emotet | 13e9b66e1ba38bb7c221084795ac83b0e01aca2fe9dcdde42e1b4d42689fdccf

General

Target
emotet_exe_e1_13e9b66e1ba38bb7c221084795ac83b0e01aca2fe9dcdde42e1b4d42689fdccf_2020-12-22__211404.exe.dll
Size 276KB
Sample201222-d27jbtcyas
SHA256 13e9b66e1ba38bb7c221084795ac83b0e01aca2fe9dcdde42e1b4d42689fdccf
MD5 a77b6137c972cee82849a6cb62acc408
SHA1 21e57c63de0972c6ac4aa1d652cc689b9ca4bbc5
SHA512 5a000c855b9ed5fdab3568e8a6fffe0c9f2b22fb1c74a6060878f5dc53f33896faa85007171b6c4df3cf664dc4a0a93883929c5d492028e602510754967ac3e9
MD5 SHA1 SHA512

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

184.66.18.83:80
202.187.222.40:80
167.71.148.58:443
211.215.18.93:8080
1.234.65.61:80
80.15.100.37:80
155.186.9.160:80
172.104.169.32:8080
110.39.162.2:443
12.162.84.2:8080
181.136.190.86:80
68.183.190.199:8080
191.223.36.170:80
190.45.24.210:80
81.213.175.132:80
181.120.29.49:80
82.76.111.249:443
177.23.7.151:80
95.76.153.115:80
93.148.247.169:80
51.255.165.160:8080
213.52.74.198:80
178.250.54.208:8080
202.134.4.210:7080
138.97.60.141:7080
94.176.234.118:443
190.24.243.186:80
46.43.2.95:8080
197.232.36.108:80
77.78.196.173:443
59.148.253.194:8080
212.71.237.140:8080
46.101.58.37:8080
110.39.160.38:443
83.169.21.32:7080
189.2.177.210:443
81.214.253.80:443
51.15.7.145:80
172.245.248.239:8080
177.85.167.10:80
178.211.45.66:8080
5.196.35.138:7080
71.58.233.254:80
168.121.4.238:80
149.202.72.142:7080
185.183.16.47:80
191.241.233.198:80
209.236.123.42:8080
190.114.254.163:8080
70.32.84.74:8080
138.97.60.140:8080
68.183.170.114:8080
192.232.229.53:4143
62.84.75.50:80
113.163.216.135:80
46.105.114.137:8080
177.144.130.105:8080
192.232.229.54:7080
192.175.111.212:7080
35.143.99.174:80
81.215.230.173:443
1.226.84.243:8080
187.162.248.237:80
152.169.22.67:80
137.74.106.111:7080
191.182.6.118:80
181.61.182.143:80
202.79.24.136:443
50.28.51.143:8080
85.214.26.7:8080
170.81.48.2:80
111.67.12.222:8080
177.144.130.105:443
188.225.32.231:7080
185.94.252.27:443
12.163.208.58:80
191.53.80.88:80
87.106.46.107:8080
122.201.23.45:443
181.30.61.163:443
104.131.41.185:8080
190.195.129.227:8090
45.184.103.73:80
186.146.13.184:443
45.16.226.117:443
187.162.250.23:443
2.80.112.146:80
60.93.23.51:80
24.232.228.233:80
190.251.216.100:80
105.209.235.113:8080
217.13.106.14:8080
190.64.88.186:443
118.38.110.192:80
111.67.12.221:8080
201.75.62.86:80
70.32.115.157:8080
188.135.15.49:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 1 IoCs

flow	pid	Process
13	4796	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4796	rundll32.exe
4796	rundll32.exe
4796	rundll32.exe
4796	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 4796	4700	rundll32.exe	70
PID 4700 wrote to memory of 4796	4700	rundll32.exe	70
PID 4700 wrote to memory of 4796	4700	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_13e9b66e1ba38bb7c221084795ac83b0e01aca2fe9dcdde42e1b4d42689fdccf_2020-12-22__211404.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_13e9b66e1ba38bb7c221084795ac83b0e01aca2fe9dcdde42e1b4d42689fdccf_2020-12-22__211404.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:4796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4796-3-0x0000000000AF0000-0x0000000000B12000-memory.dmp

Download

Analysis

Sharing