Analysis
-
max time kernel
134s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2023 17:30
Static task
static1
Behavioral task
behavioral1
Sample
6a847af3c34a1f6a807a53b84e4960f4.dll
Resource
win7-20231215-en
General
-
Target
6a847af3c34a1f6a807a53b84e4960f4.dll
-
Size
432KB
-
MD5
6a847af3c34a1f6a807a53b84e4960f4
-
SHA1
cfc785dfed7294f7109ec2f19709cce5dd66c541
-
SHA256
6f6d6e33ae558f05aa510158ed5e167ebc9460609a92668015ace0d766bb72c4
-
SHA512
9b7b00809f89187f367494f3421d581ff5eb1372cc69aedf860b64fdba7979fb6fbfd0b9ddaba5de85f42f57cec8fda3fdbfca7ac8afac9333662211240d8e22
-
SSDEEP
12288:rkEjer16eQSqXL4m1EiOS1OrX3sBqCjM7cuJceViQjnbbyADuCgs:rk2E1kEi1asBqCM7liQjbFuO
Malware Config
Extracted
emotet
Epoch2
24.231.88.85:80
191.112.178.60:80
50.116.111.59:8080
173.249.20.233:443
188.165.214.98:8080
74.40.205.197:443
62.75.141.82:80
2.58.16.89:8080
188.219.31.12:80
95.213.236.64:8080
72.186.136.247:443
185.201.9.197:8080
203.153.216.189:7080
202.134.4.216:8080
72.229.97.235:80
24.179.13.119:80
174.118.202.24:443
74.208.45.104:8080
51.89.36.180:443
202.141.243.254:443
142.112.10.95:20
172.104.97.173:8080
136.244.110.184:8080
79.137.83.50:443
61.19.246.238:443
119.59.116.21:8080
109.74.5.95:8080
37.187.72.193:8080
181.171.209.241:443
100.37.240.62:80
24.69.65.8:8080
123.176.25.234:80
74.128.121.17:80
98.109.133.80:80
161.0.153.60:80
37.139.21.175:8080
178.152.87.96:80
172.86.188.251:8080
94.23.237.171:443
110.145.77.103:80
5.39.91.110:7080
46.105.131.79:8080
120.150.60.189:80
173.70.61.180:80
190.29.166.0:80
59.21.235.119:80
70.92.118.112:80
41.185.28.84:8080
201.241.127.190:80
85.105.111.166:80
152.170.205.73:80
187.161.206.24:80
118.83.154.64:443
190.240.194.77:443
202.134.4.211:8080
78.24.219.147:8080
89.216.122.92:80
200.116.145.225:443
197.211.245.21:80
194.190.67.75:80
139.99.158.11:443
190.162.215.233:80
115.94.207.99:443
139.162.60.124:8080
167.114.153.111:8080
176.111.60.55:8080
78.189.148.42:80
134.209.144.106:443
138.68.87.218:443
110.145.101.66:443
172.125.40.123:80
87.106.139.101:8080
70.183.211.3:80
64.207.182.168:8080
157.245.99.39:8080
181.165.68.127:80
62.171.142.179:8080
75.177.207.146:80
209.141.54.221:7080
70.180.33.202:80
109.116.245.80:80
144.217.7.207:7080
50.91.114.38:80
139.59.60.244:8080
97.120.3.198:80
121.124.124.40:7080
104.131.11.150:443
67.170.250.203:443
185.94.252.104:443
220.245.198.194:80
49.205.182.134:80
50.245.107.73:443
172.105.13.66:443
5.2.212.254:80
78.188.225.105:80
120.150.218.241:443
93.146.48.84:80
110.145.11.73:80
168.235.67.138:7080
217.20.166.178:7080
24.178.90.49:80
95.9.5.93:80
194.4.58.192:7080
47.144.21.37:80
62.30.7.67:443
Signatures
-
Blocklisted process makes network request 6 IoCs
Processes:
rundll32.exeflow pid process 31 3244 rundll32.exe 54 3244 rundll32.exe 58 3244 rundll32.exe 63 3244 rundll32.exe 65 3244 rundll32.exe 66 3244 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3244 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Xtmrnz\zuzlz.bhn rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
rundll32.exepid process 3244 rundll32.exe 3244 rundll32.exe 3244 rundll32.exe 3244 rundll32.exe 3244 rundll32.exe 3244 rundll32.exe 3244 rundll32.exe 3244 rundll32.exe 3244 rundll32.exe 3244 rundll32.exe 3244 rundll32.exe 3244 rundll32.exe 3244 rundll32.exe 3244 rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
rundll32.exepid process 1896 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2892 wrote to memory of 1896 2892 rundll32.exe rundll32.exe PID 2892 wrote to memory of 1896 2892 rundll32.exe rundll32.exe PID 2892 wrote to memory of 1896 2892 rundll32.exe rundll32.exe PID 1896 wrote to memory of 3244 1896 rundll32.exe rundll32.exe PID 1896 wrote to memory of 3244 1896 rundll32.exe rundll32.exe PID 1896 wrote to memory of 3244 1896 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6a847af3c34a1f6a807a53b84e4960f4.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6a847af3c34a1f6a807a53b84e4960f4.dll,#12⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Xtmrnz\zuzlz.bhn",Control_RunDLL3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\Xtmrnz\zuzlz.bhnFilesize
432KB
MD56a847af3c34a1f6a807a53b84e4960f4
SHA1cfc785dfed7294f7109ec2f19709cce5dd66c541
SHA2566f6d6e33ae558f05aa510158ed5e167ebc9460609a92668015ace0d766bb72c4
SHA5129b7b00809f89187f367494f3421d581ff5eb1372cc69aedf860b64fdba7979fb6fbfd0b9ddaba5de85f42f57cec8fda3fdbfca7ac8afac9333662211240d8e22
-
memory/1896-0-0x0000000002570000-0x0000000002590000-memory.dmpFilesize
128KB
-
memory/3244-4-0x0000000000BA0000-0x0000000000BC0000-memory.dmpFilesize
128KB