emotet | 50f2720eb123111a10d2d2b0622a5ff1606f24069e8bfe19aa0e0c1ea080b8bc

Analysis

max time kernel
298s
max time network
300s
platform
windows10_x64
resource
win10v20201028
submitted
24-01-2021 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50f2720eb123111a10d2d2b0622a5ff1606f24069e8bfe19aa0e0c1ea080b8bc.dll
Size

340KB
MD5

9890f234acf38add7dfae55b17c71a69
SHA1

4e88cf5a987653d1d92cee7b4f9907f70b5a9a3c
SHA256

50f2720eb123111a10d2d2b0622a5ff1606f24069e8bfe19aa0e0c1ea080b8bc
SHA512

ad7a3178c64e81f4806187f6a879539c6ccdf67c70ca4e9841bda0c4728aac33623aae28ebdc58969a3b129ea547db59d2225eda8c6ea6a8c09b77345af52574

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

69.38.130.14:80

195.159.28.230:8080

162.241.204.233:8080

115.21.224.117:80

78.189.148.42:80

181.165.68.127:80

78.188.225.105:80

161.0.153.60:80

89.106.251.163:80

172.125.40.123:80

5.39.91.110:7080

110.145.11.73:80

190.251.200.206:80

144.217.7.207:7080

75.109.111.18:80

75.177.207.146:80

139.59.60.244:8080

70.183.211.3:80

95.213.236.64:8080

61.19.246.238:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

17 880 rundll32.exe
18 880 rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

880 rundll32.exe
880 rundll32.exe
880 rundll32.exe
880 rundll32.exe
880 rundll32.exe
880 rundll32.exe

flow	pid	process
17	880	rundll32.exe
18	880	rundll32.exe

pid	process
880	rundll32.exe
880	rundll32.exe
880	rundll32.exe
880	rundll32.exe
880	rundll32.exe
880	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 580 wrote to memory of 880	580	rundll32.exe	rundll32.exe
PID 580 wrote to memory of 880	580	rundll32.exe	rundll32.exe
PID 580 wrote to memory of 880	580	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\50f2720eb123111a10d2d2b0622a5ff1606f24069e8bfe19aa0e0c1ea080b8bc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\50f2720eb123111a10d2d2b0622a5ff1606f24069e8bfe19aa0e0c1ea080b8bc.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/880-2-0x0000000000000000-mapping.dmp

Download
memory/880-4-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/880-3-0x0000000000710000-0x0000000000730000-memory.dmp

Filesize
128KB

Download