e935c7159e7550951ccf8f018e36d3a341ab04f58acb0a1e389e0cb66caec211

Analysis

max time kernel
138s
max time network
140s
platform
windows10_x64
resource
win10-en-20211104
submitted
01/12/2021, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
emotet_exe_e5_e935c7159e7550951ccf8f018e36d3a341ab04f58acb0a1e389e0cb66caec211_2021-12-01__222207.exe.dll
Size 364KB
Sample211201-2askeabeg8
SHA256 e935c7159e7550951ccf8f018e36d3a341ab04f58acb0a1e389e0cb66caec211
MD5 8ef007348da4202edbd8853827421378
SHA1 30bff35aef708b3435d6e3b3dafa2af1a552d27b
SHA512 a40d83fc16581f487cdb662650c23e8a5fb080e34c29d62e9e0c188a002507093964af4801f7802cf3ca46c9e3f8fad0bcfdedb9ee70f390f378e839a6eec271
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Hcvuezixiyfthla\swgzcjndb.vmm	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4404	rundll32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 4212	4208	rundll32.exe	69
PID 4208 wrote to memory of 4212	4208	rundll32.exe	69
PID 4208 wrote to memory of 4212	4208	rundll32.exe	69
PID 4212 wrote to memory of 4404	4212	rundll32.exe	70
PID 4212 wrote to memory of 4404	4212	rundll32.exe	70
PID 4212 wrote to memory of 4404	4212	rundll32.exe	70
PID 4404 wrote to memory of 3140	4404	rundll32.exe	73
PID 4404 wrote to memory of 3140	4404	rundll32.exe	73
PID 4404 wrote to memory of 3140	4404	rundll32.exe	73
PID 3140 wrote to memory of 520	3140	rundll32.exe	74
PID 3140 wrote to memory of 520	3140	rundll32.exe	74
PID 3140 wrote to memory of 520	3140	rundll32.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e935c7159e7550951ccf8f018e36d3a341ab04f58acb0a1e389e0cb66caec211_2021-12-01__222207.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e935c7159e7550951ccf8f018e36d3a341ab04f58acb0a1e389e0cb66caec211_2021-12-01__222207.exe.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e935c7159e7550951ccf8f018e36d3a341ab04f58acb0a1e389e0cb66caec211_2021-12-01__222207.exe.dll",Control_RunDLL
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: RenamesItself
    - Suspicious use of WriteProcessMemory
    PID:4404
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Hcvuezixiyfthla\swgzcjndb.vmm",OipuxlWm
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3140
    - - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Hcvuezixiyfthla\swgzcjndb.vmm",Control_RunDLL
        5⤵
        
        PID:520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3140-123-0x0000000000140000-0x00000000001EE000-memory.dmp

Download

memory/4212-120-0x0000000000600000-0x000000000074A000-memory.dmp