Analysis
-
max time kernel
137s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
30-06-2022 23:43
General
-
Target
57b86f91baf5e06bdc084363a35a8ccb6e727784646b8a257134fd9503a309b6.dll
-
Size
190KB
-
MD5
5e0711568d555b512e29fe63c2a81705
-
SHA1
c8683022b3de406d5302611e945285118cba8580
-
SHA256
57b86f91baf5e06bdc084363a35a8ccb6e727784646b8a257134fd9503a309b6
-
SHA512
f6b9fbde4dacbdac383ac58e3313a1b536427439c7baa5d0b1843bfac1f908ddcdceade672d8b6091f7232a1e909f14dadb788606933e2f40aca596f4a1cf391
Malware Config
Extracted
emotet
Epoch2
90.160.138.175:80
74.222.117.42:80
157.245.123.197:8080
50.116.111.59:8080
173.249.20.233:443
200.116.145.225:443
142.112.10.95:20
87.106.139.101:8080
173.70.61.180:80
75.177.207.146:80
121.124.124.40:7080
98.109.133.80:80
37.187.72.193:8080
74.40.205.197:443
220.245.198.194:80
197.211.245.21:80
123.176.25.234:80
194.190.67.75:80
78.188.225.105:80
217.20.166.178:7080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Blocklisted process makes network request 7 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\57b86f91baf5e06bdc084363a35a8ccb6e727784646b8a257134fd9503a309b6.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\57b86f91baf5e06bdc084363a35a8ccb6e727784646b8a257134fd9503a309b6.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2024-54-0x0000000000000000-mapping.dmp
-
memory/2024-55-0x0000000075F21000-0x0000000075F23000-memory.dmpFilesize
8KB
-
memory/2024-56-0x00000000001B0000-0x00000000001D0000-memory.dmpFilesize
128KB