Analysis
-
max time kernel
122s -
max time network
144s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
16-11-2021 22:16
Static task
static1
General
-
Target
072a3978d89b226c9847eb3bfc02ef12f01d2fd3409fb3ca2734ecfe0186ec47.dll
-
Size
252KB
-
MD5
97a7cb619515de7df6e9078239ba48d3
-
SHA1
1db3015d36fe5ac337d25cdfa6f2b3382eb842c7
-
SHA256
072a3978d89b226c9847eb3bfc02ef12f01d2fd3409fb3ca2734ecfe0186ec47
-
SHA512
f7ef6ac5499f128418add582bd9e10ccd26feabd9af0920ae0788126b70ac2fd40b52bc3cef677e061f23f578ea0b181fa84bcc02f4c6c58227d6824744d8b04
Malware Config
Extracted
emotet
Epoch4
81.0.236.93:443
94.177.248.64:443
66.42.55.5:7080
103.8.26.103:8080
185.184.25.237:8080
45.76.176.10:8080
188.93.125.116:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exeflow pid process 9 2676 rundll32.exe 24 2676 rundll32.exe 25 2676 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 2676 rundll32.exe 2676 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2500 wrote to memory of 2648 2500 rundll32.exe rundll32.exe PID 2500 wrote to memory of 2648 2500 rundll32.exe rundll32.exe PID 2500 wrote to memory of 2648 2500 rundll32.exe rundll32.exe PID 2648 wrote to memory of 2676 2648 rundll32.exe rundll32.exe PID 2648 wrote to memory of 2676 2648 rundll32.exe rundll32.exe PID 2648 wrote to memory of 2676 2648 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\072a3978d89b226c9847eb3bfc02ef12f01d2fd3409fb3ca2734ecfe0186ec47.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\072a3978d89b226c9847eb3bfc02ef12f01d2fd3409fb3ca2734ecfe0186ec47.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\072a3978d89b226c9847eb3bfc02ef12f01d2fd3409fb3ca2734ecfe0186ec47.dll",Control_RunDLL3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:2676