emotet | af6a5eac70f2f2e02d183cd8086afe3d27471d112fd0c2746b12af451c148a5d

Analysis

max time kernel
265s
max time network
267s
platform
windows10_x64
resource
win10v20201028
submitted
24-01-2021 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af6a5eac70f2f2e02d183cd8086afe3d27471d112fd0c2746b12af451c148a5d.dll
Size

340KB
MD5

e77d9e223b3998ebbb9473d4764e7d2e
SHA1

a8647f0c3faa466afdd5a29f7dc2bc251edd15c5
SHA256

af6a5eac70f2f2e02d183cd8086afe3d27471d112fd0c2746b12af451c148a5d
SHA512

ac06a4a8e609b3580b366b71fd0a3a79caaae8d29ccaa66e6479b5392b4d91e1a640c8fe50fd4eea4a756cd3dad813a27a8c0427572f0f7baae46f2549c82d0d

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

69.38.130.14:80

195.159.28.230:8080

162.241.204.233:8080

115.21.224.117:80

78.189.148.42:80

181.165.68.127:80

78.188.225.105:80

161.0.153.60:80

89.106.251.163:80

172.125.40.123:80

5.39.91.110:7080

110.145.11.73:80

190.251.200.206:80

144.217.7.207:7080

75.109.111.18:80

75.177.207.146:80

139.59.60.244:8080

70.183.211.3:80

95.213.236.64:8080

61.19.246.238:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

16 4764 rundll32.exe
17 4764 rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

4764 rundll32.exe
4764 rundll32.exe
4764 rundll32.exe
4764 rundll32.exe
4764 rundll32.exe
4764 rundll32.exe

flow	pid	process
16	4764	rundll32.exe
17	4764	rundll32.exe

pid	process
4764	rundll32.exe
4764	rundll32.exe
4764	rundll32.exe
4764	rundll32.exe
4764	rundll32.exe
4764	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4704 wrote to memory of 4764	4704	rundll32.exe	rundll32.exe
PID 4704 wrote to memory of 4764	4704	rundll32.exe	rundll32.exe
PID 4704 wrote to memory of 4764	4704	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af6a5eac70f2f2e02d183cd8086afe3d27471d112fd0c2746b12af451c148a5d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\af6a5eac70f2f2e02d183cd8086afe3d27471d112fd0c2746b12af451c148a5d.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:4764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4764-2-0x0000000000000000-mapping.dmp

Download
memory/4764-3-0x0000000002BA0000-0x0000000002BC0000-memory.dmp

Filesize
128KB

Download
memory/4764-4-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download