Analysis
-
max time kernel
119s -
max time network
223s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
16-11-2021 21:40
Static task
static1
General
-
Target
9c4291513c898b21877a3cda2c838a79fa2d6ebe00d7b24b0f4c6a2bdae7f74e.dll
-
Size
252KB
-
MD5
e802ece352c2702a210a4e523d38ce0a
-
SHA1
76fa64bc2fceb025087697416f2d0daa924e199d
-
SHA256
9c4291513c898b21877a3cda2c838a79fa2d6ebe00d7b24b0f4c6a2bdae7f74e
-
SHA512
c2ebce6d159a8f83dcf45776e4bd47809f140535822d0fef11acafe3ca38ae3eb168f7712341e54df6f5eb719e106044ea9b503378ad557559e4917b0b2efe57
Malware Config
Extracted
emotet
Epoch4
81.0.236.93:443
94.177.248.64:443
66.42.55.5:7080
103.8.26.103:8080
185.184.25.237:8080
45.76.176.10:8080
188.93.125.116:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exeflow pid process 10 732 rundll32.exe 19 732 rundll32.exe 20 732 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 732 rundll32.exe 732 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 656 wrote to memory of 2300 656 rundll32.exe rundll32.exe PID 656 wrote to memory of 2300 656 rundll32.exe rundll32.exe PID 656 wrote to memory of 2300 656 rundll32.exe rundll32.exe PID 2300 wrote to memory of 732 2300 rundll32.exe rundll32.exe PID 2300 wrote to memory of 732 2300 rundll32.exe rundll32.exe PID 2300 wrote to memory of 732 2300 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9c4291513c898b21877a3cda2c838a79fa2d6ebe00d7b24b0f4c6a2bdae7f74e.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9c4291513c898b21877a3cda2c838a79fa2d6ebe00d7b24b0f4c6a2bdae7f74e.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\9c4291513c898b21877a3cda2c838a79fa2d6ebe00d7b24b0f4c6a2bdae7f74e.dll",Control_RunDLL3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses