emotet | ace5ddc10143a31cc2df2146715a6f06aabce2bc62283d744129cad0df6caf24

Analysis

max time kernel
14s
max time network
122s
platform
windows10_x64
resource
win10v20201028
submitted
21/12/2020, 18:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nmji.ard.dll
Size 225KB
Sample201221-s9fdsmr4px
SHA256 ace5ddc10143a31cc2df2146715a6f06aabce2bc62283d744129cad0df6caf24
MD5 a5f973505a28aeedb5439640bb4cbe69
SHA1 cb0b0411f9c201377fcc3569dba02ebd43da9222
SHA512 700b7169b3bd2e998348f61291ae609655008a55d1cb425c099a19aaa54f4d552005aefafd4467b4ed9928ba128728a9e2f48236e34aa4b5deb7601df9cff525
MD5 SHA1 SHA512

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

95.76.153.115:80
191.241.233.198:80
167.71.148.58:443
211.215.18.93:8080
1.234.65.61:80
60.93.23.51:80
51.15.7.145:80
190.24.243.186:80
190.64.88.186:443
186.146.13.184:443
177.85.167.10:80
59.148.253.194:8080
155.186.9.160:80
51.255.165.160:8080
149.202.72.142:7080
111.67.12.221:8080
185.183.16.47:80
111.67.12.222:8080
190.195.129.227:8090
71.58.233.254:80
104.131.41.185:8080
85.214.26.7:8080
1.226.84.243:8080
110.39.160.38:443
213.52.74.198:80
192.232.229.54:7080
172.104.169.32:8080
5.196.35.138:7080
137.74.106.111:7080
181.30.61.163:443
68.183.170.114:8080
45.16.226.117:443
168.121.4.238:80
190.251.216.100:80
46.101.58.37:8080
191.182.6.118:80
70.32.84.74:8080
77.78.196.173:443
103.236.179.162:80
181.120.29.49:80
50.28.51.143:8080
181.61.182.143:80
46.43.2.95:8080
209.236.123.42:8080
172.245.248.239:8080
188.135.15.49:80
122.201.23.45:443
177.23.7.151:80
68.183.190.199:8080
192.175.111.212:7080
201.75.62.86:80
191.223.36.170:80
202.79.24.136:443
105.209.235.113:8080
177.144.130.105:443
81.213.175.132:80
190.45.24.210:80
190.114.254.163:8080
217.13.106.14:8080
87.106.46.107:8080
45.184.103.73:80
138.97.60.141:7080
81.215.230.173:443
192.232.229.53:4143
80.15.100.37:80
178.211.45.66:8080
187.162.248.237:80
189.2.177.210:443
187.162.250.23:443
82.76.111.249:443
170.81.48.2:80
93.148.247.169:80
110.39.162.2:443
46.105.114.137:8080
113.163.216.135:80
70.32.115.157:8080
62.84.75.50:80
152.169.22.67:80
24.232.228.233:80
35.143.99.174:80
138.97.60.140:8080
83.169.21.32:7080
212.71.237.140:8080
188.225.32.231:7080
12.163.208.58:80
185.94.252.27:443
202.134.4.210:7080
177.144.130.105:8080
178.250.54.208:8080
197.232.36.108:80
12.162.84.2:8080
94.176.234.118:443
81.214.253.80:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 1 IoCs

flow	pid	Process
13	1264	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1264	rundll32.exe
1264	rundll32.exe
1264	rundll32.exe
1264	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1264	1160	rundll32.exe	70
PID 1160 wrote to memory of 1264	1160	rundll32.exe	70
PID 1160 wrote to memory of 1264	1160	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\nmji.ard.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\nmji.ard.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1264-3-0x0000000004BD0000-0x0000000004BF2000-memory.dmp

Download