Analysis
-
max time kernel
135s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08-07-2022 07:17
Static task
static1
Behavioral task
behavioral1
Sample
c311cb7354c575294b27ad25b17e57b34640424343a07d264088d1ef028af96e.dll
Resource
win7-20220414-en
General
-
Target
c311cb7354c575294b27ad25b17e57b34640424343a07d264088d1ef028af96e.dll
-
Size
190KB
-
MD5
c7bd286819dd2ce582aefab6c17ddd59
-
SHA1
71cf4ea6859c918d70cd9a6cf7588e027f2d2a09
-
SHA256
c311cb7354c575294b27ad25b17e57b34640424343a07d264088d1ef028af96e
-
SHA512
8b692fe2909785eb84e349088c4592cee06288217976c33c5be77482a22d24f2875e0e00d1e37fc8f70fe44d17907b9899b0e738c28467f8c7345a228c62eb79
Malware Config
Extracted
emotet
Epoch2
90.160.138.175:80
74.222.117.42:80
157.245.123.197:8080
50.116.111.59:8080
173.249.20.233:443
200.116.145.225:443
142.112.10.95:20
87.106.139.101:8080
173.70.61.180:80
75.177.207.146:80
121.124.124.40:7080
98.109.133.80:80
37.187.72.193:8080
74.40.205.197:443
220.245.198.194:80
197.211.245.21:80
123.176.25.234:80
194.190.67.75:80
78.188.225.105:80
217.20.166.178:7080
49.205.182.134:80
79.137.83.50:443
50.91.114.38:80
62.171.142.179:8080
119.59.116.21:8080
75.109.111.18:80
24.179.13.119:80
120.150.60.189:80
24.69.65.8:8080
185.201.9.197:8080
154.0.8.2:443
118.83.154.64:443
161.0.153.60:80
61.19.246.238:443
100.37.240.62:80
66.57.108.14:443
144.217.7.207:7080
181.165.68.127:80
174.118.202.24:443
188.219.31.12:80
89.106.251.163:80
104.131.11.150:443
181.171.209.241:443
178.152.87.96:80
89.216.122.92:80
172.125.40.123:80
47.144.21.37:80
185.94.252.104:443
139.59.60.244:8080
24.231.88.85:80
190.240.194.77:443
190.29.166.0:80
194.4.58.192:7080
138.68.87.218:443
187.161.206.24:80
78.189.148.42:80
74.128.121.17:80
75.188.107.174:80
202.141.243.254:443
59.21.235.119:80
62.30.7.67:443
5.2.212.254:80
134.209.144.106:443
110.145.11.73:80
139.162.60.124:8080
95.213.236.64:8080
51.89.36.180:443
41.185.28.84:8080
168.235.67.138:7080
203.153.216.189:7080
93.146.48.84:80
94.23.237.171:443
74.208.45.104:8080
5.39.91.110:7080
172.105.13.66:443
109.74.5.95:8080
115.94.207.99:443
78.24.219.147:8080
70.92.118.112:80
37.139.21.175:8080
24.178.90.49:80
62.75.141.82:80
188.165.214.98:8080
84.232.252.202:443
74.58.215.226:80
109.116.245.80:80
64.207.182.168:8080
110.145.101.66:443
136.244.110.184:8080
202.134.4.216:8080
2.58.16.89:8080
95.9.5.93:80
172.104.97.173:8080
172.86.188.251:8080
167.114.153.111:8080
176.111.60.55:8080
202.134.4.211:8080
67.170.250.203:443
46.105.131.79:8080
70.183.211.3:80
139.99.158.11:443
24.164.79.147:8080
85.105.111.166:80
157.245.99.39:8080
201.241.127.190:80
97.120.3.198:80
50.245.107.73:443
Signatures
-
Blocklisted process makes network request 7 IoCs
Processes:
rundll32.exeflow pid process 3 2000 rundll32.exe 4 2000 rundll32.exe 5 2000 rundll32.exe 9 2000 rundll32.exe 10 2000 rundll32.exe 13 2000 rundll32.exe 15 2000 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
rundll32.exepid process 2000 rundll32.exe 2000 rundll32.exe 2000 rundll32.exe 2000 rundll32.exe 2000 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1900 wrote to memory of 2000 1900 rundll32.exe rundll32.exe PID 1900 wrote to memory of 2000 1900 rundll32.exe rundll32.exe PID 1900 wrote to memory of 2000 1900 rundll32.exe rundll32.exe PID 1900 wrote to memory of 2000 1900 rundll32.exe rundll32.exe PID 1900 wrote to memory of 2000 1900 rundll32.exe rundll32.exe PID 1900 wrote to memory of 2000 1900 rundll32.exe rundll32.exe PID 1900 wrote to memory of 2000 1900 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c311cb7354c575294b27ad25b17e57b34640424343a07d264088d1ef028af96e.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c311cb7354c575294b27ad25b17e57b34640424343a07d264088d1ef028af96e.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses