Overview

overview

10

Static

static

TNZRPB2F2YpS.dll

windows7_x64

10

TNZRPB2F2YpS.dll

windows10-2004_x64

10

Analysis

  • max time kernel
    128s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    26/05/2022, 13:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    TNZRPB2F2YpS.dll
  • Size 342KB
  • Sample220526-qaf1tsfebr
  • SHA256 5478e90e2d42676ac423516709111caf32a9eaecad52ccd36f82d1b9ba2e1ca3
  • MD5 SHA1 SHA512
Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Family

  • emotet

Botnet

  • Epoch2

C2

  • 115.21.224.117:80

  • 162.241.204.233:8080

  • 50.116.111.59:8080

  • 194.4.58.192:7080

  • 120.150.60.189:80

  • 172.104.97.173:8080

  • 172.105.13.66:443

  • 62.171.142.179:8080

  • 110.142.236.207:80

  • 62.75.141.82:80

  • 203.153.216.189:7080

  • 66.57.108.14:443

  • 87.106.139.101:8080

  • 120.150.218.241:443

  • 115.94.207.99:443

  • 173.70.61.180:80

  • 2.58.16.89:8080

  • 24.231.88.85:80

  • 200.116.145.225:443

  • 74.58.215.226:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Blocklisted process makes network request 5 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\TNZRPB2F2YpS.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1824
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\TNZRPB2F2YpS.dll,#1
      2⤵
      • Drops file in System32 directory
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1224
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Isivwuypmvkcwo\moflqpydxdysf.bza",wJOCkIMvWkF
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:844
        • C:\Windows\SysWOW64\rundll32.exe
          C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Isivwuypmvkcwo\moflqpydxdysf.bza",#1
          4⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          PID:1448

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/844-61-0x0000000010000000-0x0000000010023000-memory.dmp
        Download

        memory/1224-55-0x0000000075E41000-0x0000000075E43000-memory.dmp
        Download

        memory/1224-59-0x0000000010000000-0x0000000010023000-memory.dmp
        Download

        memory/1224-58-0x00000000000B0000-0x00000000000D0000-memory.dmp
        Download

        memory/1448-63-0x0000000010000000-0x000000001005B000-memory.dmp
        Download