Overview

overview

10

Static

static

tgzrnhae.dll

windows7_x64

8

tgzrnhae.dll

windows10-2004_x64

10

Analysis

  • max time kernel
    152s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21/04/2022, 19:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    tgzrnhae.dll
  • Size 348KB
  • Sample220421-yla8qagce5
  • SHA256 b5abacf24ae5aa96016c09f71a78d0121fff396d6154740eab622c4751e1764f
  • MD5 SHA1 SHA512
Score
10/10
emotetepoch1bankertrojan

Malware Config

Extracted

Family

  • emotet

Botnet

  • Epoch1

C2

  • 181.10.46.92:80

  • 2.58.16.88:8080

  • 206.189.232.2:8080

  • 178.250.54.208:8080

  • 167.71.148.58:443

  • 202.134.4.210:7080

  • 187.162.248.237:80

  • 78.206.229.130:80

  • 85.214.26.7:8080

  • 5.196.35.138:7080

  • 1.226.84.243:8080

  • 110.39.162.2:443

  • 185.183.16.47:80

  • 152.231.89.226:80

  • 138.97.60.141:7080

  • 94.176.234.118:443

  • 46.101.58.37:8080

  • 93.146.143.191:80

  • 70.32.84.74:8080

  • 137.74.106.111:7080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Blocklisted process makes network request 5 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\tgzrnhae.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4156
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\tgzrnhae.dll,#1
      2⤵
      • Drops file in System32 directory
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:3512
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Jopdiuvuwael\jfutdguyjxb.jof",zRzISvMia
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:544
        • C:\Windows\SysWOW64\rundll32.exe
          C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Jopdiuvuwael\jfutdguyjxb.jof",#1
          4⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:1604

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        jfutdguyjxb.jof
        • Path C:\Windows\SysWOW64\Jopdiuvuwael\jfutdguyjxb.jof
        • Size 348KB
        • SHA256 b5abacf24ae5aa96016c09f71a78d0121fff396d6154740eab622c4751e1764f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        jfutdguyjxb.jof
        • Path C:\Windows\SysWOW64\Jopdiuvuwael\jfutdguyjxb.jof
        • Size 348KB
        • SHA256 b5abacf24ae5aa96016c09f71a78d0121fff396d6154740eab622c4751e1764f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/544-136-0x0000000010000000-0x0000000010024000-memory.dmp
        Download

        memory/1604-138-0x0000000010000000-0x000000001005C000-memory.dmp
        Download

        memory/3512-131-0x0000000000730000-0x0000000000751000-memory.dmp
        Download

        memory/3512-132-0x0000000010000000-0x000000001005C000-memory.dmp
        Download