Analysis
-
max time kernel
11s -
max time network
126s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
26-01-2021 16:29
Static task
static1
Behavioral task
behavioral1
Sample
a9c68d527223db40014d067cf4fdae5be46cca67387e9cfdff118276085f23ef.dll
Resource
win7v20201028
0 signatures
0 seconds
General
-
Target
a9c68d527223db40014d067cf4fdae5be46cca67387e9cfdff118276085f23ef.dll
-
Size
404KB
-
MD5
9a062ead5b2d55af0a5a4b39c5b5eadc
-
SHA1
fc83367be87c700a696b0329dab538b5e47d90bf
-
SHA256
a9c68d527223db40014d067cf4fdae5be46cca67387e9cfdff118276085f23ef
-
SHA512
693ab862c7e3c5dad3ca3d44bbc4a5a4c2391ff558e02e86e4c1d7d1fa7c00b4acf1c426ca619dea2b422997caaf1f0ecba37ec0ffca19edaca297005c9ad861
Malware Config
Extracted
Family
emotet
Botnet
LEA
C2
80.158.3.161:443
80.158.51.209:8080
80.158.35.51:80
80.158.63.78:443
80.158.53.167:80
80.158.62.194:443
80.158.59.174:8080
80.158.43.136:80
rsa_pubkey.plain
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 4 1892 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
rundll32.exepid process 1892 rundll32.exe 1892 rundll32.exe 1892 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 748 wrote to memory of 1892 748 rundll32.exe rundll32.exe PID 748 wrote to memory of 1892 748 rundll32.exe rundll32.exe PID 748 wrote to memory of 1892 748 rundll32.exe rundll32.exe PID 748 wrote to memory of 1892 748 rundll32.exe rundll32.exe PID 748 wrote to memory of 1892 748 rundll32.exe rundll32.exe PID 748 wrote to memory of 1892 748 rundll32.exe rundll32.exe PID 748 wrote to memory of 1892 748 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9c68d527223db40014d067cf4fdae5be46cca67387e9cfdff118276085f23ef.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9c68d527223db40014d067cf4fdae5be46cca67387e9cfdff118276085f23ef.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1244-6-0x000007FEF7500000-0x000007FEF777A000-memory.dmpFilesize
2.5MB
-
memory/1892-2-0x0000000000000000-mapping.dmp
-
memory/1892-3-0x0000000075301000-0x0000000075303000-memory.dmpFilesize
8KB
-
memory/1892-4-0x0000000000130000-0x000000000014D000-memory.dmpFilesize
116KB
-
memory/1892-5-0x00000000001F0000-0x0000000000210000-memory.dmpFilesize
128KB