Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/11/2024, 00:22
Static task
static1
Behavioral task
behavioral1
Sample
35c63c88aa3f71f05f372fa04f66aee0ef62062223a2e2e9b00afeb7e903098a.dll
Resource
win7-20240903-en
General
-
Target
35c63c88aa3f71f05f372fa04f66aee0ef62062223a2e2e9b00afeb7e903098a.dll
-
Size
780KB
-
MD5
cb6df8dd99e2a8b42839f0d41623a3d0
-
SHA1
5dcb041c351377fcbde8ec9bc33e931cef27f6c1
-
SHA256
35c63c88aa3f71f05f372fa04f66aee0ef62062223a2e2e9b00afeb7e903098a
-
SHA512
d5bd68e9cf67f04bba29c54d2fcd7242c9f146080a3f7ed8684d788baeefe2cd9066c2e9ab4434ce2e5e7393e1fc004637800d527ceec88abc167379a221b4e0
-
SSDEEP
12288:5s/YpAp2/yQ0P7BLyP70njTkgwzDwtAs0owb8ZPnJ0l7FgDZ4liMFdajByR:5GPp2/yQ0PtC0E/w50Pb8wgDZTGMjB
Malware Config
Extracted
emotet
Epoch4
45.80.148.200:443
80.211.3.13:8080
110.232.117.186:8080
45.142.114.231:8080
131.100.24.231:80
107.182.225.142:8080
45.118.135.203:7080
164.68.99.3:8080
212.237.56.116:7080
41.76.108.46:8080
58.227.42.236:80
104.168.155.129:8080
79.172.212.216:8080
192.254.71.210:443
51.38.71.0:443
217.182.143.207:443
203.114.109.124:443
185.157.82.211:8080
173.212.193.249:8080
45.176.232.124:443
158.69.222.101:443
212.237.17.99:8080
207.38.84.195:8080
195.154.133.20:443
162.243.175.63:443
138.185.72.26:8080
103.8.26.102:8080
103.8.26.103:8080
50.116.54.215:443
178.79.147.66:8080
45.118.115.99:8080
178.63.25.185:443
46.55.222.11:443
103.75.201.2:443
81.0.236.90:443
176.104.106.96:8080
162.214.50.39:7080
212.237.5.209:443
209.59.138.75:7080
216.158.226.206:443
104.251.214.46:8080
212.24.98.99:8080
Signatures
-
Emotet family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 580 wrote to memory of 2128 580 regsvr32.exe 31 PID 580 wrote to memory of 2128 580 regsvr32.exe 31 PID 580 wrote to memory of 2128 580 regsvr32.exe 31 PID 580 wrote to memory of 2128 580 regsvr32.exe 31 PID 580 wrote to memory of 2128 580 regsvr32.exe 31 PID 580 wrote to memory of 2128 580 regsvr32.exe 31 PID 580 wrote to memory of 2128 580 regsvr32.exe 31 PID 2128 wrote to memory of 2292 2128 regsvr32.exe 32 PID 2128 wrote to memory of 2292 2128 regsvr32.exe 32 PID 2128 wrote to memory of 2292 2128 regsvr32.exe 32 PID 2128 wrote to memory of 2292 2128 regsvr32.exe 32 PID 2128 wrote to memory of 2292 2128 regsvr32.exe 32 PID 2128 wrote to memory of 2292 2128 regsvr32.exe 32 PID 2128 wrote to memory of 2292 2128 regsvr32.exe 32
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\35c63c88aa3f71f05f372fa04f66aee0ef62062223a2e2e9b00afeb7e903098a.dll1⤵
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\35c63c88aa3f71f05f372fa04f66aee0ef62062223a2e2e9b00afeb7e903098a.dll2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\35c63c88aa3f71f05f372fa04f66aee0ef62062223a2e2e9b00afeb7e903098a.dll",DllRegisterServer3⤵
- System Location Discovery: System Language Discovery
PID:2292
-
-