emotet | 998be5a4e606f3cea5b0d08e0f460815dbe2b835d3c4dfe84777d5bbc34d9c6e

Analysis

max time kernel
245s
max time network
247s
platform
windows10_x64
resource
win10v20201028
submitted
26-01-2021 00:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

998be5a4e606f3cea5b0d08e0f460815dbe2b835d3c4dfe84777d5bbc34d9c6e.dll
Size

614KB
MD5

b924af2257c2f595750f388b1dac9a57
SHA1

b10ab1d06c765db8abd2b5807501c96aa2b61fb1
SHA256

998be5a4e606f3cea5b0d08e0f460815dbe2b835d3c4dfe84777d5bbc34d9c6e
SHA512

7512a34624f3ac92a94da0fa3a0d02951c9310b3b3237ef46d591cedd6affdc6540112f28a9fa9004e2cf6788cd3478275b7d272dadf2c6b29bd84fa36cc8d0c

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

69.38.130.14:80

195.159.28.230:8080

162.241.204.233:8080

181.165.68.127:80

49.205.182.134:80

190.251.200.206:80

139.59.60.244:8080

119.59.116.21:8080

89.216.122.92:80

185.94.252.104:443

70.92.118.112:80

78.24.219.147:8080

173.70.61.180:80

87.106.139.101:8080

66.57.108.14:443

24.179.13.119:80

121.124.124.40:7080

61.19.246.238:443

200.116.145.225:443

93.146.48.84:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

11 1784 rundll32.exe
14 1784 rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

1784 rundll32.exe
1784 rundll32.exe
1784 rundll32.exe
1784 rundll32.exe
1784 rundll32.exe
1784 rundll32.exe

flow	pid	process
11	1784	rundll32.exe
14	1784	rundll32.exe

pid	process
1784	rundll32.exe
1784	rundll32.exe
1784	rundll32.exe
1784	rundll32.exe
1784	rundll32.exe
1784	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1404 wrote to memory of 1784	1404	rundll32.exe	rundll32.exe
PID 1404 wrote to memory of 1784	1404	rundll32.exe	rundll32.exe
PID 1404 wrote to memory of 1784	1404	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\998be5a4e606f3cea5b0d08e0f460815dbe2b835d3c4dfe84777d5bbc34d9c6e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\998be5a4e606f3cea5b0d08e0f460815dbe2b835d3c4dfe84777d5bbc34d9c6e.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1784-2-0x0000000000000000-mapping.dmp

Download
memory/1784-3-0x0000000003620000-0x0000000003646000-memory.dmp

Filesize
152KB

Download
memory/1784-4-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download