emotet | 2e7cb7c987a6ede754bd7db675dc1593590c37f30d034eba34731be6f0a101fe

General

Target
emotet_exe_e1_2e7cb7c987a6ede754bd7db675dc1593590c37f30d034eba34731be6f0a101fe_2020-12-22__142103.exe.dll
Size 244KB
Sample201222-1bs8h8yc8n
SHA256 2e7cb7c987a6ede754bd7db675dc1593590c37f30d034eba34731be6f0a101fe
MD5 6b0e61432dd99d498026bb1e384c1502
SHA1 fc661cf65c01050ee9c521871aff7796ea54c45e
SHA512 f886391e2944cf91f911acd02c2ef38f12d648903e66cf9597c6bf330cdf69dd976c9a98ade4c6fd9bf124ff695b123f7a8589696bf9c83e613a4330225b538e
MD5 SHA1 SHA512

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

184.66.18.83:80
202.187.222.40:80
167.71.148.58:443
211.215.18.93:8080
1.234.65.61:80
80.15.100.37:80
155.186.9.160:80
172.104.169.32:8080
110.39.162.2:443
12.162.84.2:8080
181.136.190.86:80
68.183.190.199:8080
191.223.36.170:80
190.45.24.210:80
81.213.175.132:80
181.120.29.49:80
82.76.111.249:443
177.23.7.151:80
95.76.153.115:80
93.148.247.169:80
51.255.165.160:8080
213.52.74.198:80
178.250.54.208:8080
202.134.4.210:7080
138.97.60.141:7080
94.176.234.118:443
190.24.243.186:80
46.43.2.95:8080
197.232.36.108:80
77.78.196.173:443
59.148.253.194:8080
212.71.237.140:8080
46.101.58.37:8080
110.39.160.38:443
83.169.21.32:7080
189.2.177.210:443
81.214.253.80:443
51.15.7.145:80
172.245.248.239:8080
177.85.167.10:80
178.211.45.66:8080
5.196.35.138:7080
71.58.233.254:80
168.121.4.238:80
149.202.72.142:7080
185.183.16.47:80
191.241.233.198:80
209.236.123.42:8080
190.114.254.163:8080
70.32.84.74:8080
138.97.60.140:8080
68.183.170.114:8080
192.232.229.53:4143
62.84.75.50:80
113.163.216.135:80
46.105.114.137:8080
177.144.130.105:8080
192.232.229.54:7080
192.175.111.212:7080
35.143.99.174:80
81.215.230.173:443
1.226.84.243:8080
187.162.248.237:80
152.169.22.67:80
137.74.106.111:7080
191.182.6.118:80
181.61.182.143:80
202.79.24.136:443
50.28.51.143:8080
85.214.26.7:8080
170.81.48.2:80
111.67.12.222:8080
177.144.130.105:443
188.225.32.231:7080
185.94.252.27:443
12.163.208.58:80
191.53.80.88:80
87.106.46.107:8080
122.201.23.45:443
181.30.61.163:443
104.131.41.185:8080
190.195.129.227:8090
45.184.103.73:80
186.146.13.184:443
45.16.226.117:443
187.162.250.23:443
2.80.112.146:80
60.93.23.51:80
24.232.228.233:80
190.251.216.100:80
105.209.235.113:8080
217.13.106.14:8080
190.64.88.186:443
118.38.110.192:80
111.67.12.221:8080
201.75.62.86:80
70.32.115.157:8080
188.135.15.49:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 1 IoCs

flow	pid	Process
6	1820	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1820	rundll32.exe
1820	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1820	1684	rundll32.exe	25
PID 1684 wrote to memory of 1820	1684	rundll32.exe	25
PID 1684 wrote to memory of 1820	1684	rundll32.exe	25
PID 1684 wrote to memory of 1820	1684	rundll32.exe	25
PID 1684 wrote to memory of 1820	1684	rundll32.exe	25
PID 1684 wrote to memory of 1820	1684	rundll32.exe	25
PID 1684 wrote to memory of 1820	1684	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_2e7cb7c987a6ede754bd7db675dc1593590c37f30d034eba34731be6f0a101fe_2020-12-22__142103.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_2e7cb7c987a6ede754bd7db675dc1593590c37f30d034eba34731be6f0a101fe_2020-12-22__142103.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1344-4-0x000007FEF81B0000-0x000007FEF842A000-memory.dmp

Download

memory/1820-3-0x0000000000210000-0x0000000000232000-memory.dmp