Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
16-11-2021 22:16
Static task
static1
General
-
Target
61a2941e39c362bd2d3681a966913686e7b9b0847b9f085b439dde913e15bb12.dll
-
Size
252KB
-
MD5
74fbbbcca46d2998111bd2095ffd2355
-
SHA1
894fac777488826e93122a2d0120667e26b0a0ee
-
SHA256
61a2941e39c362bd2d3681a966913686e7b9b0847b9f085b439dde913e15bb12
-
SHA512
2b597f6e2b33db72311ad1fe72a43eb41fd83ec710a8ae73e3d790b10509f03c0aae28807ebe06351b69e7c9464b0503e256df2f68aa517511ced5396a77333a
Malware Config
Extracted
emotet
Epoch4
81.0.236.93:443
94.177.248.64:443
66.42.55.5:7080
103.8.26.103:8080
185.184.25.237:8080
45.76.176.10:8080
188.93.125.116:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 18 1252 rundll32.exe 23 1252 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Svitswtvuvav\oyunljzqhwg.cmj rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 1252 rundll32.exe 1252 rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
rundll32.exepid process 3748 rundll32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
rundll32.exerundll32.exerundll32.exerundll32.exedescription pid process target process PID 2680 wrote to memory of 2724 2680 rundll32.exe rundll32.exe PID 2680 wrote to memory of 2724 2680 rundll32.exe rundll32.exe PID 2680 wrote to memory of 2724 2680 rundll32.exe rundll32.exe PID 2724 wrote to memory of 3748 2724 rundll32.exe rundll32.exe PID 2724 wrote to memory of 3748 2724 rundll32.exe rundll32.exe PID 2724 wrote to memory of 3748 2724 rundll32.exe rundll32.exe PID 3748 wrote to memory of 2116 3748 rundll32.exe rundll32.exe PID 3748 wrote to memory of 2116 3748 rundll32.exe rundll32.exe PID 3748 wrote to memory of 2116 3748 rundll32.exe rundll32.exe PID 2116 wrote to memory of 1252 2116 rundll32.exe rundll32.exe PID 2116 wrote to memory of 1252 2116 rundll32.exe rundll32.exe PID 2116 wrote to memory of 1252 2116 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\61a2941e39c362bd2d3681a966913686e7b9b0847b9f085b439dde913e15bb12.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\61a2941e39c362bd2d3681a966913686e7b9b0847b9f085b439dde913e15bb12.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\61a2941e39c362bd2d3681a966913686e7b9b0847b9f085b439dde913e15bb12.dll",Control_RunDLL3⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Svitswtvuvav\oyunljzqhwg.cmj",LYui4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Svitswtvuvav\oyunljzqhwg.cmj",Control_RunDLL5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1252-119-0x0000000000000000-mapping.dmp
-
memory/2116-118-0x0000000000000000-mapping.dmp
-
memory/2724-115-0x0000000000000000-mapping.dmp
-
memory/2724-117-0x0000000010000000-0x0000000010028000-memory.dmpFilesize
160KB
-
memory/3748-116-0x0000000000000000-mapping.dmp