emotet | 871cb569a95e8bf40dd59ebb85fb83d4d2da75239891a9daa665d29872fd1c91

Analysis

max time kernel
266s
max time network
269s
platform
windows10_x64
resource
win10v20201028
submitted
26-01-2021 06:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

871cb569a95e8bf40dd59ebb85fb83d4d2da75239891a9daa665d29872fd1c91.dll
Size

614KB
MD5

07190fd876be5645f65465a5dfd2775d
SHA1

a1eec86f8787ecb81ee2976e0438c1acd2038fe1
SHA256

871cb569a95e8bf40dd59ebb85fb83d4d2da75239891a9daa665d29872fd1c91
SHA512

4c5e8fb108348dd30572d07c6031452fed5d31df58f42d4b74d07d265f5ccfc233d6a719351fcf4737169148840ab1c2f2b44b6558dad4b5c749cb0bc5d0c38f

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

69.38.130.14:80

195.159.28.230:8080

162.241.204.233:8080

181.165.68.127:80

49.205.182.134:80

190.251.200.206:80

139.59.60.244:8080

119.59.116.21:8080

89.216.122.92:80

185.94.252.104:443

70.92.118.112:80

78.24.219.147:8080

173.70.61.180:80

87.106.139.101:8080

66.57.108.14:443

24.179.13.119:80

121.124.124.40:7080

61.19.246.238:443

200.116.145.225:443

93.146.48.84:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

13 3172 rundll32.exe
17 3172 rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

3172 rundll32.exe
3172 rundll32.exe
3172 rundll32.exe
3172 rundll32.exe
3172 rundll32.exe
3172 rundll32.exe

flow	pid	process
13	3172	rundll32.exe
17	3172	rundll32.exe

pid	process
3172	rundll32.exe
3172	rundll32.exe
3172	rundll32.exe
3172	rundll32.exe
3172	rundll32.exe
3172	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3884 wrote to memory of 3172	3884	rundll32.exe	rundll32.exe
PID 3884 wrote to memory of 3172	3884	rundll32.exe	rundll32.exe
PID 3884 wrote to memory of 3172	3884	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\871cb569a95e8bf40dd59ebb85fb83d4d2da75239891a9daa665d29872fd1c91.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\871cb569a95e8bf40dd59ebb85fb83d4d2da75239891a9daa665d29872fd1c91.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3172-2-0x0000000000000000-mapping.dmp

Download
memory/3172-3-0x0000000000641000-0x00000000006A4000-memory.dmp

Filesize
396KB

Download
memory/3172-4-0x0000000000880000-0x00000000008A6000-memory.dmp

Filesize
152KB

Download
memory/3172-5-0x0000000000640000-0x0000000000663000-memory.dmp

Filesize
140KB

Download