Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2023 03:06
Static task
static1
Behavioral task
behavioral1
Sample
25b5780c888a8eeb1260b0880efaebf6.dll
Resource
win7-20231215-en
General
-
Target
25b5780c888a8eeb1260b0880efaebf6.dll
-
Size
432KB
-
MD5
25b5780c888a8eeb1260b0880efaebf6
-
SHA1
db3f28216aeeba8af51115d1fc799a2b6abd8c1f
-
SHA256
8f8b165d03fb14c977d84409e9455933c58eece0fb7382321b8b9887ec4c22bb
-
SHA512
034bb8aafe03364aab482978a3f5085f20e72756044ab8351882828411f7f51987f556c836af8fbd572ec646132aab44177b81f7e1f28daae5baa778baad37b8
-
SSDEEP
12288:rkEjer16eQSqXL4m1EiOS1OrX3sBqCjM7cuJc5ViQjnbbyADuCgs:rk2E1kEi1asBqCM7SiQjbFuO
Malware Config
Extracted
emotet
Epoch2
24.231.88.85:80
191.112.178.60:80
50.116.111.59:8080
173.249.20.233:443
188.165.214.98:8080
74.40.205.197:443
62.75.141.82:80
2.58.16.89:8080
188.219.31.12:80
95.213.236.64:8080
72.186.136.247:443
185.201.9.197:8080
203.153.216.189:7080
202.134.4.216:8080
72.229.97.235:80
24.179.13.119:80
174.118.202.24:443
74.208.45.104:8080
51.89.36.180:443
202.141.243.254:443
142.112.10.95:20
172.104.97.173:8080
136.244.110.184:8080
79.137.83.50:443
61.19.246.238:443
119.59.116.21:8080
109.74.5.95:8080
37.187.72.193:8080
181.171.209.241:443
100.37.240.62:80
24.69.65.8:8080
123.176.25.234:80
74.128.121.17:80
98.109.133.80:80
161.0.153.60:80
37.139.21.175:8080
178.152.87.96:80
172.86.188.251:8080
94.23.237.171:443
110.145.77.103:80
5.39.91.110:7080
46.105.131.79:8080
120.150.60.189:80
173.70.61.180:80
190.29.166.0:80
59.21.235.119:80
70.92.118.112:80
41.185.28.84:8080
201.241.127.190:80
85.105.111.166:80
152.170.205.73:80
187.161.206.24:80
118.83.154.64:443
190.240.194.77:443
202.134.4.211:8080
78.24.219.147:8080
89.216.122.92:80
200.116.145.225:443
197.211.245.21:80
194.190.67.75:80
139.99.158.11:443
190.162.215.233:80
115.94.207.99:443
139.162.60.124:8080
167.114.153.111:8080
176.111.60.55:8080
78.189.148.42:80
134.209.144.106:443
138.68.87.218:443
110.145.101.66:443
172.125.40.123:80
87.106.139.101:8080
70.183.211.3:80
64.207.182.168:8080
157.245.99.39:8080
181.165.68.127:80
62.171.142.179:8080
75.177.207.146:80
209.141.54.221:7080
70.180.33.202:80
109.116.245.80:80
144.217.7.207:7080
50.91.114.38:80
139.59.60.244:8080
97.120.3.198:80
121.124.124.40:7080
104.131.11.150:443
67.170.250.203:443
185.94.252.104:443
220.245.198.194:80
49.205.182.134:80
50.245.107.73:443
172.105.13.66:443
5.2.212.254:80
78.188.225.105:80
120.150.218.241:443
93.146.48.84:80
110.145.11.73:80
168.235.67.138:7080
217.20.166.178:7080
24.178.90.49:80
95.9.5.93:80
194.4.58.192:7080
47.144.21.37:80
62.30.7.67:443
Signatures
-
Blocklisted process makes network request 6 IoCs
Processes:
rundll32.exeflow pid process 34 2352 rundll32.exe 61 2352 rundll32.exe 87 2352 rundll32.exe 100 2352 rundll32.exe 102 2352 rundll32.exe 107 2352 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
rundll32.exepid process 2352 rundll32.exe 2352 rundll32.exe 2352 rundll32.exe 2352 rundll32.exe 2352 rundll32.exe 2352 rundll32.exe 2352 rundll32.exe 2352 rundll32.exe 2352 rundll32.exe 2352 rundll32.exe 2352 rundll32.exe 2352 rundll32.exe 2352 rundll32.exe 2352 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3636 wrote to memory of 2352 3636 rundll32.exe rundll32.exe PID 3636 wrote to memory of 2352 3636 rundll32.exe rundll32.exe PID 3636 wrote to memory of 2352 3636 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\25b5780c888a8eeb1260b0880efaebf6.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\25b5780c888a8eeb1260b0880efaebf6.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2352-0-0x0000000002930000-0x0000000002950000-memory.dmpFilesize
128KB