emotet | 295b2e9c35ae5b220723699e0046df5be8e2e5d811505ce403a3dde70fc93507

Analysis

max time kernel
152s
max time network
148s
platform
windows7_x64
resource
win7v20201028
submitted
28/12/2020, 20:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
emotet_exe_e1_295b2e9c35ae5b220723699e0046df5be8e2e5d811505ce403a3dde70fc93507_2020-12-28__202327.exe.dll
Size 504KB
Sample201228-km3jsgnn92
SHA256 295b2e9c35ae5b220723699e0046df5be8e2e5d811505ce403a3dde70fc93507
MD5 b436775bf591f59b660f4074c589bc8f
SHA1 7b069f3cf6f09faab282ceef1655275db0182835
SHA512 d5201d918ac518335d5559615a910cc56f4ea0e5c9a38f6fb157209bd1c56df35276bdbb43f5aa9f64be4877fc3103a9c4b52cf775e02608320b2ee369979ac6
MD5 SHA1 SHA512

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

190.210.246.253:80
31.27.59.105:80
167.71.148.58:443
211.215.18.93:8080
1.234.65.61:80
122.201.23.45:443
190.162.232.138:80
2.80.112.146:80
185.183.16.47:80
181.30.61.163:443
45.16.226.117:443
209.236.123.42:8080
70.32.115.157:8080
45.184.103.73:80
191.182.6.118:80
181.61.182.143:80
110.39.162.2:443
81.215.230.173:443
108.4.209.15:80
188.135.15.49:80
5.196.35.138:7080
187.162.248.237:80
190.136.176.89:80
138.97.60.141:7080
87.106.46.107:8080
118.38.110.192:80
191.241.233.198:80
184.66.18.83:80
181.136.190.86:80
152.169.22.67:80
172.245.248.239:8080
1.226.84.243:8080
137.74.106.111:7080
188.225.32.231:7080
68.183.190.199:8080
104.131.41.185:8080
172.104.169.32:8080
212.71.237.140:8080
80.15.100.37:80
95.76.153.115:80
181.120.29.49:80
177.23.7.151:80
46.101.58.37:8080
213.52.74.198:80
177.144.130.105:8080
110.39.160.38:443
12.162.84.2:8080
35.143.99.174:80
186.146.13.184:443
113.163.216.135:80
94.176.234.118:443
200.24.255.23:80
82.76.111.249:443
81.214.253.80:443
192.175.111.212:7080
202.79.24.136:443
190.64.88.186:443
51.15.7.145:80
190.114.254.163:8080
46.105.114.137:8080
191.53.80.88:80
51.255.165.160:8080
187.39.237.56:8080
192.232.229.53:4143
149.202.72.142:7080
111.67.12.222:8080
81.213.175.132:80
178.250.54.208:8080
168.121.4.238:80
192.232.229.54:7080
201.75.62.86:80
178.211.45.66:8080
155.186.9.160:80
111.67.12.221:8080
138.97.60.140:8080
62.84.75.50:80
70.32.84.74:8080
190.251.216.100:80
85.214.26.7:8080
59.148.253.194:8080
202.187.222.40:80
93.148.247.169:80
190.195.129.227:8090
177.144.130.105:443
197.232.36.108:80
60.93.23.51:80
83.169.21.32:7080
217.13.106.14:8080
202.134.4.210:7080
190.24.243.186:80
77.78.196.173:443
190.45.24.210:80
46.43.2.95:8080
50.28.51.143:8080
185.94.252.27:443
24.232.228.233:80
177.85.167.10:80
187.162.250.23:443
12.163.208.58:80
68.183.170.114:8080
105.209.235.113:8080
191.223.36.170:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 1 IoCs

flow	pid	Process
6	2008	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2008	rundll32.exe
2008	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2008	1680	rundll32.exe	25
PID 1680 wrote to memory of 2008	1680	rundll32.exe	25
PID 1680 wrote to memory of 2008	1680	rundll32.exe	25
PID 1680 wrote to memory of 2008	1680	rundll32.exe	25
PID 1680 wrote to memory of 2008	1680	rundll32.exe	25
PID 1680 wrote to memory of 2008	1680	rundll32.exe	25
PID 1680 wrote to memory of 2008	1680	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_295b2e9c35ae5b220723699e0046df5be8e2e5d811505ce403a3dde70fc93507_2020-12-28__202327.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_295b2e9c35ae5b220723699e0046df5be8e2e5d811505ce403a3dde70fc93507_2020-12-28__202327.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:2008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/848-4-0x000007FEF7080000-0x000007FEF72FA000-memory.dmp

Download

memory/2008-3-0x00000000001F0000-0x000000000020F000-memory.dmp

Download