Analysis
-
max time kernel
159s -
max time network
295s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
16-11-2021 21:10
Static task
static1
General
-
Target
98aec9e9dc02bc644cd693ba1a1fa268c65bf0e7e29df65fdbe0d1d158c45d28.dll
-
Size
252KB
-
MD5
d66ed26584e7608395ab0d358f0525a5
-
SHA1
c76abd6dc9ee6cd72b185fcf21ea9bc06b551742
-
SHA256
98aec9e9dc02bc644cd693ba1a1fa268c65bf0e7e29df65fdbe0d1d158c45d28
-
SHA512
3c1cd4d11320de3aa13f5c5c5c245a9b421fb63f33838cc21995d26372fc85548ac4d99cb8dc0e5bca288c9ea2db25103872d3c49308009dfd8a5019d49827a1
Malware Config
Extracted
emotet
Epoch4
81.0.236.93:443
94.177.248.64:443
66.42.55.5:7080
103.8.26.103:8080
185.184.25.237:8080
45.76.176.10:8080
188.93.125.116:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exeflow pid process 10 1000 rundll32.exe 19 1000 rundll32.exe 20 1000 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 1000 rundll32.exe 1000 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 3124 wrote to memory of 3748 3124 rundll32.exe rundll32.exe PID 3124 wrote to memory of 3748 3124 rundll32.exe rundll32.exe PID 3124 wrote to memory of 3748 3124 rundll32.exe rundll32.exe PID 3748 wrote to memory of 1000 3748 rundll32.exe rundll32.exe PID 3748 wrote to memory of 1000 3748 rundll32.exe rundll32.exe PID 3748 wrote to memory of 1000 3748 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\98aec9e9dc02bc644cd693ba1a1fa268c65bf0e7e29df65fdbe0d1d158c45d28.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\98aec9e9dc02bc644cd693ba1a1fa268c65bf0e7e29df65fdbe0d1d158c45d28.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\98aec9e9dc02bc644cd693ba1a1fa268c65bf0e7e29df65fdbe0d1d158c45d28.dll",Control_RunDLL3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses