Analysis

  • max time kernel
    143s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220310-en
  • submitted
    17-03-2022 18:10

General

  • Target

    d1dd435b1d9d160362ba98902846a29be59c4bd6caae1b06effe14855106d952.dll

  • Size

    217KB

  • MD5

    05c6b87cd2a69152d186b57a64e01075

  • SHA1

    35bb2be326bfa548986fa23b097250228a496a9d

  • SHA256

    d1dd435b1d9d160362ba98902846a29be59c4bd6caae1b06effe14855106d952

  • SHA512

    8babad5697191d1b6d29a5b5812b0c72f90a2230d8373d322ff41f9a7b85b5951dbc74fa423cf292727d4fba97e2e66a75449af90d8ee02d1244a92a59c91105

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

173.70.61.180:80

59.21.235.119:80

50.116.111.59:8080

173.249.20.233:443

188.165.214.98:8080

72.188.173.74:80

74.40.205.197:443

64.207.182.168:8080

97.120.3.198:80

190.29.166.0:80

123.176.25.234:80

155.186.9.160:80

138.68.87.218:443

139.99.158.11:443

78.24.219.147:8080

58.1.242.115:80

108.21.72.56:443

188.219.31.12:80

70.180.33.202:80

181.171.209.241:443

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet3 2 IoCs
  • Blocklisted process makes network request 5 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\d1dd435b1d9d160362ba98902846a29be59c4bd6caae1b06effe14855106d952.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1324
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\d1dd435b1d9d160362ba98902846a29be59c4bd6caae1b06effe14855106d952.dll,#1
      2⤵
      • Drops file in System32 directory
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:2316
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Mfnv\zys.neo",RunDLL
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:1988

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\Mfnv\zys.neo

    MD5

    05c6b87cd2a69152d186b57a64e01075

    SHA1

    35bb2be326bfa548986fa23b097250228a496a9d

    SHA256

    d1dd435b1d9d160362ba98902846a29be59c4bd6caae1b06effe14855106d952

    SHA512

    8babad5697191d1b6d29a5b5812b0c72f90a2230d8373d322ff41f9a7b85b5951dbc74fa423cf292727d4fba97e2e66a75449af90d8ee02d1244a92a59c91105

  • memory/1988-138-0x00000000014B0000-0x00000000014CF000-memory.dmp

    Filesize

    124KB

  • memory/2316-134-0x0000000002370000-0x000000000238F000-memory.dmp

    Filesize

    124KB