Analysis
-
max time kernel
123s -
max time network
127s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
16-11-2021 21:42
Static task
static1
General
-
Target
1dc4ade9a017445ccfcd1a586c731752c1656fa21b7a5d6e5257daa30f149638.dll
-
Size
252KB
-
MD5
d30fb1943448154e5e678af46c638c66
-
SHA1
791ebb8c5cb7b53a64f4ca7aaec8ee31563d345f
-
SHA256
1dc4ade9a017445ccfcd1a586c731752c1656fa21b7a5d6e5257daa30f149638
-
SHA512
d32cbd9ea3bca5f4f0e1c446fcf10a6a2e5aab5f4d6cdacfa826f212afc0e1d6a8f3fc81fbbcc38259a70bc47e815f919d2e0767802834803bb4839ee60f34a2
Malware Config
Extracted
emotet
Epoch4
81.0.236.93:443
94.177.248.64:443
66.42.55.5:7080
103.8.26.103:8080
185.184.25.237:8080
45.76.176.10:8080
188.93.125.116:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 20 4284 rundll32.exe 25 4284 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Wdyukfgqac\pauqgar.qex rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 4284 rundll32.exe 4284 rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
rundll32.exepid process 4064 rundll32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
rundll32.exerundll32.exerundll32.exerundll32.exedescription pid process target process PID 396 wrote to memory of 3932 396 rundll32.exe rundll32.exe PID 396 wrote to memory of 3932 396 rundll32.exe rundll32.exe PID 396 wrote to memory of 3932 396 rundll32.exe rundll32.exe PID 3932 wrote to memory of 4064 3932 rundll32.exe rundll32.exe PID 3932 wrote to memory of 4064 3932 rundll32.exe rundll32.exe PID 3932 wrote to memory of 4064 3932 rundll32.exe rundll32.exe PID 4064 wrote to memory of 4188 4064 rundll32.exe rundll32.exe PID 4064 wrote to memory of 4188 4064 rundll32.exe rundll32.exe PID 4064 wrote to memory of 4188 4064 rundll32.exe rundll32.exe PID 4188 wrote to memory of 4284 4188 rundll32.exe rundll32.exe PID 4188 wrote to memory of 4284 4188 rundll32.exe rundll32.exe PID 4188 wrote to memory of 4284 4188 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1dc4ade9a017445ccfcd1a586c731752c1656fa21b7a5d6e5257daa30f149638.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1dc4ade9a017445ccfcd1a586c731752c1656fa21b7a5d6e5257daa30f149638.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\1dc4ade9a017445ccfcd1a586c731752c1656fa21b7a5d6e5257daa30f149638.dll",Control_RunDLL3⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Wdyukfgqac\pauqgar.qex",cWvQ4⤵
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Wdyukfgqac\pauqgar.qex",Control_RunDLL5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4284