Analysis
-
max time kernel
140s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 00:56
Static task
static1
Behavioral task
behavioral1
Sample
696819a824327a505987eb467c43f87686500ec4e02e006add1e7ea54c18a1ef.dll
Resource
win7-20240903-en
General
-
Target
696819a824327a505987eb467c43f87686500ec4e02e006add1e7ea54c18a1ef.dll
-
Size
465KB
-
MD5
382c96eb10a6b49329ef9886bdc7d543
-
SHA1
017ca47da5c6c84b8aa44ba59df742ee7dd4e76c
-
SHA256
696819a824327a505987eb467c43f87686500ec4e02e006add1e7ea54c18a1ef
-
SHA512
1aa53badad295af174c733541c99ee82b89eba611df7c0156e664c617bc4f6d7189e920b0fcde2817a76131a196a96e415404f1f0f509b172023905273f8cb69
-
SSDEEP
12288:uS4BnAed8BK2o0a6a5aoE0ZcKTME+ZvDV5ejhF0E3hobx:R4BnANK1a34dmyL0E3Q
Malware Config
Extracted
emotet
Epoch5
210.57.209.142:8080
103.56.149.105:8080
104.248.225.227:8080
103.41.204.169:8080
175.126.176.79:8080
207.148.81.119:8080
110.235.83.107:7080
54.38.242.185:443
103.133.214.242:8080
88.217.172.165:8080
68.183.93.250:443
159.69.237.188:443
51.68.141.164:8080
37.44.244.177:8080
54.37.228.122:443
68.183.91.111:8080
196.44.98.190:8080
78.47.204.80:443
37.59.209.141:8080
116.124.128.206:8080
217.182.143.207:443
5.56.132.177:8080
93.104.209.107:8080
54.37.106.167:8080
134.122.119.23:8080
85.25.120.45:8080
59.148.253.194:443
139.196.72.155:8080
178.62.112.199:8080
103.8.26.17:8080
195.154.146.35:443
45.71.195.104:8080
103.42.58.120:7080
202.29.239.162:443
118.98.72.86:443
202.28.34.99:8080
66.42.57.149:443
190.90.233.66:443
194.9.172.107:8080
103.85.95.4:8080
185.148.168.220:8080
78.46.73.125:443
203.153.216.46:443
54.38.143.246:7080
62.171.178.147:8080
85.214.67.203:8080
195.77.239.39:8080
202.134.4.210:7080
36.67.23.59:443
87.106.97.83:7080
188.225.32.231:4143
Signatures
-
Emotet family
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2436 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2464 regsvr32.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2464 wrote to memory of 2436 2464 regsvr32.exe 31 PID 2464 wrote to memory of 2436 2464 regsvr32.exe 31 PID 2464 wrote to memory of 2436 2464 regsvr32.exe 31 PID 2464 wrote to memory of 2436 2464 regsvr32.exe 31 PID 2464 wrote to memory of 2436 2464 regsvr32.exe 31
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\696819a824327a505987eb467c43f87686500ec4e02e006add1e7ea54c18a1ef.dll1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\CtLUrezVtKPET\DVgmuvDpigGtmNL.dll"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2436
-