Analysis
-
max time kernel
126s -
max time network
140s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
16-11-2021 21:29
Static task
static1
General
-
Target
2d98c56c9334be65f69db4a21c8f5fdf9760193d74efe74ce0db2df031b3d296.dll
-
Size
252KB
-
MD5
3cf62cdccb6998cb23aa64114c97ce83
-
SHA1
db37de290d396c5d5a084626a7f4d73916d04bcf
-
SHA256
2d98c56c9334be65f69db4a21c8f5fdf9760193d74efe74ce0db2df031b3d296
-
SHA512
443693efb6a558d51193c94226936a472d6d07bd3e22b9e845865dcacdb4a8e6a05e8411a704c10e8a30cc2373c607ce48340cbe4b20fd6973a6e2fe8127c8b8
Malware Config
Extracted
emotet
Epoch4
81.0.236.93:443
94.177.248.64:443
66.42.55.5:7080
103.8.26.103:8080
185.184.25.237:8080
45.76.176.10:8080
188.93.125.116:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exeflow pid process 24 3988 rundll32.exe 29 3988 rundll32.exe 30 3988 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 3988 rundll32.exe 3988 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 3652 wrote to memory of 4200 3652 rundll32.exe rundll32.exe PID 3652 wrote to memory of 4200 3652 rundll32.exe rundll32.exe PID 3652 wrote to memory of 4200 3652 rundll32.exe rundll32.exe PID 4200 wrote to memory of 3988 4200 rundll32.exe rundll32.exe PID 4200 wrote to memory of 3988 4200 rundll32.exe rundll32.exe PID 4200 wrote to memory of 3988 4200 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2d98c56c9334be65f69db4a21c8f5fdf9760193d74efe74ce0db2df031b3d296.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2d98c56c9334be65f69db4a21c8f5fdf9760193d74efe74ce0db2df031b3d296.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\2d98c56c9334be65f69db4a21c8f5fdf9760193d74efe74ce0db2df031b3d296.dll",Control_RunDLL3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses