Analysis
-
max time kernel
132s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
17-11-2022 09:04
Static task
static1
Behavioral task
behavioral1
Sample
04127316b9d7776ed0054f2a1d0a69e9475ece1f5790d95cf9d46a291026d9dc.dll
Resource
win7-20221111-en
General
-
Target
04127316b9d7776ed0054f2a1d0a69e9475ece1f5790d95cf9d46a291026d9dc.dll
-
Size
252KB
-
MD5
d0992fffda8fd4acbe44c1b07dd0b4dd
-
SHA1
bbaca5532b18e7c8506a7d4be008a6e4c897e43e
-
SHA256
04127316b9d7776ed0054f2a1d0a69e9475ece1f5790d95cf9d46a291026d9dc
-
SHA512
0b715ae50791d1c30df8810948cfa7d99ccb7f092510eb5aa3e61a218a1b96052b2c6ba61fa5ce1509aa55bb2dc7c722fc52062854256a5ea48e59b3aff184f4
-
SSDEEP
6144:9ks3h7Usv9KgNXyyPSkDTQhJh1WTB5TCa:9kMgwWyqkDT0WTfWa
Malware Config
Extracted
emotet
Epoch4
81.0.236.93:443
94.177.248.64:443
66.42.55.5:7080
103.8.26.103:8080
185.184.25.237:8080
45.76.176.10:8080
188.93.125.116:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
Blocklisted process makes network request 8 IoCs
Processes:
rundll32.exeflow pid process 3 320 rundll32.exe 5 320 rundll32.exe 6 320 rundll32.exe 7 320 rundll32.exe 8 320 rundll32.exe 9 320 rundll32.exe 11 320 rundll32.exe 12 320 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Pbvtowvzgidhha\pttambfv.rct rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
rundll32.exepid process 320 rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
rundll32.exepid process 1088 rundll32.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
rundll32.exerundll32.exerundll32.exerundll32.exedescription pid process target process PID 1756 wrote to memory of 1240 1756 rundll32.exe rundll32.exe PID 1756 wrote to memory of 1240 1756 rundll32.exe rundll32.exe PID 1756 wrote to memory of 1240 1756 rundll32.exe rundll32.exe PID 1756 wrote to memory of 1240 1756 rundll32.exe rundll32.exe PID 1756 wrote to memory of 1240 1756 rundll32.exe rundll32.exe PID 1756 wrote to memory of 1240 1756 rundll32.exe rundll32.exe PID 1756 wrote to memory of 1240 1756 rundll32.exe rundll32.exe PID 1240 wrote to memory of 1088 1240 rundll32.exe rundll32.exe PID 1240 wrote to memory of 1088 1240 rundll32.exe rundll32.exe PID 1240 wrote to memory of 1088 1240 rundll32.exe rundll32.exe PID 1240 wrote to memory of 1088 1240 rundll32.exe rundll32.exe PID 1240 wrote to memory of 1088 1240 rundll32.exe rundll32.exe PID 1240 wrote to memory of 1088 1240 rundll32.exe rundll32.exe PID 1240 wrote to memory of 1088 1240 rundll32.exe rundll32.exe PID 1088 wrote to memory of 1112 1088 rundll32.exe rundll32.exe PID 1088 wrote to memory of 1112 1088 rundll32.exe rundll32.exe PID 1088 wrote to memory of 1112 1088 rundll32.exe rundll32.exe PID 1088 wrote to memory of 1112 1088 rundll32.exe rundll32.exe PID 1088 wrote to memory of 1112 1088 rundll32.exe rundll32.exe PID 1088 wrote to memory of 1112 1088 rundll32.exe rundll32.exe PID 1088 wrote to memory of 1112 1088 rundll32.exe rundll32.exe PID 1112 wrote to memory of 320 1112 rundll32.exe rundll32.exe PID 1112 wrote to memory of 320 1112 rundll32.exe rundll32.exe PID 1112 wrote to memory of 320 1112 rundll32.exe rundll32.exe PID 1112 wrote to memory of 320 1112 rundll32.exe rundll32.exe PID 1112 wrote to memory of 320 1112 rundll32.exe rundll32.exe PID 1112 wrote to memory of 320 1112 rundll32.exe rundll32.exe PID 1112 wrote to memory of 320 1112 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\04127316b9d7776ed0054f2a1d0a69e9475ece1f5790d95cf9d46a291026d9dc.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\04127316b9d7776ed0054f2a1d0a69e9475ece1f5790d95cf9d46a291026d9dc.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\04127316b9d7776ed0054f2a1d0a69e9475ece1f5790d95cf9d46a291026d9dc.dll",Control_RunDLL3⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Pbvtowvzgidhha\pttambfv.rct",wcYGuHbUJwrfODU4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Pbvtowvzgidhha\pttambfv.rct",Control_RunDLL5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/320-62-0x0000000000000000-mapping.dmp
-
memory/320-65-0x0000000010000000-0x0000000010028000-memory.dmpFilesize
160KB
-
memory/320-66-0x0000000010000000-0x0000000010028000-memory.dmpFilesize
160KB
-
memory/1088-56-0x0000000000000000-mapping.dmp
-
memory/1088-60-0x0000000010000000-0x0000000010028000-memory.dmpFilesize
160KB
-
memory/1112-59-0x0000000000000000-mapping.dmp
-
memory/1112-63-0x0000000010000000-0x0000000010028000-memory.dmpFilesize
160KB
-
memory/1240-54-0x0000000000000000-mapping.dmp
-
memory/1240-55-0x0000000076221000-0x0000000076223000-memory.dmpFilesize
8KB
-
memory/1240-57-0x0000000010000000-0x0000000010028000-memory.dmpFilesize
160KB