Analysis
- max time kernel
117s - max time network
117s - platform
windows7_x64 - resource
win7-en-20211104 - submitted
24/11/2021, 15:39
Static task
static1
Behavioral task
behavioral1
Sample
8f6552b136a4dd8719c898f90df1ba44.dll
Resource
win7-en-20211104
windows7_x64
0 signatures
0 seconds
General
- Target 8f6552b136a4dd8719c898f90df1ba44.dll
- Size 416KB
- Sample211124-s3l4nadaer
- SHA256 03995882170eb6ebacaa47f77fc0c2e8fd78e17ab5427fbe3c70b2f91f46e44d
- MD5 8f6552b136a4dd8719c898f90df1ba44
- SHA1 fea5b1d5e44dc58be42e472254e9b62b5caec532
- SHA512 6aafb9415c8073e3a71c045543813d8d558c10ef5ee15c26dc175b7ef036873fbd2a3aa41e82c25e574cd8c5274320a812ea1e57eda8e8e42339504d221c4c5d
- MD5 SHA1 SHA512
Malware Config
Signatures
- suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
- suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
- Blocklisted process makes network request 10 IoCs
flow pid Process 4 620 rundll32.exe 6 620 rundll32.exe 7 620 rundll32.exe 8 620 rundll32.exe 9 620 rundll32.exe 12 620 rundll32.exe 13 620 rundll32.exe 14 620 rundll32.exe 18 620 rundll32.exe 20 620 rundll32.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 620 rundll32.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 696 wrote to memory of 476 696 rundll32.exe 28 PID 696 wrote to memory of 476 696 rundll32.exe 28 PID 696 wrote to memory of 476 696 rundll32.exe 28 PID 696 wrote to memory of 476 696 rundll32.exe 28 PID 696 wrote to memory of 476 696 rundll32.exe 28 PID 696 wrote to memory of 476 696 rundll32.exe 28 PID 696 wrote to memory of 476 696 rundll32.exe 28 PID 476 wrote to memory of 1496 476 rundll32.exe 29 PID 476 wrote to memory of 1496 476 rundll32.exe 29 PID 476 wrote to memory of 1496 476 rundll32.exe 29 PID 476 wrote to memory of 1496 476 rundll32.exe 29 PID 476 wrote to memory of 1496 476 rundll32.exe 29 PID 476 wrote to memory of 1496 476 rundll32.exe 29 PID 476 wrote to memory of 1496 476 rundll32.exe 29 PID 1496 wrote to memory of 1484 1496 rundll32.exe 30 PID 1496 wrote to memory of 1484 1496 rundll32.exe 30 PID 1496 wrote to memory of 1484 1496 rundll32.exe 30 PID 1496 wrote to memory of 1484 1496 rundll32.exe 30 PID 1496 wrote to memory of 1484 1496 rundll32.exe 30 PID 1496 wrote to memory of 1484 1496 rundll32.exe 30 PID 1496 wrote to memory of 1484 1496 rundll32.exe 30 PID 1484 wrote to memory of 620 1484 rundll32.exe 31 PID 1484 wrote to memory of 620 1484 rundll32.exe 31 PID 1484 wrote to memory of 620 1484 rundll32.exe 31 PID 1484 wrote to memory of 620 1484 rundll32.exe 31 PID 1484 wrote to memory of 620 1484 rundll32.exe 31 PID 1484 wrote to memory of 620 1484 rundll32.exe 31 PID 1484 wrote to memory of 620 1484 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8f6552b136a4dd8719c898f90df1ba44.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8f6552b136a4dd8719c898f90df1ba44.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8f6552b136a4dd8719c898f90df1ba44.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\8f6552b136a4dd8719c898f90df1ba44.dll",Control_RunDLL4⤵
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\8f6552b136a4dd8719c898f90df1ba44.dll",Control_RunDLL5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:620
-
-
-
-