Analysis
-
max time kernel
95s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21/11/2024, 00:09 UTC
General
-
Target
224fe4a379a431b94c500fd32c92dcfc986334f5a2b3eb8b6e1cc1861a06b9b3.dll
-
Size
520KB
-
MD5
cef0852106c4b88ac96aaf443a986665
-
SHA1
c86da5bfac0748411f283b24e2786eeba406ed10
-
SHA256
224fe4a379a431b94c500fd32c92dcfc986334f5a2b3eb8b6e1cc1861a06b9b3
-
SHA512
5a382da94d9a5082fe3b9be917903b616790ae9ebf82c10f498b1429dd0441408f3bc80e3c4bc55a5c5106ae38e932207e86c5b4c6613465f71b4015e8c30c60
-
SSDEEP
12288:KZ01lbelr11DkMO0rfFb/pn5iLEEgTyfEP49f:89lr1Vk70h/KLhn
Malware Config
Extracted
emotet
Epoch5
159.69.43.124:8080
45.79.80.198:443
207.148.81.119:8080
128.199.192.135:8080
118.98.72.86:443
217.182.143.207:443
168.197.250.14:80
116.124.128.206:8080
78.46.73.125:443
185.148.168.15:8080
195.154.146.35:443
85.214.67.203:8080
194.9.172.107:8080
59.148.253.194:443
210.57.209.142:8080
54.38.242.185:443
195.77.239.39:8080
159.69.237.188:443
104.131.62.48:8080
62.171.178.147:8080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\224fe4a379a431b94c500fd32c92dcfc986334f5a2b3eb8b6e1cc1861a06b9b3.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\224fe4a379a431b94c500fd32c92dcfc986334f5a2b3eb8b6e1cc1861a06b9b3.dll2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\224fe4a379a431b94c500fd32c92dcfc986334f5a2b3eb8b6e1cc1861a06b9b3.dll",DllRegisterServer3⤵
- System Location Discovery: System Language Discovery
-
-
Network
-
DNS104.219.191.52.in-addr.arpaRemote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse -
DNS138.136.73.23.in-addr.arpaRemote address:8.8.8.8:53Request138.136.73.23.in-addr.arpaIN PTRResponse138.136.73.23.in-addr.arpaIN PTRa23-73-136-138deploystaticakamaitechnologiescom
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS73.31.126.40.in-addr.arpaRemote address:8.8.8.8:53Request73.31.126.40.in-addr.arpaIN PTRResponse
-
DNS58.55.71.13.in-addr.arpaRemote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
DNS197.87.175.4.in-addr.arpaRemote address:8.8.8.8:53Request197.87.175.4.in-addr.arpaIN PTRResponse
-
DNS198.187.3.20.in-addr.arpaRemote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
DNS18.134.221.88.in-addr.arpaRemote address:8.8.8.8:53Request18.134.221.88.in-addr.arpaIN PTRResponse18.134.221.88.in-addr.arpaIN PTRa88-221-134-18deploystaticakamaitechnologiescom
-
DNS43.229.111.52.in-addr.arpaRemote address:8.8.8.8:53Request43.229.111.52.in-addr.arpaIN PTRResponse
-
8.8.8.8:53104.219.191.52.in-addr.arpadns
DNS Request
104.219.191.52.in-addr.arpa
-
8.8.8.8:53138.136.73.23.in-addr.arpadns
DNS Request
138.136.73.23.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:5373.31.126.40.in-addr.arpadns
DNS Request
73.31.126.40.in-addr.arpa
-
8.8.8.8:5358.55.71.13.in-addr.arpadns
DNS Request
58.55.71.13.in-addr.arpa
-
8.8.8.8:53197.87.175.4.in-addr.arpadns
DNS Request
197.87.175.4.in-addr.arpa
-
8.8.8.8:53198.187.3.20.in-addr.arpadns
DNS Request
198.187.3.20.in-addr.arpa
-
8.8.8.8:5318.134.221.88.in-addr.arpadns
DNS Request
18.134.221.88.in-addr.arpa
-
8.8.8.8:5343.229.111.52.in-addr.arpadns
DNS Request
43.229.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB