emotet | 344a26b3735b69aa253f7873605cb9eca09082b943f9602e11bd4eca5e3c58e9

Analysis

max time kernel
264s
max time network
266s
platform
windows10_x64
resource
win10v20201028
submitted
25-01-2021 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

344a26b3735b69aa253f7873605cb9eca09082b943f9602e11bd4eca5e3c58e9.dll
Size

614KB
MD5

c3d8cfea09389c074a7f1ae4599fc1a2
SHA1

983bd6abfc74e21d7a911c3387ece1a273d3f842
SHA256

344a26b3735b69aa253f7873605cb9eca09082b943f9602e11bd4eca5e3c58e9
SHA512

5e2388b5aceaccdf3c55893ccf31b0884c3b7d7cdf0f12f3852ed5b8ad82f601c7d88a2793e5c814268e6047e40284c49d657b3a4d546f95f1e645a82ed2ec0e

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

69.38.130.14:80

195.159.28.230:8080

162.241.204.233:8080

181.165.68.127:80

49.205.182.134:80

190.251.200.206:80

139.59.60.244:8080

119.59.116.21:8080

89.216.122.92:80

185.94.252.104:443

70.92.118.112:80

78.24.219.147:8080

173.70.61.180:80

87.106.139.101:8080

66.57.108.14:443

24.179.13.119:80

121.124.124.40:7080

61.19.246.238:443

200.116.145.225:443

93.146.48.84:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

18 1712 rundll32.exe
19 1712 rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

1712 rundll32.exe
1712 rundll32.exe
1712 rundll32.exe
1712 rundll32.exe
1712 rundll32.exe
1712 rundll32.exe

flow	pid	process
18	1712	rundll32.exe
19	1712	rundll32.exe

pid	process
1712	rundll32.exe
1712	rundll32.exe
1712	rundll32.exe
1712	rundll32.exe
1712	rundll32.exe
1712	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2604 wrote to memory of 1712	2604	rundll32.exe	rundll32.exe
PID 2604 wrote to memory of 1712	2604	rundll32.exe	rundll32.exe
PID 2604 wrote to memory of 1712	2604	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\344a26b3735b69aa253f7873605cb9eca09082b943f9602e11bd4eca5e3c58e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\344a26b3735b69aa253f7873605cb9eca09082b943f9602e11bd4eca5e3c58e9.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1712-2-0x0000000000000000-mapping.dmp

Download
memory/1712-3-0x0000000002F90000-0x0000000002FB6000-memory.dmp

Filesize
152KB

Download
memory/1712-4-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download