emotet | fdcf1b5310c80b5149b310e4a147423f152f4e9bb16b96f08496f686805dbc35

Analysis

max time kernel
256s
max time network
259s
platform
windows10_x64
resource
win10v20201028
submitted
25-01-2021 13:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fdcf1b5310c80b5149b310e4a147423f152f4e9bb16b96f08496f686805dbc35.dll
Size

614KB
MD5

36c20dd51d0827bb9a18ac22426f5b04
SHA1

17d240f71a8e927f62794d1566ca2617c0c6a213
SHA256

fdcf1b5310c80b5149b310e4a147423f152f4e9bb16b96f08496f686805dbc35
SHA512

a8af3a70111ab5b6979ee941509d8b1c94f216e8de578e73300f728a8547b53041342c5d342848e48470f04c89e5055e4e232eacb8f0c6f1a9db0cd04fd623c2

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

69.38.130.14:80

195.159.28.230:8080

162.241.204.233:8080

181.165.68.127:80

49.205.182.134:80

190.251.200.206:80

139.59.60.244:8080

119.59.116.21:8080

89.216.122.92:80

185.94.252.104:443

70.92.118.112:80

78.24.219.147:8080

173.70.61.180:80

87.106.139.101:8080

66.57.108.14:443

24.179.13.119:80

121.124.124.40:7080

61.19.246.238:443

200.116.145.225:443

93.146.48.84:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

12 1520 rundll32.exe
16 1520 rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

1520 rundll32.exe
1520 rundll32.exe
1520 rundll32.exe
1520 rundll32.exe
1520 rundll32.exe
1520 rundll32.exe

flow	pid	process
12	1520	rundll32.exe
16	1520	rundll32.exe

pid	process
1520	rundll32.exe
1520	rundll32.exe
1520	rundll32.exe
1520	rundll32.exe
1520	rundll32.exe
1520	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 8 wrote to memory of 1520	8	rundll32.exe	rundll32.exe
PID 8 wrote to memory of 1520	8	rundll32.exe	rundll32.exe
PID 8 wrote to memory of 1520	8	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fdcf1b5310c80b5149b310e4a147423f152f4e9bb16b96f08496f686805dbc35.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fdcf1b5310c80b5149b310e4a147423f152f4e9bb16b96f08496f686805dbc35.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1520-2-0x0000000000000000-mapping.dmp

Download
memory/1520-4-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1520-3-0x0000000000EB0000-0x0000000000ED6000-memory.dmp

Filesize
152KB

Download