Analysis
-
max time kernel
104s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
16-11-2021 21:28
Static task
static1
General
-
Target
686e7d9f14c32b5fc46d85de528d823c70682c93c8953355547757f8af03a754.dll
-
Size
252KB
-
MD5
83fc668933ca4ee28cb86fea232bbb68
-
SHA1
5cbf1ace16cbfc27a8c07fa886bdecc7a44e5270
-
SHA256
686e7d9f14c32b5fc46d85de528d823c70682c93c8953355547757f8af03a754
-
SHA512
dd47784442cee72ca17bb30f8dca2ea1026ee208682579a2b2655aeaaa3201c099d2555bde9c9c26076720156247de2c2d1fd36536964f2967100b87609d8402
Malware Config
Extracted
emotet
Epoch4
81.0.236.93:443
94.177.248.64:443
66.42.55.5:7080
103.8.26.103:8080
185.184.25.237:8080
45.76.176.10:8080
188.93.125.116:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 18 3976 rundll32.exe 23 3976 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Jfnircyntngwqf\imylkvvlxtw.ozg rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 3976 rundll32.exe 3976 rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
rundll32.exepid process 2576 rundll32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
rundll32.exerundll32.exerundll32.exerundll32.exedescription pid process target process PID 3064 wrote to memory of 3992 3064 rundll32.exe rundll32.exe PID 3064 wrote to memory of 3992 3064 rundll32.exe rundll32.exe PID 3064 wrote to memory of 3992 3064 rundll32.exe rundll32.exe PID 3992 wrote to memory of 2576 3992 rundll32.exe rundll32.exe PID 3992 wrote to memory of 2576 3992 rundll32.exe rundll32.exe PID 3992 wrote to memory of 2576 3992 rundll32.exe rundll32.exe PID 2576 wrote to memory of 3592 2576 rundll32.exe rundll32.exe PID 2576 wrote to memory of 3592 2576 rundll32.exe rundll32.exe PID 2576 wrote to memory of 3592 2576 rundll32.exe rundll32.exe PID 3592 wrote to memory of 3976 3592 rundll32.exe rundll32.exe PID 3592 wrote to memory of 3976 3592 rundll32.exe rundll32.exe PID 3592 wrote to memory of 3976 3592 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\686e7d9f14c32b5fc46d85de528d823c70682c93c8953355547757f8af03a754.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\686e7d9f14c32b5fc46d85de528d823c70682c93c8953355547757f8af03a754.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\686e7d9f14c32b5fc46d85de528d823c70682c93c8953355547757f8af03a754.dll",Control_RunDLL3⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Jfnircyntngwqf\imylkvvlxtw.ozg",eQDKOuvxzLJatS4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Jfnircyntngwqf\imylkvvlxtw.ozg",Control_RunDLL5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2576-119-0x0000000000000000-mapping.dmp
-
memory/3592-121-0x0000000000000000-mapping.dmp
-
memory/3976-122-0x0000000000000000-mapping.dmp
-
memory/3992-118-0x0000000000000000-mapping.dmp
-
memory/3992-120-0x0000000010000000-0x0000000010028000-memory.dmpFilesize
160KB