emotet | 4a6a2b0f9106f473e07735edb3bb1987728fcb4522afedad28b2e88476357172

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7v20201028
submitted
07-01-2021 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8088473cb357050baf08a2f17c1ca4ef.dll
Size

322KB
MD5

8088473cb357050baf08a2f17c1ca4ef
SHA1

e0224d2797f107849932317c7516c6f6af32e06f
SHA256

4a6a2b0f9106f473e07735edb3bb1987728fcb4522afedad28b2e88476357172
SHA512

d5b582066bd3966a0ae07a58cc61a46ed750a5408e99f5f0b3d1fdcffd95ec1667674fea22b15e78332bf14e4cd30bf2985a77164bad4c6ea001e28f9e93c654

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

197.87.160.216:80

78.188.225.105:80

50.116.111.59:8080

173.249.20.233:443

188.165.214.98:8080

188.219.31.12:80

157.245.99.39:8080

172.125.40.123:80

62.30.7.67:443

120.150.60.189:80

109.74.5.95:8080

67.10.155.92:80

67.170.250.203:443

2.58.16.89:8080

186.74.215.34:80

202.141.243.254:443

118.83.154.64:443

172.86.188.251:8080

37.187.72.193:8080

87.106.139.101:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

6 664 rundll32.exe
9 664 rundll32.exe
10 664 rundll32.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

rundll32.exe

pid process

664 rundll32.exe
664 rundll32.exe
664 rundll32.exe

flow	pid	process
6	664	rundll32.exe
9	664	rundll32.exe
10	664	rundll32.exe

pid	process
664	rundll32.exe
664	rundll32.exe
664	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1432 wrote to memory of 664	1432	rundll32.exe	rundll32.exe
PID 1432 wrote to memory of 664	1432	rundll32.exe	rundll32.exe
PID 1432 wrote to memory of 664	1432	rundll32.exe	rundll32.exe
PID 1432 wrote to memory of 664	1432	rundll32.exe	rundll32.exe
PID 1432 wrote to memory of 664	1432	rundll32.exe	rundll32.exe
PID 1432 wrote to memory of 664	1432	rundll32.exe	rundll32.exe
PID 1432 wrote to memory of 664	1432	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8088473cb357050baf08a2f17c1ca4ef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1432

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8088473cb357050baf08a2f17c1ca4ef.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/664-2-0x0000000000000000-mapping.dmp

Download
memory/664-3-0x0000000000270000-0x000000000028F000-memory.dmp

Filesize
124KB

Download
memory/1924-4-0x000007FEF74A0000-0x000007FEF771A000-memory.dmp

Filesize
2.5MB

Download