Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220722-en -
resource tags
arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system -
submitted
31-07-2022 05:15
Static task
static1
Behavioral task
behavioral1
Sample
knbbdizq.dll
Resource
win7-20220715-en
General
-
Target
knbbdizq.dll
-
Size
233KB
-
MD5
5aefd49a03a4810e6dd2b73395deb12b
-
SHA1
7706a62fa35616037c6ce35d71eea6fa10cc0eac
-
SHA256
f3842cd4b63be5212f9d13436938759fc5d1966bdad0cec0819f87cfbfb3adec
-
SHA512
2e622a4c7cc2da5a4dee64823fa42b499749fd473dee5d0e9703e08b8d4f564b57a8eb6c75eb057d02d25f81ccc851f1ab266ab68ae4c3eb8c266a8cc8bf44ff
Malware Config
Extracted
emotet
Epoch1
184.66.18.83:80
202.187.222.40:80
167.71.148.58:443
211.215.18.93:8080
1.234.65.61:80
80.15.100.37:80
155.186.9.160:80
172.104.169.32:8080
110.39.162.2:443
12.162.84.2:8080
181.136.190.86:80
68.183.190.199:8080
191.223.36.170:80
190.45.24.210:80
81.213.175.132:80
181.120.29.49:80
82.76.111.249:443
177.23.7.151:80
95.76.153.115:80
93.148.247.169:80
51.255.165.160:8080
213.52.74.198:80
178.250.54.208:8080
202.134.4.210:7080
138.97.60.141:7080
94.176.234.118:443
190.24.243.186:80
46.43.2.95:8080
197.232.36.108:80
77.78.196.173:443
59.148.253.194:8080
212.71.237.140:8080
46.101.58.37:8080
110.39.160.38:443
83.169.21.32:7080
189.2.177.210:443
81.214.253.80:443
51.15.7.145:80
172.245.248.239:8080
177.85.167.10:80
178.211.45.66:8080
5.196.35.138:7080
71.58.233.254:80
168.121.4.238:80
149.202.72.142:7080
185.183.16.47:80
191.241.233.198:80
209.236.123.42:8080
190.114.254.163:8080
70.32.84.74:8080
138.97.60.140:8080
68.183.170.114:8080
192.232.229.53:4143
62.84.75.50:80
113.163.216.135:80
46.105.114.137:8080
177.144.130.105:8080
192.232.229.54:7080
192.175.111.212:7080
35.143.99.174:80
81.215.230.173:443
1.226.84.243:8080
187.162.248.237:80
152.169.22.67:80
137.74.106.111:7080
191.182.6.118:80
181.61.182.143:80
202.79.24.136:443
50.28.51.143:8080
85.214.26.7:8080
170.81.48.2:80
111.67.12.222:8080
177.144.130.105:443
188.225.32.231:7080
185.94.252.27:443
12.163.208.58:80
191.53.80.88:80
87.106.46.107:8080
122.201.23.45:443
181.30.61.163:443
104.131.41.185:8080
190.195.129.227:8090
45.184.103.73:80
186.146.13.184:443
45.16.226.117:443
187.162.250.23:443
2.80.112.146:80
60.93.23.51:80
24.232.228.233:80
190.251.216.100:80
105.209.235.113:8080
217.13.106.14:8080
190.64.88.186:443
118.38.110.192:80
111.67.12.221:8080
201.75.62.86:80
70.32.115.157:8080
188.135.15.49:80
Signatures
-
Blocklisted process makes network request 4 IoCs
Processes:
rundll32.exeflow pid process 28 972 rundll32.exe 53 972 rundll32.exe 56 972 rundll32.exe 71 972 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 972 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Okji\ufjoxnn.too rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
rundll32.exepid process 972 rundll32.exe 972 rundll32.exe 972 rundll32.exe 972 rundll32.exe 972 rundll32.exe 972 rundll32.exe 972 rundll32.exe 972 rundll32.exe 972 rundll32.exe 972 rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
rundll32.exepid process 4904 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 4680 wrote to memory of 4904 4680 rundll32.exe rundll32.exe PID 4680 wrote to memory of 4904 4680 rundll32.exe rundll32.exe PID 4680 wrote to memory of 4904 4680 rundll32.exe rundll32.exe PID 4904 wrote to memory of 972 4904 rundll32.exe rundll32.exe PID 4904 wrote to memory of 972 4904 rundll32.exe rundll32.exe PID 4904 wrote to memory of 972 4904 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\knbbdizq.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\knbbdizq.dll,#12⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Okji\ufjoxnn.too",RunDLL3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\Okji\ufjoxnn.tooFilesize
233KB
MD55aefd49a03a4810e6dd2b73395deb12b
SHA17706a62fa35616037c6ce35d71eea6fa10cc0eac
SHA256f3842cd4b63be5212f9d13436938759fc5d1966bdad0cec0819f87cfbfb3adec
SHA5122e622a4c7cc2da5a4dee64823fa42b499749fd473dee5d0e9703e08b8d4f564b57a8eb6c75eb057d02d25f81ccc851f1ab266ab68ae4c3eb8c266a8cc8bf44ff
-
memory/972-139-0x0000000000000000-mapping.dmp
-
memory/972-141-0x00000000024D0000-0x00000000024F2000-memory.dmpFilesize
136KB
-
memory/4904-135-0x0000000000000000-mapping.dmp
-
memory/4904-136-0x0000000000E40000-0x0000000000E62000-memory.dmpFilesize
136KB