Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
16-11-2021 21:46
Static task
static1
General
-
Target
713c53fdd85e9b594bea237b4364978d01f6004518efad6602a494dfe16535d7.dll
-
Size
252KB
-
MD5
70582b4ff0c3a417dc2f3c109b7c8bc8
-
SHA1
d773421be9578d2ad197e926bd295c17cb6d50ee
-
SHA256
713c53fdd85e9b594bea237b4364978d01f6004518efad6602a494dfe16535d7
-
SHA512
3bec72f476deff55b7239180886f8fc227c94b82f12fd8e326ee8d9a8f33e1801824c498af3c246ce67477b9114a27f30580cd000e32c132a0ae9f8b82264da4
Malware Config
Extracted
emotet
Epoch4
81.0.236.93:443
94.177.248.64:443
66.42.55.5:7080
103.8.26.103:8080
185.184.25.237:8080
45.76.176.10:8080
188.93.125.116:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 18 2432 rundll32.exe 23 2432 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Lupzngybmvksthc\vuzpdgnj.pfb rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 2432 rundll32.exe 2432 rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
rundll32.exepid process 496 rundll32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
rundll32.exerundll32.exerundll32.exerundll32.exedescription pid process target process PID 4024 wrote to memory of 3100 4024 rundll32.exe rundll32.exe PID 4024 wrote to memory of 3100 4024 rundll32.exe rundll32.exe PID 4024 wrote to memory of 3100 4024 rundll32.exe rundll32.exe PID 3100 wrote to memory of 496 3100 rundll32.exe rundll32.exe PID 3100 wrote to memory of 496 3100 rundll32.exe rundll32.exe PID 3100 wrote to memory of 496 3100 rundll32.exe rundll32.exe PID 496 wrote to memory of 1176 496 rundll32.exe rundll32.exe PID 496 wrote to memory of 1176 496 rundll32.exe rundll32.exe PID 496 wrote to memory of 1176 496 rundll32.exe rundll32.exe PID 1176 wrote to memory of 2432 1176 rundll32.exe rundll32.exe PID 1176 wrote to memory of 2432 1176 rundll32.exe rundll32.exe PID 1176 wrote to memory of 2432 1176 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\713c53fdd85e9b594bea237b4364978d01f6004518efad6602a494dfe16535d7.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\713c53fdd85e9b594bea237b4364978d01f6004518efad6602a494dfe16535d7.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\713c53fdd85e9b594bea237b4364978d01f6004518efad6602a494dfe16535d7.dll",Control_RunDLL3⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Lupzngybmvksthc\vuzpdgnj.pfb",SJxrITlEIAczD4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Lupzngybmvksthc\vuzpdgnj.pfb",Control_RunDLL5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/496-119-0x0000000000000000-mapping.dmp
-
memory/1176-121-0x0000000000000000-mapping.dmp
-
memory/2432-122-0x0000000000000000-mapping.dmp
-
memory/3100-118-0x0000000000000000-mapping.dmp
-
memory/3100-120-0x0000000010000000-0x0000000010028000-memory.dmpFilesize
160KB