Analysis
-
max time kernel
295s -
max time network
298s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
26-01-2021 08:44
Static task
static1
General
-
Target
1fa84cf8ec429630099e9c8f0004f9d38da78d2c64c8799ead171686717e9cb4.dll
-
Size
609KB
-
MD5
15f8e8f198852dc71f501631d201544f
-
SHA1
88554c3a65c6e012b9e690cd0a69ae095c2c55c3
-
SHA256
1fa84cf8ec429630099e9c8f0004f9d38da78d2c64c8799ead171686717e9cb4
-
SHA512
4c4c0f9bdf19c0958af36b2fa5eb55fb373689f11768e248fa2ba72d9108185ba75086a50dc0fa70e0157dfda08dfcd1ffdf76de7d12e0cc3503cfa342144fcc
Malware Config
Extracted
emotet
Epoch3
190.55.186.229:80
203.157.152.9:7080
157.245.145.87:443
132.248.38.158:80
110.172.180.180:8080
70.32.89.105:8080
161.49.84.2:80
37.46.129.215:8080
50.116.78.109:8080
115.79.195.246:80
178.62.254.156:8080
175.103.38.146:80
188.226.165.170:8080
91.93.3.85:8080
162.144.145.58:8080
117.2.139.117:443
190.85.46.52:7080
201.193.160.196:80
152.32.75.74:443
195.201.56.70:8080
192.210.217.94:8080
91.83.93.103:443
172.104.46.84:8080
201.212.61.66:80
186.96.170.61:80
74.208.173.91:8080
182.73.7.59:8080
139.59.12.63:8080
211.110.229.161:8080
122.116.104.238:8443
223.17.215.76:80
195.159.28.244:8080
82.78.179.117:443
2.58.16.86:8080
65.32.168.171:80
58.27.215.3:8080
179.233.3.89:80
190.19.169.69:443
203.160.167.243:80
178.254.36.182:8080
202.29.237.113:8080
79.133.6.236:8080
103.93.220.182:80
88.58.209.2:80
24.230.124.78:80
203.56.191.129:8080
186.146.229.172:80
91.75.75.46:80
68.133.75.203:8080
103.229.73.17:8080
116.202.10.123:8080
139.59.61.215:443
46.105.131.68:8080
2.82.75.215:80
75.127.14.170:8080
120.51.34.254:80
185.142.236.163:443
139.5.101.203:80
203.153.216.178:7080
188.166.220.180:7080
178.33.167.120:8080
162.144.42.60:8080
201.163.74.204:80
103.80.51.61:8080
49.206.16.156:80
78.90.78.210:80
110.37.224.243:80
27.78.27.110:443
190.18.184.113:80
172.193.14.201:80
192.163.221.191:8080
157.7.164.178:8081
183.91.3.63:80
109.99.146.210:8080
54.38.143.245:8080
192.241.220.183:8080
180.148.4.130:8080
190.107.118.125:80
8.4.9.137:8080
163.53.204.180:443
143.95.101.72:8080
Signatures
-
Blocklisted process makes network request 25 IoCs
Processes:
rundll32.exeflow pid process 18 4724 rundll32.exe 22 4724 rundll32.exe 24 4724 rundll32.exe 27 4724 rundll32.exe 28 4724 rundll32.exe 29 4724 rundll32.exe 30 4724 rundll32.exe 31 4724 rundll32.exe 32 4724 rundll32.exe 33 4724 rundll32.exe 34 4724 rundll32.exe 35 4724 rundll32.exe 36 4724 rundll32.exe 37 4724 rundll32.exe 38 4724 rundll32.exe 39 4724 rundll32.exe 40 4724 rundll32.exe 41 4724 rundll32.exe 42 4724 rundll32.exe 43 4724 rundll32.exe 44 4724 rundll32.exe 45 4724 rundll32.exe 46 4724 rundll32.exe 47 4724 rundll32.exe 48 4724 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 52 IoCs
Processes:
rundll32.exepid process 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe 4724 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4684 wrote to memory of 4724 4684 rundll32.exe rundll32.exe PID 4684 wrote to memory of 4724 4684 rundll32.exe rundll32.exe PID 4684 wrote to memory of 4724 4684 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1fa84cf8ec429630099e9c8f0004f9d38da78d2c64c8799ead171686717e9cb4.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1fa84cf8ec429630099e9c8f0004f9d38da78d2c64c8799ead171686717e9cb4.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses