emotet | b7a7327164ad7b34693c4367bb643b7f234c29f22c3fb30d8127c5237bb6f0a1

General

Target
emotet_exe_e1_b7a7327164ad7b34693c4367bb643b7f234c29f22c3fb30d8127c5237bb6f0a1_2020-12-22__000402.exe.dll
Size 232KB
Sample201222-a5eahwb2kn
SHA256 b7a7327164ad7b34693c4367bb643b7f234c29f22c3fb30d8127c5237bb6f0a1
MD5 1089aedf8a10266695862f8d4b176ce2
SHA1 245ad7e6db32c4d0c759612b4af49cce10dab799
SHA512 d0ca7314c0f0562c7c3e0612db585607afcc961a8fd738efd9d3c04e3098ffca6e94196f0c42ef9964a0a76717ec417468ed518495db48fde5e00dd78c871ee0
MD5 SHA1 SHA512

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

118.38.110.192:80
181.136.190.86:80
167.71.148.58:443
211.215.18.93:8080
1.234.65.61:80
209.236.123.42:8080
187.162.250.23:443
172.245.248.239:8080
60.93.23.51:80
177.144.130.105:443
93.148.247.169:80
177.144.130.105:8080
110.39.162.2:443
87.106.46.107:8080
83.169.21.32:7080
191.223.36.170:80
95.76.153.115:80
110.39.160.38:443
45.16.226.117:443
46.43.2.95:8080
201.75.62.86:80
190.114.254.163:8080
12.162.84.2:8080
46.101.58.37:8080
197.232.36.108:80
185.94.252.27:443
70.32.84.74:8080
202.79.24.136:443
2.80.112.146:80
202.134.4.210:7080
105.209.235.113:8080
187.162.248.237:80
190.64.88.186:443
111.67.12.221:8080
5.196.35.138:7080
50.28.51.143:8080
181.30.61.163:443
103.236.179.162:80
81.215.230.173:443
190.251.216.100:80
51.255.165.160:8080
149.202.72.142:7080
192.175.111.212:7080
178.250.54.208:8080
24.232.228.233:80
190.45.24.210:80
45.184.103.73:80
177.85.167.10:80
212.71.237.140:8080
181.120.29.49:80
170.81.48.2:80
68.183.170.114:8080
35.143.99.174:80
217.13.106.14:8080
168.121.4.238:80
172.104.169.32:8080
111.67.12.222:8080
62.84.75.50:80
77.78.196.173:443
177.23.7.151:80
213.52.74.198:80
12.163.208.58:80
1.226.84.243:8080
113.163.216.135:80
188.225.32.231:7080
191.182.6.118:80
81.213.175.132:80
104.131.41.185:8080
152.169.22.67:80
185.183.16.47:80
192.232.229.54:7080
186.146.13.184:443
178.211.45.66:8080
122.201.23.45:443
70.32.115.157:8080
190.24.243.186:80
51.15.7.145:80
46.105.114.137:8080
81.214.253.80:443
192.232.229.53:4143
59.148.253.194:8080
191.241.233.198:80
181.61.182.143:80
190.195.129.227:8090
68.183.190.199:8080
138.97.60.140:8080
138.97.60.141:7080
137.74.106.111:7080
85.214.26.7:8080
71.58.233.254:80
94.176.234.118:443
188.135.15.49:80
80.15.100.37:80
82.76.111.249:443
155.186.9.160:80
189.2.177.210:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 4 IoCs

flow	pid	Process
6	1596	rundll32.exe
9	1596	rundll32.exe
10	1596	rundll32.exe
11	1596	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1596	rundll32.exe
1596	rundll32.exe
1596	rundll32.exe
1596	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 1596	548	rundll32.exe	25
PID 548 wrote to memory of 1596	548	rundll32.exe	25
PID 548 wrote to memory of 1596	548	rundll32.exe	25
PID 548 wrote to memory of 1596	548	rundll32.exe	25
PID 548 wrote to memory of 1596	548	rundll32.exe	25
PID 548 wrote to memory of 1596	548	rundll32.exe	25
PID 548 wrote to memory of 1596	548	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_b7a7327164ad7b34693c4367bb643b7f234c29f22c3fb30d8127c5237bb6f0a1_2020-12-22__000402.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_b7a7327164ad7b34693c4367bb643b7f234c29f22c3fb30d8127c5237bb6f0a1_2020-12-22__000402.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1288-4-0x000007FEF7D40000-0x000007FEF7FBA000-memory.dmp

Download

memory/1596-3-0x00000000001B0000-0x00000000001D2000-memory.dmp