Analysis
-
max time kernel
148s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2024 12:18
Static task
static1
Behavioral task
behavioral1
Sample
836d8e2f36ad80f937a377f568d78653e975e4b52db995ae18272dfecca9ac0f.dll
Resource
win7-20240221-en
General
-
Target
836d8e2f36ad80f937a377f568d78653e975e4b52db995ae18272dfecca9ac0f.dll
-
Size
416KB
-
MD5
2f32784d107857e6f63dc282622b7207
-
SHA1
1027b9351dbf544e88b7cb652576b61316e2cdce
-
SHA256
836d8e2f36ad80f937a377f568d78653e975e4b52db995ae18272dfecca9ac0f
-
SHA512
2048401a3720ca6ad6e9b2464c4d0fac7d67ec94df0e0e91d605f6e92f7de085c33a716f82deb36369c8b0dad3b7963374536cf93a08dad616b8da019f222f99
-
SSDEEP
6144:1ACzUEcRRKxe0DUAldEzpL2E0sepO8+wM:1lxemHQt2E0sLvd
Malware Config
Extracted
emotet
Epoch5
51.178.61.60:443
168.197.250.14:80
45.79.33.48:8080
196.44.98.190:8080
177.72.80.14:7080
51.210.242.234:8080
185.148.169.10:8080
142.4.219.173:8080
78.47.204.80:443
78.46.73.125:443
37.44.244.177:8080
37.59.209.141:8080
191.252.103.16:80
54.38.242.185:443
85.214.67.203:8080
54.37.228.122:443
207.148.81.119:8080
195.77.239.39:8080
66.42.57.149:443
195.154.146.35:443
Signatures
-
Blocklisted process makes network request 12 IoCs
Processes:
rundll32.exeflow pid process 15 1840 rundll32.exe 21 1840 rundll32.exe 35 1840 rundll32.exe 36 1840 rundll32.exe 39 1840 rundll32.exe 40 1840 rundll32.exe 41 1840 rundll32.exe 45 1840 rundll32.exe 49 1840 rundll32.exe 50 1840 rundll32.exe 51 1840 rundll32.exe 55 1840 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 1840 rundll32.exe 1840 rundll32.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
rundll32.exerundll32.exerundll32.exedescription pid process target process PID 1268 wrote to memory of 1556 1268 rundll32.exe rundll32.exe PID 1268 wrote to memory of 1556 1268 rundll32.exe rundll32.exe PID 1268 wrote to memory of 1556 1268 rundll32.exe rundll32.exe PID 1556 wrote to memory of 3156 1556 rundll32.exe rundll32.exe PID 1556 wrote to memory of 3156 1556 rundll32.exe rundll32.exe PID 1556 wrote to memory of 3156 1556 rundll32.exe rundll32.exe PID 3156 wrote to memory of 1840 3156 rundll32.exe rundll32.exe PID 3156 wrote to memory of 1840 3156 rundll32.exe rundll32.exe PID 3156 wrote to memory of 1840 3156 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\836d8e2f36ad80f937a377f568d78653e975e4b52db995ae18272dfecca9ac0f.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\836d8e2f36ad80f937a377f568d78653e975e4b52db995ae18272dfecca9ac0f.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\836d8e2f36ad80f937a377f568d78653e975e4b52db995ae18272dfecca9ac0f.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\836d8e2f36ad80f937a377f568d78653e975e4b52db995ae18272dfecca9ac0f.dll",Control_RunDLL4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1556-0-0x0000000075830000-0x000000007589F000-memory.dmpFilesize
444KB
-
memory/1556-12-0x0000000075830000-0x000000007589F000-memory.dmpFilesize
444KB
-
memory/1840-6-0x0000000075830000-0x000000007589F000-memory.dmpFilesize
444KB
-
memory/1840-11-0x0000000010000000-0x0000000010028000-memory.dmpFilesize
160KB
-
memory/1840-14-0x0000000075830000-0x000000007589F000-memory.dmpFilesize
444KB
-
memory/1840-15-0x0000000010000000-0x0000000010028000-memory.dmpFilesize
160KB
-
memory/3156-2-0x0000000010000000-0x0000000010028000-memory.dmpFilesize
160KB
-
memory/3156-1-0x0000000075830000-0x000000007589F000-memory.dmpFilesize
444KB
-
memory/3156-8-0x0000000075830000-0x000000007589F000-memory.dmpFilesize
444KB
-
memory/3156-9-0x0000000010000000-0x0000000010028000-memory.dmpFilesize
160KB