emotet | da24479545e3c7454774b689cdb7c373cdcd40bf3bb5c928f57f5b733773765d

Analysis

max time kernel
250s
max time network
300s
platform
windows10_x64
resource
win10v20201028
submitted
24-01-2021 19:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da24479545e3c7454774b689cdb7c373cdcd40bf3bb5c928f57f5b733773765d.dll
Size

340KB
MD5

385eb1167a29b071ac22a0f5d9fa98cc
SHA1

275505abeffeee3d98654523f34842c7e101ef69
SHA256

da24479545e3c7454774b689cdb7c373cdcd40bf3bb5c928f57f5b733773765d
SHA512

6e3c4c98488857954f0298198cec9c990d8c7c4fa49bdba99b750e2eca878f63a1d5b33255b40437da3efd02dc9ed0edea92e547bf65f69e9611f876079239ba

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

69.38.130.14:80

195.159.28.230:8080

162.241.204.233:8080

115.21.224.117:80

78.189.148.42:80

181.165.68.127:80

78.188.225.105:80

161.0.153.60:80

89.106.251.163:80

172.125.40.123:80

5.39.91.110:7080

110.145.11.73:80

190.251.200.206:80

144.217.7.207:7080

75.109.111.18:80

75.177.207.146:80

139.59.60.244:8080

70.183.211.3:80

95.213.236.64:8080

61.19.246.238:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

15 392 rundll32.exe
16 392 rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

392 rundll32.exe
392 rundll32.exe
392 rundll32.exe
392 rundll32.exe
392 rundll32.exe
392 rundll32.exe

flow	pid	process
15	392	rundll32.exe
16	392	rundll32.exe

pid	process
392	rundll32.exe
392	rundll32.exe
392	rundll32.exe
392	rundll32.exe
392	rundll32.exe
392	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 644 wrote to memory of 392	644	rundll32.exe	rundll32.exe
PID 644 wrote to memory of 392	644	rundll32.exe	rundll32.exe
PID 644 wrote to memory of 392	644	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\da24479545e3c7454774b689cdb7c373cdcd40bf3bb5c928f57f5b733773765d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\da24479545e3c7454774b689cdb7c373cdcd40bf3bb5c928f57f5b733773765d.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/392-2-0x0000000000000000-mapping.dmp

Download
memory/392-4-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/392-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download