Analysis
-
max time kernel
112s -
max time network
134s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
26-01-2021 17:02
Static task
static1
General
-
Target
tfvxeurehkyz.wut.dll
-
Size
404KB
-
MD5
9a062ead5b2d55af0a5a4b39c5b5eadc
-
SHA1
fc83367be87c700a696b0329dab538b5e47d90bf
-
SHA256
a9c68d527223db40014d067cf4fdae5be46cca67387e9cfdff118276085f23ef
-
SHA512
693ab862c7e3c5dad3ca3d44bbc4a5a4c2391ff558e02e86e4c1d7d1fa7c00b4acf1c426ca619dea2b422997caaf1f0ecba37ec0ffca19edaca297005c9ad861
Malware Config
Extracted
| Family |
emotet |
| Botnet |
LEA |
| C2 |
80.158.3.161:443 80.158.51.209:8080 80.158.35.51:80 80.158.63.78:443 80.158.53.167:80 80.158.62.194:443 80.158.59.174:8080 80.158.43.136:80 |
| rsa_pubkey.plain |
|
Signatures
-
Blocklisted process makes network request ⋅ 1 IoCs
Processes:
rundll32.exeflow pid process 12 1700 rundll32.exe -
Suspicious behavior: EnumeratesProcesses ⋅ 6 IoCs
Processes:
rundll32.exepid process 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe -
Suspicious use of WriteProcessMemory ⋅ 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 944 wrote to memory of 1700 944 rundll32.exe rundll32.exe PID 944 wrote to memory of 1700 944 rundll32.exe rundll32.exe PID 944 wrote to memory of 1700 944 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exePID:944rundll32.exe C:\Users\Admin\AppData\Local\Temp\tfvxeurehkyz.wut.dll,#1Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exePID:1700rundll32.exe C:\Users\Admin\AppData\Local\Temp\tfvxeurehkyz.wut.dll,#1Blocklisted process makes network requestSuspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\rundll32.exePID:2240C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
00:00
00:00
Loading data