Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 20:38
Static task
static1
Behavioral task
behavioral1
Sample
966ce02794b74ef420f9459881bc24921cab20516722ad6f6b25c73ce680e767.dll
Resource
win7-20240903-en
General
-
Target
966ce02794b74ef420f9459881bc24921cab20516722ad6f6b25c73ce680e767.dll
-
Size
615KB
-
MD5
3bf642f6dfb0f8d38f9dc7aa1f368042
-
SHA1
7bc9570fc027900aaf0818d89e8a36674b8f1e6c
-
SHA256
966ce02794b74ef420f9459881bc24921cab20516722ad6f6b25c73ce680e767
-
SHA512
3e78a760e11d524dc06a846b57d3bcda71283e62be0019fb7873e47b05f5573420a1a641f4dee9f41a6cc1b58e62193be4aaff826756dc39488c92989883b047
-
SSDEEP
12288:dOzFuk7dA19ZCOo6AI/2NLaQLJkMZR+TTD7vgEPej:0hn7dA19ZCOyDaQVkqkXa
Malware Config
Extracted
emotet
Epoch4
131.100.24.231:80
209.59.138.75:7080
103.8.26.103:8080
51.38.71.0:443
212.237.17.99:8080
79.172.212.216:8080
207.38.84.195:8080
104.168.155.129:8080
178.79.147.66:8080
46.55.222.11:443
103.8.26.102:8080
192.254.71.210:443
45.176.232.124:443
203.114.109.124:443
51.68.175.8:8080
58.227.42.236:80
45.142.114.231:8080
217.182.143.207:443
178.63.25.185:443
45.118.115.99:8080
103.75.201.2:443
104.251.214.46:8080
158.69.222.101:443
81.0.236.90:443
45.118.135.203:7080
176.104.106.96:8080
212.237.56.116:7080
216.158.226.206:443
173.212.193.249:8080
50.116.54.215:443
138.185.72.26:8080
41.76.108.46:8080
212.237.5.209:443
107.182.225.142:8080
195.154.133.20:443
162.214.50.39:7080
110.232.117.186:8080
Signatures
-
Emotet family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
regsvr32.exerundll32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid Process procid_target PID 2848 wrote to memory of 1364 2848 regsvr32.exe 31 PID 2848 wrote to memory of 1364 2848 regsvr32.exe 31 PID 2848 wrote to memory of 1364 2848 regsvr32.exe 31 PID 2848 wrote to memory of 1364 2848 regsvr32.exe 31 PID 2848 wrote to memory of 1364 2848 regsvr32.exe 31 PID 2848 wrote to memory of 1364 2848 regsvr32.exe 31 PID 2848 wrote to memory of 1364 2848 regsvr32.exe 31 PID 1364 wrote to memory of 2408 1364 regsvr32.exe 32 PID 1364 wrote to memory of 2408 1364 regsvr32.exe 32 PID 1364 wrote to memory of 2408 1364 regsvr32.exe 32 PID 1364 wrote to memory of 2408 1364 regsvr32.exe 32 PID 1364 wrote to memory of 2408 1364 regsvr32.exe 32 PID 1364 wrote to memory of 2408 1364 regsvr32.exe 32 PID 1364 wrote to memory of 2408 1364 regsvr32.exe 32
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\966ce02794b74ef420f9459881bc24921cab20516722ad6f6b25c73ce680e767.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\966ce02794b74ef420f9459881bc24921cab20516722ad6f6b25c73ce680e767.dll2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\966ce02794b74ef420f9459881bc24921cab20516722ad6f6b25c73ce680e767.dll",DllRegisterServer3⤵
- System Location Discovery: System Language Discovery
PID:2408
-
-