Analysis
-
max time kernel
144s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
11-11-2023 13:01
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.befb1a966c87d19385ae81aaf3c89040.dll
Resource
win7-20231023-en
General
-
Target
NEAS.befb1a966c87d19385ae81aaf3c89040.dll
-
Size
204KB
-
MD5
befb1a966c87d19385ae81aaf3c89040
-
SHA1
4fa9cca13abbb7dad59da88d82728dc8f19deb50
-
SHA256
8e198da7e6f48dab28c380878866bea34cf7e0d63fd55c83f9cddbf6ff24eedc
-
SHA512
ab3c75c7a437bdd9623ebb39ed691bfd725299c380072bb0afd3b84f949d2c09434724cc541ed98c651558a032e3139c1693888a43a3ed598fe7a48a49ccba54
-
SSDEEP
3072:kNsjnip4XgGOIcYEs+bG1Va/kqjT3ZNd3mncCuU0QNx84t7YitYvm3OXBmC:5iGXNxusqj9Knjtf04tzem300C
Malware Config
Extracted
emotet
Epoch2
173.70.61.180:80
59.21.235.119:80
50.116.111.59:8080
173.249.20.233:443
188.165.214.98:8080
72.188.173.74:80
74.40.205.197:443
64.207.182.168:8080
97.120.3.198:80
190.29.166.0:80
123.176.25.234:80
155.186.9.160:80
138.68.87.218:443
139.99.158.11:443
78.24.219.147:8080
58.1.242.115:80
108.21.72.56:443
188.219.31.12:80
70.180.33.202:80
181.171.209.241:443
37.187.72.193:8080
181.165.68.127:80
187.161.206.24:80
110.145.77.103:80
75.143.247.51:80
201.252.34.3:80
95.213.236.64:8080
74.128.121.17:80
220.245.198.194:80
185.201.9.197:8080
37.139.21.175:8080
109.74.5.95:8080
51.89.36.180:443
172.104.97.173:8080
200.116.145.225:443
46.105.131.79:8080
202.134.4.216:8080
118.83.154.64:443
62.75.141.82:80
167.114.153.111:8080
5.39.91.110:7080
47.144.21.37:80
115.94.207.99:443
142.112.10.95:20
62.30.7.67:443
137.59.187.107:8080
5.2.212.254:80
119.59.116.21:8080
202.134.4.211:8080
70.92.118.112:80
72.229.97.235:80
194.4.58.192:7080
61.19.246.238:443
74.208.45.104:8080
110.145.11.73:80
168.235.67.138:7080
208.74.26.234:80
136.244.110.184:8080
24.179.13.119:80
79.137.83.50:443
120.150.60.189:80
70.183.211.3:80
94.23.237.171:443
197.211.245.21:80
190.240.194.77:443
85.105.111.166:80
24.69.65.8:8080
161.0.153.60:80
120.150.218.241:443
50.91.114.38:80
139.162.60.124:8080
157.245.99.39:8080
67.10.155.92:80
139.59.60.244:8080
152.170.205.73:80
144.217.7.207:7080
185.94.252.104:443
194.190.67.75:80
174.118.202.24:443
78.188.225.105:80
186.74.215.34:80
190.162.215.233:80
95.9.5.93:80
176.111.60.55:8080
110.145.101.66:443
49.205.182.134:80
172.105.13.66:443
202.141.243.254:443
178.152.87.96:80
50.245.107.73:443
217.20.166.178:7080
41.185.28.84:8080
201.241.127.190:80
2.58.16.89:8080
109.116.245.80:80
67.170.250.203:443
62.171.142.179:8080
24.178.90.49:80
100.37.240.62:80
121.124.124.40:7080
172.125.40.123:80
203.153.216.189:7080
134.209.144.106:443
89.216.122.92:80
87.106.139.101:8080
172.86.188.251:8080
104.131.11.150:443
209.141.54.221:7080
72.186.136.247:443
Signatures
-
Blocklisted process makes network request 7 IoCs
Processes:
rundll32.exeflow pid process 42 1304 rundll32.exe 68 1304 rundll32.exe 69 1304 rundll32.exe 79 1304 rundll32.exe 82 1304 rundll32.exe 83 1304 rundll32.exe 87 1304 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
rundll32.exepid process 1304 rundll32.exe 1304 rundll32.exe 1304 rundll32.exe 1304 rundll32.exe 1304 rundll32.exe 1304 rundll32.exe 1304 rundll32.exe 1304 rundll32.exe 1304 rundll32.exe 1304 rundll32.exe 1304 rundll32.exe 1304 rundll32.exe 1304 rundll32.exe 1304 rundll32.exe 1304 rundll32.exe 1304 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 456 wrote to memory of 1304 456 rundll32.exe rundll32.exe PID 456 wrote to memory of 1304 456 rundll32.exe rundll32.exe PID 456 wrote to memory of 1304 456 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.befb1a966c87d19385ae81aaf3c89040.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.befb1a966c87d19385ae81aaf3c89040.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1304-0-0x0000000000BF0000-0x0000000000C0F000-memory.dmpFilesize
124KB