Analysis
-
max time kernel
81s -
max time network
144s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
16-11-2021 21:10
Static task
static1
General
-
Target
e66a7fea9dba3c61f69b04c146ec7629de9e56e81f9bd8492da19fa454165b0a.dll
-
Size
252KB
-
MD5
673e2227c7d98de3d98975f4e46127fe
-
SHA1
05a89b817bb2021d741fb49dc41ecc52394893b0
-
SHA256
e66a7fea9dba3c61f69b04c146ec7629de9e56e81f9bd8492da19fa454165b0a
-
SHA512
54beea9076305f00d29c6495dc882d1c0ca7c2af33c8e28105ab688abdd85b0d88ce3fa1c442931073bcffbb343c81673b8f09667d00b2cb838fa2c1023a8184
Malware Config
Extracted
emotet
Epoch4
81.0.236.93:443
94.177.248.64:443
66.42.55.5:7080
103.8.26.103:8080
185.184.25.237:8080
45.76.176.10:8080
188.93.125.116:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exeflow pid process 17 4040 rundll32.exe 24 4040 rundll32.exe 26 4040 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 4040 rundll32.exe 4040 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2256 wrote to memory of 788 2256 rundll32.exe rundll32.exe PID 2256 wrote to memory of 788 2256 rundll32.exe rundll32.exe PID 2256 wrote to memory of 788 2256 rundll32.exe rundll32.exe PID 788 wrote to memory of 4040 788 rundll32.exe rundll32.exe PID 788 wrote to memory of 4040 788 rundll32.exe rundll32.exe PID 788 wrote to memory of 4040 788 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e66a7fea9dba3c61f69b04c146ec7629de9e56e81f9bd8492da19fa454165b0a.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e66a7fea9dba3c61f69b04c146ec7629de9e56e81f9bd8492da19fa454165b0a.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\e66a7fea9dba3c61f69b04c146ec7629de9e56e81f9bd8492da19fa454165b0a.dll",Control_RunDLL3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses