Analysis
-
max time kernel
109s -
max time network
126s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
16-11-2021 21:34
Static task
static1
General
-
Target
a7ca7ce54a52380549f87624037e5b654a5a909ae6ca25f3f878cdab5c9e6edb.dll
-
Size
252KB
-
MD5
59308ba7d50e51fb3c343d35b4da84dc
-
SHA1
041c190209f7af67b5047e90e81460c66db71d0d
-
SHA256
a7ca7ce54a52380549f87624037e5b654a5a909ae6ca25f3f878cdab5c9e6edb
-
SHA512
959497a00b1f6aa4f5cea58adec3b75b67bc2aa9e85581b1890ff1af6b0642dec6d05616119b114310ba298619e5f68fb96400ba0d639de68654ceb277fcada9
Malware Config
Extracted
emotet
Epoch4
81.0.236.93:443
94.177.248.64:443
66.42.55.5:7080
103.8.26.103:8080
185.184.25.237:8080
45.76.176.10:8080
188.93.125.116:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 18 924 rundll32.exe 23 924 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Rygvgjdmnr\pqrxasynyft.sfk rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 924 rundll32.exe 924 rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
rundll32.exepid process 3208 rundll32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
rundll32.exerundll32.exerundll32.exerundll32.exedescription pid process target process PID 2680 wrote to memory of 2108 2680 rundll32.exe rundll32.exe PID 2680 wrote to memory of 2108 2680 rundll32.exe rundll32.exe PID 2680 wrote to memory of 2108 2680 rundll32.exe rundll32.exe PID 2108 wrote to memory of 3208 2108 rundll32.exe rundll32.exe PID 2108 wrote to memory of 3208 2108 rundll32.exe rundll32.exe PID 2108 wrote to memory of 3208 2108 rundll32.exe rundll32.exe PID 3208 wrote to memory of 1188 3208 rundll32.exe rundll32.exe PID 3208 wrote to memory of 1188 3208 rundll32.exe rundll32.exe PID 3208 wrote to memory of 1188 3208 rundll32.exe rundll32.exe PID 1188 wrote to memory of 924 1188 rundll32.exe rundll32.exe PID 1188 wrote to memory of 924 1188 rundll32.exe rundll32.exe PID 1188 wrote to memory of 924 1188 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a7ca7ce54a52380549f87624037e5b654a5a909ae6ca25f3f878cdab5c9e6edb.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a7ca7ce54a52380549f87624037e5b654a5a909ae6ca25f3f878cdab5c9e6edb.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\a7ca7ce54a52380549f87624037e5b654a5a909ae6ca25f3f878cdab5c9e6edb.dll",Control_RunDLL3⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Rygvgjdmnr\pqrxasynyft.sfk",GxMMDnSwm4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Rygvgjdmnr\pqrxasynyft.sfk",Control_RunDLL5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/924-119-0x0000000000000000-mapping.dmp
-
memory/1188-118-0x0000000000000000-mapping.dmp
-
memory/2108-115-0x0000000000000000-mapping.dmp
-
memory/2108-117-0x0000000010000000-0x0000000010028000-memory.dmpFilesize
160KB
-
memory/3208-116-0x0000000000000000-mapping.dmp