Analysis

  • max time kernel
    104s
  • max time network
    122s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    16-11-2021 21:28

General

  • Target

    686e7d9f14c32b5fc46d85de528d823c70682c93c8953355547757f8af03a754.dll

  • Size

    252KB

  • MD5

    83fc668933ca4ee28cb86fea232bbb68

  • SHA1

    5cbf1ace16cbfc27a8c07fa886bdecc7a44e5270

  • SHA256

    686e7d9f14c32b5fc46d85de528d823c70682c93c8953355547757f8af03a754

  • SHA512

    dd47784442cee72ca17bb30f8dca2ea1026ee208682579a2b2655aeaaa3201c099d2555bde9c9c26076720156247de2c2d1fd36536964f2967100b87609d8402

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

81.0.236.93:443

94.177.248.64:443

66.42.55.5:7080

103.8.26.103:8080

185.184.25.237:8080

45.76.176.10:8080

188.93.125.116:8080

103.8.26.102:8080

178.79.147.66:8080

58.227.42.236:80

45.118.135.203:7080

103.75.201.2:443

195.154.133.20:443

45.142.114.231:8080

212.237.5.209:443

207.38.84.195:8080

104.251.214.46:8080

138.185.72.26:8080

51.68.175.8:8080

210.57.217.132:8080

eck1.plain
ecs1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Blocklisted process makes network request 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\686e7d9f14c32b5fc46d85de528d823c70682c93c8953355547757f8af03a754.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\686e7d9f14c32b5fc46d85de528d823c70682c93c8953355547757f8af03a754.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3992
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\686e7d9f14c32b5fc46d85de528d823c70682c93c8953355547757f8af03a754.dll",Control_RunDLL
        3⤵
        • Drops file in System32 directory
        • Suspicious behavior: RenamesItself
        • Suspicious use of WriteProcessMemory
        PID:2576
        • C:\Windows\SysWOW64\rundll32.exe
          C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Jfnircyntngwqf\imylkvvlxtw.ozg",eQDKOuvxzLJatS
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3592
          • C:\Windows\SysWOW64\rundll32.exe
            C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Jfnircyntngwqf\imylkvvlxtw.ozg",Control_RunDLL
            5⤵
            • Blocklisted process makes network request
            • Suspicious behavior: EnumeratesProcesses
            PID:3976

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2576-119-0x0000000000000000-mapping.dmp
  • memory/3592-121-0x0000000000000000-mapping.dmp
  • memory/3976-122-0x0000000000000000-mapping.dmp
  • memory/3992-118-0x0000000000000000-mapping.dmp
  • memory/3992-120-0x0000000010000000-0x0000000010028000-memory.dmp
    Filesize

    160KB