emotet | d2a1f7791f077d47cedcccafccea2648d30438ac948cd77ae5396592eb2be003

Analysis

max time kernel
233s
max time network
235s
platform
windows10_x64
resource
win10v20201028
submitted
24-01-2021 20:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2a1f7791f077d47cedcccafccea2648d30438ac948cd77ae5396592eb2be003.dll
Size

340KB
MD5

ad6b420ad8ed769176b12e1830751a19
SHA1

b9784792c810d45fd238ec979886da54af89283e
SHA256

d2a1f7791f077d47cedcccafccea2648d30438ac948cd77ae5396592eb2be003
SHA512

1ac0f5e35d06bb39fb882436cd45a4aebd47da7b874fe74d9a462ea18f1e2219c1c69c08178c83386b0c7f08b5098624a2f20716901401f62a5b55a9f19b0862

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

69.38.130.14:80

195.159.28.230:8080

162.241.204.233:8080

115.21.224.117:80

78.189.148.42:80

181.165.68.127:80

78.188.225.105:80

161.0.153.60:80

89.106.251.163:80

172.125.40.123:80

5.39.91.110:7080

110.145.11.73:80

190.251.200.206:80

144.217.7.207:7080

75.109.111.18:80

75.177.207.146:80

139.59.60.244:8080

70.183.211.3:80

95.213.236.64:8080

61.19.246.238:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

23 3692 rundll32.exe
24 3692 rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

3692 rundll32.exe
3692 rundll32.exe
3692 rundll32.exe
3692 rundll32.exe
3692 rundll32.exe
3692 rundll32.exe

flow	pid	process
23	3692	rundll32.exe
24	3692	rundll32.exe

pid	process
3692	rundll32.exe
3692	rundll32.exe
3692	rundll32.exe
3692	rundll32.exe
3692	rundll32.exe
3692	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 580 wrote to memory of 3692	580	rundll32.exe	rundll32.exe
PID 580 wrote to memory of 3692	580	rundll32.exe	rundll32.exe
PID 580 wrote to memory of 3692	580	rundll32.exe	rundll32.exe

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d2a1f7791f077d47cedcccafccea2648d30438ac948cd77ae5396592eb2be003.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:3692

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d2a1f7791f077d47cedcccafccea2648d30438ac948cd77ae5396592eb2be003.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3692-2-0x0000000000000000-mapping.dmp

Download
memory/3692-3-0x00000000003B0000-0x00000000003D0000-memory.dmp

Filesize
128KB

Download
memory/3692-4-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download