Analysis
-
max time kernel
119s -
max time network
139s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
16-11-2021 21:58
Static task
static1
General
-
Target
30ff06f382d178d3a02f6306916819937b69f4653557dbab8f7b6a99cd57763b.dll
-
Size
252KB
-
MD5
9e270d37f25bf434b21b6f61b2f75ba6
-
SHA1
09c2e49a172fdffcd2f2b74783f1ac5685db895d
-
SHA256
30ff06f382d178d3a02f6306916819937b69f4653557dbab8f7b6a99cd57763b
-
SHA512
9b261a3981817b7dcbcf0f64ca934165c6f051edd9ec14e18694894ea5ae7034a0baca3238dd6c6391ac7bb8439647f5d97fcd639ff0a35b8898de33be7ee0fb
Malware Config
Extracted
emotet
Epoch4
81.0.236.93:443
94.177.248.64:443
66.42.55.5:7080
103.8.26.103:8080
185.184.25.237:8080
45.76.176.10:8080
188.93.125.116:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exeflow pid process 17 1888 rundll32.exe 24 1888 rundll32.exe 26 1888 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 1888 rundll32.exe 1888 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 3820 wrote to memory of 3772 3820 rundll32.exe rundll32.exe PID 3820 wrote to memory of 3772 3820 rundll32.exe rundll32.exe PID 3820 wrote to memory of 3772 3820 rundll32.exe rundll32.exe PID 3772 wrote to memory of 1888 3772 rundll32.exe rundll32.exe PID 3772 wrote to memory of 1888 3772 rundll32.exe rundll32.exe PID 3772 wrote to memory of 1888 3772 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\30ff06f382d178d3a02f6306916819937b69f4653557dbab8f7b6a99cd57763b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\30ff06f382d178d3a02f6306916819937b69f4653557dbab8f7b6a99cd57763b.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\30ff06f382d178d3a02f6306916819937b69f4653557dbab8f7b6a99cd57763b.dll",Control_RunDLL3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1888