148.81.119:8080
110.235.83.107:7080
54.38.242.185:443
103.133.214.242:8080
88.217.172.165:8080
68.183.93.250:443
159.69.237.188:443
51.68.141.164:8080
37.44.244.177:8080
54.37.228.122:443
68.183.91.111:8080
196.44.98.190:8080
78.47.204.80:443
37.59.209.141:8080
116.124.128.206:8080
217.182.143.207:443
5.56.132.177:8080
93.104.209.107:8080
54.37.106.167:8080
134.122.119.23:8080
85.25.120.45:8080
59.148.253.194:443
139.196.72.155:8080
178.62.112.199:8080
103.8.26.17:8080
195.154.146.35:443
45.71.195.104:8080
103.42.58.120:7080
202.29.239.162:443
118.98.72.86:443
202.28.34.99:8080
66.42.57.149:443
190.90.233.66:443
194.9.172.107:8080
103.85.95.4:8080
185.148.168.220:8080
78.46.73.125:443
203.153.216.46:443
54.38.143.246:7080
62.171.178.147:8080
85.214.67.203:8080
195.77.239.39:8080
202.134.4.210:7080
36.67.23.59:443
87.106.97.83:7080
188.225.32.231:4143
Signatures
-
Emotet family
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1324 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1944 regsvr32.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1944 wrote to memory of 1324 1944 regsvr32.exe 30 PID 1944 wrote to memory of 1324 1944 regsvr32.exe 30 PID 1944 wrote to memory of 1324 1944 regsvr32.exe 30 PID 1944 wrote to memory of 1324 1944 regsvr32.exe 30 PID 1944 wrote to memory of 1324 1944 regsvr32.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0d9c855ea4e5a0dfeac488a97846b8f780c5eb55a0e52fcdd0f0cee8bff70082.dll1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\CcHUa\dkVjXjPdVGLf.dll"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1324
-