Analysis
-
max time kernel
41s -
max time network
125s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
07-01-2021 06:53
Static task
static1
Behavioral task
behavioral1
Sample
8088473cb357050baf08a2f17c1ca4ef.dll
Resource
win7v20201028
General
-
Target
8088473cb357050baf08a2f17c1ca4ef.dll
-
Size
322KB
-
MD5
8088473cb357050baf08a2f17c1ca4ef
-
SHA1
e0224d2797f107849932317c7516c6f6af32e06f
-
SHA256
4a6a2b0f9106f473e07735edb3bb1987728fcb4522afedad28b2e88476357172
-
SHA512
d5b582066bd3966a0ae07a58cc61a46ed750a5408e99f5f0b3d1fdcffd95ec1667674fea22b15e78332bf14e4cd30bf2985a77164bad4c6ea001e28f9e93c654
Malware Config
Extracted
emotet
Epoch2
197.87.160.216:80
78.188.225.105:80
50.116.111.59:8080
173.249.20.233:443
188.165.214.98:8080
188.219.31.12:80
157.245.99.39:8080
172.125.40.123:80
62.30.7.67:443
120.150.60.189:80
109.74.5.95:8080
67.10.155.92:80
67.170.250.203:443
2.58.16.89:8080
186.74.215.34:80
202.141.243.254:443
118.83.154.64:443
172.86.188.251:8080
37.187.72.193:8080
87.106.139.101:8080
110.145.77.103:80
100.37.240.62:80
64.207.182.168:8080
120.150.218.241:443
89.216.122.92:80
51.89.36.180:443
168.235.67.138:7080
194.4.58.192:7080
74.40.205.197:443
185.94.252.104:443
62.171.142.179:8080
85.105.111.166:80
137.59.187.107:8080
167.114.153.111:8080
202.134.4.216:8080
74.128.121.17:80
136.244.110.184:8080
72.229.97.235:80
217.20.166.178:7080
5.39.91.110:7080
121.124.124.40:7080
176.111.60.55:8080
5.2.212.254:80
95.213.236.64:8080
181.165.68.127:80
152.170.205.73:80
62.75.141.82:80
208.74.26.234:80
139.59.60.244:8080
46.105.131.79:8080
190.29.166.0:80
161.0.153.60:80
24.69.65.8:8080
155.186.9.160:80
110.145.11.73:80
190.240.194.77:443
200.116.145.225:443
74.75.104.224:80
134.209.144.106:443
58.1.242.115:80
142.112.10.95:20
181.171.209.241:443
190.162.215.233:80
139.162.60.124:8080
220.245.198.194:80
24.178.90.49:80
94.23.237.171:443
37.139.21.175:8080
108.21.72.56:443
209.141.54.221:7080
72.186.136.247:443
115.94.207.99:443
109.116.245.80:80
174.118.202.24:443
24.179.13.119:80
47.144.21.37:80
49.205.182.134:80
95.9.5.93:80
185.201.9.197:8080
119.59.116.21:8080
187.161.206.24:80
172.105.13.66:443
202.134.4.211:8080
78.24.219.147:8080
110.145.101.66:443
172.104.97.173:8080
203.153.216.189:7080
123.176.25.234:80
201.241.127.190:80
74.208.45.104:8080
104.131.11.150:443
72.188.173.74:80
41.185.28.84:8080
178.152.87.96:80
61.19.246.238:443
75.143.247.51:80
50.245.107.73:443
139.99.158.11:443
50.91.114.38:80
144.217.7.207:7080
70.92.118.112:80
138.68.87.218:443
79.137.83.50:443
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 13 3144 rundll32.exe 14 3144 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
rundll32.exepid process 3144 rundll32.exe 3144 rundll32.exe 3144 rundll32.exe 3144 rundll32.exe 3144 rundll32.exe 3144 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1404 wrote to memory of 3144 1404 rundll32.exe rundll32.exe PID 1404 wrote to memory of 3144 1404 rundll32.exe rundll32.exe PID 1404 wrote to memory of 3144 1404 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8088473cb357050baf08a2f17c1ca4ef.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8088473cb357050baf08a2f17c1ca4ef.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses