Analysis
-
max time kernel
122s -
max time network
200s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
16-11-2021 21:22
Static task
static1
General
-
Target
5435d3dcf17be3ceffd2d84a7f4e1e17f18dfc169470efff2c859fb45065fafa.dll
-
Size
252KB
-
MD5
c2aba869e7af09266ca0e2f528a42139
-
SHA1
3770670a68fc80f0b5aacbc75bcb2e9e3e1769d7
-
SHA256
5435d3dcf17be3ceffd2d84a7f4e1e17f18dfc169470efff2c859fb45065fafa
-
SHA512
352bc848283fba052385b8aa977319dba5f87016b508bf91f5aee950c8e18cfc4bd1899649b282c6fd7b936f09d4598d6c145c78a1425a82ff6113fb61f8d944
Malware Config
Extracted
emotet
Epoch4
81.0.236.93:443
94.177.248.64:443
66.42.55.5:7080
103.8.26.103:8080
185.184.25.237:8080
45.76.176.10:8080
188.93.125.116:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exeflow pid process 12 3828 rundll32.exe 21 3828 rundll32.exe 23 3828 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 3828 rundll32.exe 3828 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2504 wrote to memory of 2748 2504 rundll32.exe rundll32.exe PID 2504 wrote to memory of 2748 2504 rundll32.exe rundll32.exe PID 2504 wrote to memory of 2748 2504 rundll32.exe rundll32.exe PID 2748 wrote to memory of 3828 2748 rundll32.exe rundll32.exe PID 2748 wrote to memory of 3828 2748 rundll32.exe rundll32.exe PID 2748 wrote to memory of 3828 2748 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5435d3dcf17be3ceffd2d84a7f4e1e17f18dfc169470efff2c859fb45065fafa.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5435d3dcf17be3ceffd2d84a7f4e1e17f18dfc169470efff2c859fb45065fafa.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\5435d3dcf17be3ceffd2d84a7f4e1e17f18dfc169470efff2c859fb45065fafa.dll",Control_RunDLL3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses