Analysis
- max time kernel
133s - max time network
143s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
17/11/2021, 07:20
Static task
static1
Behavioral task
behavioral1
Sample
OxiAACCoic.dll
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
General
- Target OxiAACCoic.dll
- Size 252KB
- Sample211117-h54rdaefam
- SHA256 3c83d96e74169dd5be8bba2f7298bec8a503080670fbf2a2c844e70098df6845
- MD5 7b6dae74a8c044abac47776d9d1c4053
- SHA1 600a9602ddafdef718092066c2cd977f890193e9
- SHA512 e01e271731f04fb837f0bcbcd712650041e879a2c70cd6a0e637eb98a63adeffd3223b18224b06b40ba60eea17591d7ce901a810759de257568d86eb75b8754d
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch4
C2
-
91.200.186.228:443
-
191.252.196.221:8080
-
94.177.248.64:443
-
66.42.55.5:7080
-
103.8.26.103:8080
-
185.184.25.237:8080
-
103.8.26.102:8080
-
178.79.147.66:8080
-
58.227.42.236:80
-
45.118.135.203:7080
-
103.75.201.2:443
-
195.154.133.20:443
-
45.142.114.231:8080
-
212.237.5.209:443
-
207.38.84.195:8080
-
104.251.214.46:8080
-
212.237.17.99:8080
-
212.237.56.116:7080
-
216.158.226.206:443
-
110.232.117.186:8080
-
158.69.222.101:443
-
107.182.225.142:8080
-
176.104.106.96:8080
-
81.0.236.90:443
-
50.116.54.215:443
-
138.185.72.26:8080
-
51.68.175.8:8080
-
210.57.217.132:8080
eck1.plain
ecs1.plain
Signatures
- suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
- suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
- Blocklisted process makes network request 64 IoCs
flow pid Process 21 3912 rundll32.exe 22 3912 rundll32.exe 23 3912 rundll32.exe 24 3912 rundll32.exe 25 3912 rundll32.exe 28 3912 rundll32.exe 29 3912 rundll32.exe 30 3912 rundll32.exe 33 3912 rundll32.exe 34 3912 rundll32.exe 35 3912 rundll32.exe 36 3912 rundll32.exe 37 3912 rundll32.exe 38 3912 rundll32.exe 39 3912 rundll32.exe 40 3912 rundll32.exe 41 3912 rundll32.exe 42 3912 rundll32.exe 43 3912 rundll32.exe 44 3912 rundll32.exe 45 3912 rundll32.exe 46 3912 rundll32.exe 47 3912 rundll32.exe 48 3912 rundll32.exe 49 3912 rundll32.exe 50 3912 rundll32.exe 51 3912 rundll32.exe 52 3912 rundll32.exe 55 3912 rundll32.exe 56 3912 rundll32.exe 57 3912 rundll32.exe 58 3912 rundll32.exe 59 3912 rundll32.exe 60 3912 rundll32.exe 61 3912 rundll32.exe 62 3912 rundll32.exe 63 3912 rundll32.exe 64 3912 rundll32.exe 65 3912 rundll32.exe 66 3912 rundll32.exe 67 3912 rundll32.exe 68 3912 rundll32.exe 69 3912 rundll32.exe 70 3912 rundll32.exe 71 3912 rundll32.exe 72 3912 rundll32.exe 73 3912 rundll32.exe 74 3912 rundll32.exe 75 3912 rundll32.exe 76 3912 rundll32.exe 77 3912 rundll32.exe 78 3912 rundll32.exe 79 3912 rundll32.exe 80 3912 rundll32.exe 81 3912 rundll32.exe 82 3912 rundll32.exe 83 3912 rundll32.exe 84 3912 rundll32.exe 85 3912 rundll32.exe 86 3912 rundll32.exe 89 3912 rundll32.exe 90 3912 rundll32.exe 91 3912 rundll32.exe 92 3912 rundll32.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3912 rundll32.exe 3912 rundll32.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2996 wrote to memory of 4204 2996 rundll32.exe 69 PID 2996 wrote to memory of 4204 2996 rundll32.exe 69 PID 2996 wrote to memory of 4204 2996 rundll32.exe 69 PID 4204 wrote to memory of 3912 4204 rundll32.exe 70 PID 4204 wrote to memory of 3912 4204 rundll32.exe 70 PID 4204 wrote to memory of 3912 4204 rundll32.exe 70
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\OxiAACCoic.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\OxiAACCoic.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\OxiAACCoic.dll",Control_RunDLL3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:3912
-
-