Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 20:04
Behavioral task
behavioral1
Sample
2c32227fabdf7aa09fa55509305e6d23d45fce2d45d5fd395dff2fbf2fff7545.dll
Resource
win7-20240508-en
General
-
Target
2c32227fabdf7aa09fa55509305e6d23d45fce2d45d5fd395dff2fbf2fff7545.dll
-
Size
196KB
-
MD5
49d5526f03c506efc5ce7cbb0d50e0d3
-
SHA1
21bee7969fcafb54818c5e6b5c2da140eaac4f20
-
SHA256
2c32227fabdf7aa09fa55509305e6d23d45fce2d45d5fd395dff2fbf2fff7545
-
SHA512
4cbdf8989b283d2eb1ab89690fd571447f86aa58bcb6623e70b177d1858c6bf2ba5e80e8b38199a6e8d4b73a038fbc69bc321ebeeff0105f7f5c627cca8f3e20
-
SSDEEP
3072:8DpJoj/4bRze+hVJ96hVYja5OpA98EEXfc5ikSxAx8/LN4ucvWlsZQSGv+:cp674Ze+/LyK7AF0fY7S2KWC
Malware Config
Extracted
emotet
Epoch1
190.202.229.74:80
118.69.11.81:7080
70.39.251.94:8080
87.230.25.43:8080
94.23.62.116:8080
37.187.161.206:8080
45.46.37.97:80
138.97.60.141:7080
177.144.130.105:8080
169.1.39.242:80
209.236.123.42:8080
202.134.4.210:7080
193.251.77.110:80
2.45.176.233:80
217.13.106.14:8080
189.223.16.99:80
190.101.156.139:80
77.238.212.227:80
181.58.181.9:80
37.183.81.217:80
74.58.215.226:80
174.118.202.24:443
168.197.45.36:80
81.215.230.173:443
192.175.111.212:7080
216.47.196.104:80
128.92.203.42:80
94.176.234.118:443
191.182.6.118:80
212.71.237.140:8080
24.232.228.233:80
177.73.0.98:443
177.23.7.151:80
24.135.69.146:80
83.169.21.32:7080
189.34.181.88:80
179.222.115.170:80
177.144.130.105:443
213.197.182.158:8080
5.89.33.136:80
77.78.196.173:443
120.72.18.91:80
50.28.51.143:8080
190.64.88.186:443
111.67.12.221:8080
12.162.84.2:8080
46.105.114.137:8080
59.148.253.194:8080
201.213.177.139:80
82.76.52.155:80
172.104.169.32:8080
188.251.213.180:80
46.43.2.95:8080
137.74.106.111:7080
188.135.15.49:80
185.94.252.27:443
197.232.36.108:80
60.249.78.226:8080
187.162.248.237:80
181.129.96.162:8080
46.101.58.37:8080
109.242.153.9:80
178.211.45.66:8080
200.59.6.174:80
83.103.179.156:80
172.86.186.21:8080
70.32.115.157:8080
81.214.253.80:443
201.49.239.200:443
149.202.72.142:7080
190.45.24.210:80
186.189.249.2:80
219.92.13.25:80
170.81.48.2:80
51.75.33.127:80
192.241.143.52:8080
45.33.77.42:8080
152.169.22.67:80
185.183.16.47:80
186.70.127.199:8090
1.226.84.243:8080
78.206.229.130:80
37.179.145.105:80
68.183.170.114:8080
192.232.229.54:7080
103.236.179.162:80
70.32.84.74:8080
79.118.74.90:80
60.93.23.51:80
181.120.29.49:80
213.52.74.198:80
51.255.165.160:8080
183.176.82.231:80
186.193.229.123:80
98.103.204.12:443
129.232.220.11:8080
181.61.182.143:80
68.183.190.199:8080
190.115.18.139:8080
200.24.255.23:80
103.13.224.53:80
85.214.26.7:8080
190.24.243.186:80
87.106.46.107:8080
177.107.79.214:8080
12.163.208.58:80
187.162.250.23:443
109.101.137.162:8080
82.76.111.249:443
181.30.61.163:443
5.196.35.138:7080
51.15.7.145:80
192.198.91.138:443
188.157.101.114:80
189.2.177.210:443
181.123.6.86:80
109.190.35.249:80
45.16.226.117:443
190.190.219.184:80
104.131.41.185:8080
101.187.81.254:80
62.84.75.50:80
178.250.54.208:8080
201.71.228.86:80
190.92.122.226:80
138.97.60.140:8080
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1600-0-0x00000000001F0000-0x0000000000223000-memory.dmp emotet -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 1600 rundll32.exe 1600 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2184 wrote to memory of 1600 2184 rundll32.exe rundll32.exe PID 2184 wrote to memory of 1600 2184 rundll32.exe rundll32.exe PID 2184 wrote to memory of 1600 2184 rundll32.exe rundll32.exe PID 2184 wrote to memory of 1600 2184 rundll32.exe rundll32.exe PID 2184 wrote to memory of 1600 2184 rundll32.exe rundll32.exe PID 2184 wrote to memory of 1600 2184 rundll32.exe rundll32.exe PID 2184 wrote to memory of 1600 2184 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2c32227fabdf7aa09fa55509305e6d23d45fce2d45d5fd395dff2fbf2fff7545.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2c32227fabdf7aa09fa55509305e6d23d45fce2d45d5fd395dff2fbf2fff7545.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1600-0-0x00000000001F0000-0x0000000000223000-memory.dmpFilesize
204KB