Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
16-11-2021 21:28
Static task
static1
General
-
Target
a09ed2d487c9c9e09b47a3afb6da4cf2cc90b786a4b13693d9f24261cc406da4.dll
-
Size
252KB
-
MD5
50a11107656e558359012f05a31364cb
-
SHA1
7739f0bb72074327bb2e235ce394666f5897bf6a
-
SHA256
a09ed2d487c9c9e09b47a3afb6da4cf2cc90b786a4b13693d9f24261cc406da4
-
SHA512
6e275f3bca87be9119bb63e3d5a77a18f05ea9c65c3ff0017258a9ec27ad415dc0b47bc350e541893a4c95bf9fd598893bc756666a41f18523004d3cec51a56e
Malware Config
Extracted
emotet
Epoch4
81.0.236.93:443
94.177.248.64:443
66.42.55.5:7080
103.8.26.103:8080
185.184.25.237:8080
45.76.176.10:8080
188.93.125.116:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 18 532 rundll32.exe 23 532 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Lldnbegptusm\zptidptasiyimq.vxu rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 532 rundll32.exe 532 rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
rundll32.exepid process 4076 rundll32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
rundll32.exerundll32.exerundll32.exerundll32.exedescription pid process target process PID 3128 wrote to memory of 2840 3128 rundll32.exe rundll32.exe PID 3128 wrote to memory of 2840 3128 rundll32.exe rundll32.exe PID 3128 wrote to memory of 2840 3128 rundll32.exe rundll32.exe PID 2840 wrote to memory of 4076 2840 rundll32.exe rundll32.exe PID 2840 wrote to memory of 4076 2840 rundll32.exe rundll32.exe PID 2840 wrote to memory of 4076 2840 rundll32.exe rundll32.exe PID 4076 wrote to memory of 2180 4076 rundll32.exe rundll32.exe PID 4076 wrote to memory of 2180 4076 rundll32.exe rundll32.exe PID 4076 wrote to memory of 2180 4076 rundll32.exe rundll32.exe PID 2180 wrote to memory of 532 2180 rundll32.exe rundll32.exe PID 2180 wrote to memory of 532 2180 rundll32.exe rundll32.exe PID 2180 wrote to memory of 532 2180 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a09ed2d487c9c9e09b47a3afb6da4cf2cc90b786a4b13693d9f24261cc406da4.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a09ed2d487c9c9e09b47a3afb6da4cf2cc90b786a4b13693d9f24261cc406da4.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\a09ed2d487c9c9e09b47a3afb6da4cf2cc90b786a4b13693d9f24261cc406da4.dll",Control_RunDLL3⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Lldnbegptusm\zptidptasiyimq.vxu",JetyiUDASd4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Lldnbegptusm\zptidptasiyimq.vxu",Control_RunDLL5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/532-119-0x0000000000000000-mapping.dmp
-
memory/2180-118-0x0000000000000000-mapping.dmp
-
memory/2840-115-0x0000000000000000-mapping.dmp
-
memory/2840-117-0x0000000010000000-0x0000000010028000-memory.dmpFilesize
160KB
-
memory/4076-116-0x0000000000000000-mapping.dmp