emotet | c74f3a233d5b696179b77f20ac229bd3e4641a4e7ad459a7afef89f76514e502

Analysis

max time kernel
296s
max time network
299s
platform
windows10_x64
resource
win10v20201028
submitted
25-01-2021 16:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c74f3a233d5b696179b77f20ac229bd3e4641a4e7ad459a7afef89f76514e502.dll
Size

614KB
MD5

9e107e6eb4acb36c51e45cf05afa0805
SHA1

63241bf2043d4122e4e9ec8c66bbf6dbbbe6b5d3
SHA256

c74f3a233d5b696179b77f20ac229bd3e4641a4e7ad459a7afef89f76514e502
SHA512

4a54ffc9db07724f4b0b322766c30a69bee22ef249143a9c5aa88dd22d395249f8dd4fbba05c699d87a2dcf332fce10ad1fed829fcd54a92d752d2f653f5432b

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

69.38.130.14:80

195.159.28.230:8080

162.241.204.233:8080

181.165.68.127:80

49.205.182.134:80

190.251.200.206:80

139.59.60.244:8080

119.59.116.21:8080

89.216.122.92:80

185.94.252.104:443

70.92.118.112:80

78.24.219.147:8080

173.70.61.180:80

87.106.139.101:8080

66.57.108.14:443

24.179.13.119:80

121.124.124.40:7080

61.19.246.238:443

200.116.145.225:443

93.146.48.84:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

15 400 rundll32.exe
16 400 rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

400 rundll32.exe
400 rundll32.exe
400 rundll32.exe
400 rundll32.exe
400 rundll32.exe
400 rundll32.exe

flow	pid	process
15	400	rundll32.exe
16	400	rundll32.exe

pid	process
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 640 wrote to memory of 400	640	rundll32.exe	rundll32.exe
PID 640 wrote to memory of 400	640	rundll32.exe	rundll32.exe
PID 640 wrote to memory of 400	640	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c74f3a233d5b696179b77f20ac229bd3e4641a4e7ad459a7afef89f76514e502.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c74f3a233d5b696179b77f20ac229bd3e4641a4e7ad459a7afef89f76514e502.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/400-2-0x0000000000000000-mapping.dmp

Download
memory/400-4-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/400-3-0x0000000001250000-0x0000000001276000-memory.dmp

Filesize
152KB

Download