Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 00:47
General
-
Target
cee1db4d1a7ecf6d33a2a80d93ea5b731ea2a825e4261353aed16ed3b97371a5.dll
-
Size
577KB
-
MD5
343bc7da956bae085b133595b92138fb
-
SHA1
15b1c7e46f61408f05532a48f23bbed6a0e11dd6
-
SHA256
cee1db4d1a7ecf6d33a2a80d93ea5b731ea2a825e4261353aed16ed3b97371a5
-
SHA512
25422513dd29266822db6f5abc062ce8b121c482e54289f641d3e1a8d33d4aa81d7836b532677ea2f8397f7eddfa3a72226c061fe8f2b980ef79afd485d5bda5
-
SSDEEP
12288:yocc2tri1Ut9aa2lI1ZrmNQo3A17bDRRySLhqcsL9HdFFlsQzTM5i:yocc21t9aaLowpDDySL8c09bui
Malware Config
Extracted
emotet
Epoch5
78.47.204.80:443
62.171.178.147:8080
165.232.185.110:8080
103.41.204.169:8080
54.37.228.122:443
202.29.239.162:443
103.71.99.57:8080
64.227.55.231:8080
85.214.67.203:8080
139.196.72.155:8080
195.77.239.39:8080
202.28.34.99:8080
54.37.106.167:8080
103.126.216.86:443
68.183.91.111:8080
104.244.79.94:443
85.25.120.45:8080
116.124.128.206:8080
210.57.209.142:8080
103.85.95.4:8080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet family
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\cee1db4d1a7ecf6d33a2a80d93ea5b731ea2a825e4261353aed16ed3b97371a5.dll1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\AgvOojwb\JcOv.dll"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
680KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB