Analysis
-
max time kernel
104s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
16-11-2021 21:10
Static task
static1
General
-
Target
350f2de5923b3275c916e238b4c6f269bf4727bfd91e31bd3fdeec6328113956.dll
-
Size
252KB
-
MD5
25ef9f397d85f4654e032fccd627f14a
-
SHA1
66c835eeec0f33586c06f76f81120fc29fa6ce41
-
SHA256
350f2de5923b3275c916e238b4c6f269bf4727bfd91e31bd3fdeec6328113956
-
SHA512
dc10aa156c7d1afe6563297e7bac90180877321354a026de06b7e1bf1dde8bc4af4332430696a9a02b068e1b443c7c5c58d08d044ea2a5567544e3102f93f059
Malware Config
Extracted
emotet
Epoch4
81.0.236.93:443
94.177.248.64:443
66.42.55.5:7080
103.8.26.103:8080
185.184.25.237:8080
45.76.176.10:8080
188.93.125.116:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 18 3688 rundll32.exe 23 3688 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Uiqcghnjdzxfwlqu\alus.gdc rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 3688 rundll32.exe 3688 rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
rundll32.exepid process 2576 rundll32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
rundll32.exerundll32.exerundll32.exerundll32.exedescription pid process target process PID 3444 wrote to memory of 3780 3444 rundll32.exe rundll32.exe PID 3444 wrote to memory of 3780 3444 rundll32.exe rundll32.exe PID 3444 wrote to memory of 3780 3444 rundll32.exe rundll32.exe PID 3780 wrote to memory of 2576 3780 rundll32.exe rundll32.exe PID 3780 wrote to memory of 2576 3780 rundll32.exe rundll32.exe PID 3780 wrote to memory of 2576 3780 rundll32.exe rundll32.exe PID 2576 wrote to memory of 3980 2576 rundll32.exe rundll32.exe PID 2576 wrote to memory of 3980 2576 rundll32.exe rundll32.exe PID 2576 wrote to memory of 3980 2576 rundll32.exe rundll32.exe PID 3980 wrote to memory of 3688 3980 rundll32.exe rundll32.exe PID 3980 wrote to memory of 3688 3980 rundll32.exe rundll32.exe PID 3980 wrote to memory of 3688 3980 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\350f2de5923b3275c916e238b4c6f269bf4727bfd91e31bd3fdeec6328113956.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\350f2de5923b3275c916e238b4c6f269bf4727bfd91e31bd3fdeec6328113956.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\350f2de5923b3275c916e238b4c6f269bf4727bfd91e31bd3fdeec6328113956.dll",Control_RunDLL3⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Uiqcghnjdzxfwlqu\alus.gdc",vZinWUDKWDpu4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Uiqcghnjdzxfwlqu\alus.gdc",Control_RunDLL5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2576-119-0x0000000000000000-mapping.dmp
-
memory/3688-122-0x0000000000000000-mapping.dmp
-
memory/3780-118-0x0000000000000000-mapping.dmp
-
memory/3780-120-0x0000000010000000-0x0000000010028000-memory.dmpFilesize
160KB
-
memory/3980-121-0x0000000000000000-mapping.dmp