Analysis
-
max time kernel
110s -
max time network
142s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
16-11-2021 21:16
Static task
static1
General
-
Target
fa1e1bc3234f341ed1a1d6149ffb9d604f46601890fb8dbfa64eee07980949ed.dll
-
Size
252KB
-
MD5
d45428f00e8885a389d0c5f5742c91dd
-
SHA1
c71c35d0b4622642d7d6d7fa2d74d6ca87e84008
-
SHA256
fa1e1bc3234f341ed1a1d6149ffb9d604f46601890fb8dbfa64eee07980949ed
-
SHA512
2a1b01ee29c4ff005382f6aa74f84b20c8328080070db32a7691bfcdb965b9de029fb54a60fbb661fccfc022442da15e6dcc9575d9975e77d9053a31ce00241d
Malware Config
Extracted
emotet
Epoch4
81.0.236.93:443
94.177.248.64:443
66.42.55.5:7080
103.8.26.103:8080
185.184.25.237:8080
45.76.176.10:8080
188.93.125.116:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exeflow pid process 16 2584 rundll32.exe 23 2584 rundll32.exe 24 2584 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 2584 rundll32.exe 2584 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 3996 wrote to memory of 3700 3996 rundll32.exe rundll32.exe PID 3996 wrote to memory of 3700 3996 rundll32.exe rundll32.exe PID 3996 wrote to memory of 3700 3996 rundll32.exe rundll32.exe PID 3700 wrote to memory of 2584 3700 rundll32.exe rundll32.exe PID 3700 wrote to memory of 2584 3700 rundll32.exe rundll32.exe PID 3700 wrote to memory of 2584 3700 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fa1e1bc3234f341ed1a1d6149ffb9d604f46601890fb8dbfa64eee07980949ed.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fa1e1bc3234f341ed1a1d6149ffb9d604f46601890fb8dbfa64eee07980949ed.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\fa1e1bc3234f341ed1a1d6149ffb9d604f46601890fb8dbfa64eee07980949ed.dll",Control_RunDLL3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses