Analysis
-
max time kernel
123s -
max time network
157s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
16-11-2021 21:22
Static task
static1
General
-
Target
70ba088e219d0ccfa2edd45b1c09e0bae765b0cfb02e73a9cb55bd5a995fb7e4.dll
-
Size
252KB
-
MD5
ec16d76f6d913df172d1142ebe55ca87
-
SHA1
5dc607df768db54a33a546a810aa2030fd83bb20
-
SHA256
70ba088e219d0ccfa2edd45b1c09e0bae765b0cfb02e73a9cb55bd5a995fb7e4
-
SHA512
375803739a9c359ad39bd696facac6d9aa670bcc29f8877636f24e40bf140e9526b9a360f8807700ea718cc88702c24f5bd2a9100289e82e2fa524448b67f592
Malware Config
Extracted
emotet
Epoch4
81.0.236.93:443
94.177.248.64:443
66.42.55.5:7080
103.8.26.103:8080
185.184.25.237:8080
45.76.176.10:8080
188.93.125.116:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exeflow pid process 16 3968 rundll32.exe 25 3968 rundll32.exe 27 3968 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 3968 rundll32.exe 3968 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2076 wrote to memory of 3996 2076 rundll32.exe rundll32.exe PID 2076 wrote to memory of 3996 2076 rundll32.exe rundll32.exe PID 2076 wrote to memory of 3996 2076 rundll32.exe rundll32.exe PID 3996 wrote to memory of 3968 3996 rundll32.exe rundll32.exe PID 3996 wrote to memory of 3968 3996 rundll32.exe rundll32.exe PID 3996 wrote to memory of 3968 3996 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\70ba088e219d0ccfa2edd45b1c09e0bae765b0cfb02e73a9cb55bd5a995fb7e4.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\70ba088e219d0ccfa2edd45b1c09e0bae765b0cfb02e73a9cb55bd5a995fb7e4.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\70ba088e219d0ccfa2edd45b1c09e0bae765b0cfb02e73a9cb55bd5a995fb7e4.dll",Control_RunDLL3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses